Function at 0x1400024a0
Capabilities:
Process ghostly hollowing
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov dword [rbp + 8], r8d
mov r13, rdx
call fcn.140001fd0
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400029c2
xorps xmm0, xmm0
mov byte [rbp + 0x88], 1
mov r9d, 1
mov dword [rsp + 0x20], 0xd
lea r8, [rbp + 0x88]
mov rcx, rax
lea rdx, [rbp + 0x98]
movups xmmword [rbp + 0x98], xmm0
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
movabs r14, 0xd2ed09abab270a35
movabs r15, 0xc84c24dacfd271de
mov esi, eax
test eax, eax
jns 0x140002641
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x20]
movabs rax, 0xf28a67c2df536f66
movabs r12, 0xedca2e81dec813b7
mov qword [rbp + 8], rax
movabs rdi, 0xc7be0e70576f5fe8
mov rcx, qword [rbp + 8]
movabs rax, 0xbc2d49a8a0b41fb7
mov qword [rbp + 0x20], rcx
mov qword [rbp + 8], rax
movabs rax, 0x81a34fe7fea67cde
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x28], rcx
mov rcx, r8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x30], rax
movabs rax, 0xc7be0e7077553b8d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x14000ccbc]
call fcn.140003120
jmp 0x140002acd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xb78160ed8b7a206e
mov qword [rbp], rax
movabs rdx, 0xee2e6fae98f42332
mov rax, qword [rbp]
movabs r12, 0xedca2e81dec813b7
mov qword [rbp + 0x40], rax
movabs rdi, 0xc7be0e70576f5fe8
movabs rax, 0xa13f4baabcbb15fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x8ba447a1b0a77ac3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xa9d1670436022d87
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xf97cdc51c5b3319
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xf97cdcf683e4039
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdx
lea rdx, [rbp + 0x40]
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
mov qword [rbp + 0x108], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmmword [rbp + 0x60], xmm2
vzeroupper
call fcn.140003120
lea rax, [rbp + 0x90]
xor esi, esi
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov eax, dword [rbp + 8]
xor edx, edx
mov dword [rsp + 0x30], eax
mov rcx, rbx
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x90], rsi
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
jns 0x14000289d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp + 0x20]
mov ebx, eax
movabs rax, 0xa5cd6dcec74e6b73
mov qword [rbp], rax
movabs rax, 0xb86c43b4a6a618ac
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
mov qword [rbp], rax
movabs rax, 0xcdeb4ae0b1a46ad6
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
mov qword [rbp], rax
movabs rax, 0xc79e3402381d2dad
mov rcx, qword [rbp]
mov qword [rbp + 0x30], rcx
mov rcx, r8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
jmp 0x140002ab7
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x80]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
mov qword [rbp + 0x80], rsi
call qword [sym.imp.ntdll.dll_NtCreateSection]
mov esi, eax
test eax, eax
je 0x1400029ad
mov r8, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp + 0x20]
movabs rax, 0xb79968ced9647e7b
mov qword [rbp], rax
movabs rax, 0xe8224bb3bbb1148d
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
mov qword [rbp], rax
movabs rax, 0xcdf04ae4b2a172d1
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
mov rcx, r8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
jmp 0x140002abd
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbp + 0x80]
jmp 0x140002ad4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [rbp + 0x20]
movabs rax, 0xa6cd6dcec74e6b73
movabs rdi, 0xc7be0e70576f5fe8
mov qword [rbp], rax
movabs r14, 0xd2ed09abab270a35
mov rax, qword [rbp]
movabs r15, 0xc84c24dacfd271de
mov qword [rbp + 0x20], rax
movabs r12, 0xedca2e81dec813b7
movabs rax, 0xad3845bfbdb151b1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xedca2ee4b2a17597
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vzeroupper
call fcn.140003120
lea rdx, [0x140001f90]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400032f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.14000a1a0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret