Function at 0x140052810
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
xor r15d, r15d
movabs rax, 0x50b4efd48bc7dd96
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x86f28c9dc816be09
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x82e9fe4042bc6ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xe2e67506c95bc0e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs r12, 0x3fd081bddce8e7d5
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs r13, 0xe386ffe49b39cd7e
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x7f4bf3832b19f5d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xe2e6196aad75f2d0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x60], ymm1
movabs rax, 0x5aa9e0d18cc5a39d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xe386ff81e35ce30c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
vmovdqa xmm0, xmmword [rbp + 0x10]
vxorps xmm0, xmm0, xmmword [rbp + 0x20]
vmovdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
vzeroupper
call fcn.140052700
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rax, [rbp + 0x60]
mov rbx, 0xffffffffffffffff
mov rdi, rbx
nop word [rax + rax]
lea rdi, [rdi + 1]
cmp byte [rax + rdi], r15b
jne 0x140052980
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov qword [rsp + 0x20], r15
lea r9, [rdi + 1]
lea r8, [rbp + 0x60]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movabs rax, 0x4db2e8f1b8898899
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x20], rcx
movabs rax, 0xe386ffe4da40bf1f
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x28], rcx
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
movabs rax, 0xde3edd8b29a829e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xe386ffe4f755a950
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rax, [rbp + 0x60]
lea rbx, [rbx + 1]
cmp byte [rax + rbx], r15b
jne 0x140052ab0
lea r8, [rbx + 1]
mov r9d, 0x8000
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, 8
call fcn.1400ba394
lea rcx, [0x1400527d0]
mov qword [rax], rcx
mov qword [rbp], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140059910]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x140052b5d
cmp dword [rbp + 0x18], 0
je 0x140052b51
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140052b51
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x18], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3