Function at 0x140018b20
Capabilities:
Create thread
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov r13, r8
mov r12, rdx
lea r8, [rsp + 0xf8]
lea r9d, [r14 + 8]
lea edx, [r14 + 0x1a]
mov rsi, rcx
xor bpl, bpl
xor bl, bl
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140018b73
cmp qword [rsp + 0xf8], r14
setne bpl
lea r8, [rsp + 0x50]
lea rdx, [0x14001b520]
mov r15d, 1
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x50], 0xc0000135
mov qword [rsp + 0x58], r12
mov word [rsp + 0x60], r15w
call fcn.14001b0e0
mov edi, dword [rsp + 0x50]
test eax, eax
cmovs edi, eax
test bpl, bpl
je 0x140018bf0
cmp edi, 0xc0000135
jne 0x140018bf0
lea r8, [rsp + 0x68]
lea rdx, [0x14001bb80]
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x70], r12
mov word [rsp + 0x78], r15w
call fcn.14001b650
mov edi, dword [rsp + 0x68]
test eax, eax
cmovs edi, eax
test edi, edi
js 0x140018bf4
movzx ebx, r15b
test edi, edi
jns 0x140018bfb
mov eax, edi
jmp 0x140018d7b
test bl, bl
jne 0x140018c1e
lea rcx, [0x1400ab590]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.LdrUnloadDll
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x140018c8b
mov rax, qword [0x1400d63b8]
test rax, rax
jne 0x140018c8b
lea rdx, str.SysWow64_ntdll.dll
mov ecx, 0x7ffe0030
call sym.ProcessHacker.exe_PhConcatStrings2
lea r8, str.LdrUnloadDll
xor r9d, r9d
lea rdx, [rax + 0x10]
mov rbx, rax
lea rax, [0x1400d63b8]
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
lea rcx, [rbx - 0x20]
mov edi, eax
or eax, 0xffffffff
lock xadd dword [rcx], eax
add eax, 0xffffffff
jne 0x140018c7c
call fcn.14001fcd0
test edi, edi
js 0x140018bf4
mov rax, qword [0x1400d63b8]
xor edx, edx
cmp dword [0x1400d8fc0], 0x3c
jb 0x140018ccf
mov qword [rsp + 0x48], r14
lea rcx, [rsp + 0x108]
xor r9d, r9d
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov edi, eax
jmp 0x140018d1d
mov qword [rsp + 0x30], r14
mov r9, rax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x108], rax
test rax, rax
jne 0x140018d1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x140018d0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140018d1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0xc0070000
test edi, edi
js 0x140018bf4
mov rcx, qword [rsp + 0x108]
mov r8, r13
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov ebx, eax
test eax, eax
jne 0x140018d6b
mov rcx, qword [rsp + 0x108]
lea r9d, [rax + 0x30]
lea r8, [rsp + 0x80]
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_NtQueryInformationThread]
mov ebx, eax
test eax, eax
cmovns ebx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret