Function at 0x180026af0
Capabilities:
Create thread
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18030a008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov eax, dword [rcx + 0x278]
test eax, eax
jne 0x180026b27
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xchg dword [rbx + 0x278], eax
mov rax, qword [rbx + 0x280]
test rax, rax
jne 0x180026b40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xchg qword [rbx + 0x280], rax
call fcn.180025d30
movzx eax, byte [rbx + 0x3d4]
test al, al
jne 0x1800273b5
lea rcx, [0x1802f68c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbx + 0x3d8], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbx + 0x3e0], rax
mov rcx, qword [rbx + 0x3d8]
test rcx, rcx
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.NtCreateToken
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c0], rax
lea rdx, str.NtOpenProcessToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1c8], rax
lea rdx, str.NtOpenProcessTokenEx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1d0], rax
lea rdx, str.NtOpenThreadToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1d8], rax
lea rdx, str.NtOpenThreadTokenEx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1e0], rax
lea rdx, str.NtDuplicateToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1e8], rax
lea rdx, str.NtQueryInformationToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1f0], rax
lea rdx, str.NtSetInformationToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1f8], rax
lea rdx, str.NtAdjustPrivilegesToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x200], rax
lea rdx, str.NtAdjustGroupsToken
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x208], rax
cmp qword [rbx + 0x1c0], 0
je 0x1800273b5
cmp qword [rbx + 0x1c8], 0
je 0x1800273b5
cmp qword [rbx + 0x1d0], 0
je 0x1800273b5
cmp qword [rbx + 0x1d8], 0
je 0x1800273b5
cmp qword [rbx + 0x1e0], 0
je 0x1800273b5
cmp qword [rbx + 0x1e8], 0
je 0x1800273b5
cmp qword [rbx + 0x1f0], 0
je 0x1800273b5
cmp qword [rbx + 0x1f8], 0
je 0x1800273b5
cmp qword [rbx + 0x200], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.NtClose
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa0], rax
lea rdx, str.NtOpenProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xa8], rax
lea rdx, str.NtTerminateProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb0], rax
lea rdx, [0x1802f69f8]
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xb8], rax
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc0], rax
cmp qword [rbx + 0xb8], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
cmp qword [rbx + 0xb0], 0
je 0x1800273b5
cmp qword [rbx + 0xa8], 0
je 0x1800273b5
cmp qword [rbx + 0xa0], 0
je 0x1800273b5
lea rdx, str.RtlInitializeCriticalSection
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xc8], rax
lea rdx, str.RtlInitializeCriticalSectionAndSpinCount
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd0], rax
lea rdx, str.RtlDeleteCriticalSection
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xd8], rax
lea rdx, str.RtlEnterCriticalSection
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe0], rax
lea rdx, str.RtlLeaveCriticalSection
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xe8], rax
lea rdx, str.RtlTryEnterCriticalSection
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf0], rax
lea rdx, str.RtlIsCriticalSectionLocked
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0xf8], rax
lea rdx, str.RtlIsCriticalSectionLockedByThread
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x100], rax
lea rdx, str.RtlGetCriticalSectionRecursionCount
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x108], rax
lea rdx, str.RtlSetCriticalSectionSpinCount
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x110], rax
cmp qword [rbx + 0xc8], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
cmp qword [rbx + 0x108], 0
je 0x1800273b5
cmp qword [rbx + 0x100], 0
je 0x1800273b5
cmp qword [rbx + 0xf8], 0
je 0x1800273b5
cmp qword [rbx + 0xf0], 0
je 0x1800273b5
cmp qword [rbx + 0xe8], 0
je 0x1800273b5
cmp qword [rbx + 0xe0], 0
je 0x1800273b5
cmp qword [rbx + 0xd8], 0
je 0x1800273b5
cmp qword [rbx + 0xd0], 0
je 0x1800273b5
lea rdx, str.NtSuspendProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x118], rax
lea rdx, str.NtResumeProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x120], rax
lea rdx, str.RtlCreateUserProcess
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x128], rax
cmp qword [rbx + 0x118], 0
je 0x1800273b5
cmp qword [rbx + 0x120], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.RtlGetCurrentPeb
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x130], rax
lea rdx, str.RtlAcquirePebLock
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x138], rax
lea rdx, str.RtlReleasePebLock
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x140], rax
cmp qword [rbx + 0x130], 0
je 0x1800273b5
cmp qword [rbx + 0x138], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.RtlCreateUnicodeString
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x150], rax
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x158], rax
lea rdx, str.RtlFreeUnicodeString
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x160], rax
cmp qword [rbx + 0x150], 0
je 0x1800273b5
cmp qword [rbx + 0x158], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x168], rax
lea rdx, str.NtFreeVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x170], rax
lea rdx, str.NtReadVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x178], rax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x180], rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x188], rax
lea rdx, str.NtQueryVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x190], rax
lea rdx, str.NtFlushVirtualMemory
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x198], rax
cmp qword [rbx + 0x168], 0
je 0x1800273b5
cmp qword [rbx + 0x170], 0
je 0x1800273b5
cmp qword [rbx + 0x178], 0
je 0x1800273b5
cmp qword [rbx + 0x180], 0
je 0x1800273b5
cmp qword [rbx + 0x188], 0
je 0x1800273b5
cmp qword [rbx + 0x190], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.LdrLoadDll
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1a0], rax
lea rdx, str.LdrUnloadDll
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1a8], rax
lea rdx, str.LdrGetDllHandle
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1b0], rax
cmp qword [rbx + 0x1a0], 0
je 0x1800273b5
cmp qword [rbx + 0x1a8], 0
je 0x1800273b5
test rax, rax
je 0x1800273b5
lea rdx, str.LdrEnumerateLoadedModules
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x1b8], rax
test rax, rax
je 0x1800273b5
lea rdx, str.NtCreateProcessEx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x210], rax
test rax, rax
je 0x1800273b5
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x218], rax
test rax, rax
je 0x1800273b5
lea rdx, str.RtlCreateProcessParametersEx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x220], rax
test rax, rax
je 0x1800273b5
lea rdx, str.RtlGetVersion
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x148], rax
test rax, rax
je 0x1800273b5
mov rcx, rbx
call fcn.180025850
mov eax, 1
xchg byte [rbx + 0x3d4], al
movzx eax, byte [rbx + 0x4c8]
test al, al
je 0x1800273b5
lea rcx, [rbx + 0x4b0]
mov qword [rsp + 0x38], rbx
mov rdi, qword [rbx + 0x4b8]
cmp rdi, qword [rbx + 0x4c0]
je 0x1800273a8
mov ecx, 8
call fcn.180044ed8
mov qword [rax], rbx
mov qword [rsp + 0x38], rax
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800276d0]
xor edx, edx
xor ecx, ecx
call fcn.180052174
mov qword [rdi], rax
test rax, rax
je 0x1800273d2
add qword [rbx + 0x4b8], 0x10
jmp 0x1800273b5
lea r8, [rsp + 0x38]
mov rdx, rdi
call fcn.1800273f0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180044eb0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call fcn.18006a25c
int3