Function at 0x140002318
Capabilities:
Create thread
Inject thread
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15, rcx
mov ebx, 1
test rdx, rdx
je 0x1400025cb
cmp qword [rsp + 0x5e8], 0
je 0x1400025cb
mov r13d, dword [rsp + 0x5f0]
test r13d, r13d
je 0x1400025cb
mov ebp, r9d
mov rdi, rdx
xor eax, eax
cmp r9d, 0x8664
mov ecx, 0x7f0
cmovne rcx, rax
lea rdx, [0x140108868]
cmovne rdx, rax
cmp r9d, 0x14c
mov ebx, 0x7d0
cmovne rbx, rcx
lea r12, [0x140108098]
cmovne r12, rdx
test r12, r12
je 0x14000259c
mov qword [rsp + 0x60], r8
mov r14d, dword [rsp + 0x600]
lea eax, [rbx + r13]
lea esi, [r14 + rax]
add esi, 0x28
mov dword [rsp + 0x20], 4
mov rcx, rdi
xor edx, edx
mov r8, rsi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1400025c6
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rsi
mov ecx, r13d
mov dword [rsp + 0x70], 0
lea rsi, [rax + rbx]
add rsi, 0x28
mov r15, rax
add r15, rbx
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], r13d
mov qword [rsp + 0x58], rcx
add rcx, r15
add rcx, 0x28
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x88], rcx
mov dword [rsp + 0x90], r14d
lea r13, [rsp + 0x98]
mov qword [r13], 0
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rdx, rax
mov qword [rsp + 0x38], rax
mov r8, r12
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, 4
test eax, eax
je 0x1400025a3
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0x70]
mov r9d, 0x28
mov rcx, rdi
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400025a3
mov r12, r15
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rdx, rsi
mov r8, qword [rsp + 0x5e8]
mov r9, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400025a3
mov r8, qword [rsp + 0x5f8]
mov eax, dword [rsp + 0x600]
mov r9d, eax
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
je 0x1400025ad
lea rax, [rsp + 0x6c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, qword [rsp + 0x38]
mov r8, r14
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000260f
mov eax, dword [rsp + 0x5e0]
cmp eax, 2
je 0x140002616
mov ebx, 0xa
cmp eax, 1
jne 0x1400025ad
cmp ebp, 0x8664
je 0x140002547
cmp ebp, 0x14c
jne 0x140002580
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x1400026ca
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400026f8
mov ebx, 2
jmp 0x1400025cb
mov r14, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rcx, rdi
mov rdx, qword [rsp + 0x38]
mov r8, r14
mov r9d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400025cb
mov ebx, 3
test r15, r15
je 0x1400025f9
lea rdx, [0x1401093b4]
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r15
mov rdx, rdi
mov r8d, eax
call fcn.14000224e
mov eax, ebx
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, 5
jmp 0x1400025ad
mov rsi, qword [rsp + 0x60]
test rsi, rsi
je 0x14000266c
cmp ebp, 0x14c
jne 0x140002676
lea rdx, [rsp + 0xa0]
mov dword [rdx], 0x10002
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1400026d4
lea rdx, [rsp + 0xa0]
mov rax, qword [rsp + 0x38]
mov dword [rdx + 0xb0], eax
mov dword [rdx + 0xa4], r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
jmp 0x1400026be
mov ebx, 7
jmp 0x1400025ad
cmp ebp, 0x8664
jne 0x1400026e1
lea rdx, [rsp + 0xa0]
mov dword [rdx + 0x30], 0x100002
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400026d4
lea rdx, [rsp + 0xa0]
mov rax, qword [rsp + 0x38]
mov qword [rdx + 0x80], rax
mov qword [rdx + 0x88], r12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
test eax, eax
sete cl
lea ebx, [rcx + rcx*8]
jmp 0x1400026d9
mov ebx, 6
jmp 0x1400025ad
mov ebx, 8
test ebx, ebx
jne 0x1400025ad
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebx, ebx
jmp 0x1400025ad