Function at 0x7ff7c00d9b70
Capabilities:
Create thread
Get windows directory from kuser_shared_data
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xor esi, esi
mov r13, r8
mov r12, rdx
mov qword [rbp - 0x39], rsi
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], rsi
mov r14, rcx
lea r9d, [rsi + 8]
lea edx, [rsi + 0x1a]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x7ff7c00d9d6f
cmp qword [rbp + 0x7f], rsi
je 0x7ff7c00d9d6f
lea rax, [rbp - 0x11]
mov r8b, 1
lea r9, [rbp - 9]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r12
call fcn.7ff7c010ca90
mov ebx, eax
test eax, eax
js 0x7ff7c00d9c16
mov r8, qword [rbp - 0x11]
lea rcx, [rbp - 1]
mov rdx, qword [rbp - 9]
call sym.ProcessHacker.exe_PhInitializeMappedImage
mov rdx, qword [rbp + 7]
mov ebx, eax
test eax, eax
jns 0x7ff7c00d9c1d
lea rcx, ds:[rsi - 1]
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, ebx
jmp 0x7ff7c00d9e78
mov r15, 0xffffffffffffffff
mov rcx, r15
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0x10b
cmp word [rbp + 0x2f], ax
jne 0x7ff7c00d9d6f
mov rbx, qword [0x7ff7c01d6af0]
test rbx, rbx
jne 0x7ff7c00d9d9a
cmp qword [0x7ff7c01d69b8], rsi
je 0x7ff7c00d9c62
movups xmm0, xmmword [0x7ff7c01d69b0]
movaps xmmword [rbp - 0x29], xmm0
jmp 0x7ff7c00d9cad
mov ecx, 0x7ffe0030
mov qword [rbp - 0x21], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rbp - 0x29], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x7ff7c00d9c8e
add rax, 0xfffffffffffffffe
mov qword [rbp - 0x29], rax
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
mov qword [0x7ff7c01d69b0], rax
lock or dword [rsp], esi
mov qword [0x7ff7c01d69b8], 0x7ffe0030
mov rdi, qword [rbp - 0x29]
mov rdx, qword [0x7ff7c01d3b58]
lea rbx, [rdi + 0x2c]
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rbp - 0x21]
mov rsi, rax
mov r8, rdi
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
xor eax, eax
mov word [rcx + rbx], ax
mov rcx, qword [rsi + 8]
call fcn.7ff7c0125120
mov rcx, qword [rsi + 8]
lea r8, [0x7ff7c0188ec8]
movups xmm0, xmmword [0x7ff7c0188ed8]
xor r9d, r9d
movups xmmword [rcx + rdi], xmm0
movups xmm1, xmmword [0x7ff7c0188ee8]
movups xmmword [rcx + rdi + 0x10], xmm1
movsd xmm0, qword [0x7ff7c0188ef8]
movsd qword [rcx + rdi + 0x20], xmm0
mov eax, dword [0x7ff7c0188f00]
mov dword [rcx + rdi + 0x28], eax
xor eax, eax
mov rdx, qword [rsi + 8]
mov rcx, r14
mov qword [rsp + 0x28], rax
lea rax, [0x7ff7c01d6af0]
mov qword [rsp + 0x20], rax
call sym.ProcessHacker.exe_PhGetProcedureAddressRemote
mov ebx, eax
lea rcx, [rsi - 0x10]
lock xadd dword [rcx + 8], r15d
cmp r15d, 1
jne 0x7ff7c00d9d5c
call fcn.7ff7c00c6290
test ebx, ebx
js 0x7ff7c00d9c16
mov rbx, qword [0x7ff7c01d6af0]
xor esi, esi
jmp 0x7ff7c00d9d9a
lea rcx, [0x7ff7c0186948]
call fcn.7ff7c00c47c0
test rax, rax
jne 0x7ff7c00d9d85
mov rbx, rsi
jmp 0x7ff7c00d9d9a
xor r8d, r8d
lea rdx, [0x7ff7c0188ec8]
mov rcx, rax
call fcn.7ff7c00c4b60
mov rbx, rax
mov rcx, r12
call sym.ProcessHacker.exe_PhCountStringZ
mov dword ss:[rsp + 0x28], 4
lea r9, [rbp - 0x31]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
lea rdx, [rbp - 0x39]
mov rcx, r14
lea rdi, [rax*2 + 2]
mov qword [rbp - 0x31], rdi
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x7ff7c00d9e78
mov rdx, qword [rbp - 0x39]
mov r9, rdi
mov r8, r12
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov edi, eax
test eax, eax
js 0x7ff7c00d9e57
mov qword ss:[rsp + 0x48], rsi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov rax, qword [rbp - 0x39]
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntdll.dll_RtlCreateUserThread]
mov edi, eax
test eax, eax
js 0x7ff7c00d9e57
mov rcx, qword [rbp - 0x19]
mov r8, r13
xor edx, edx
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, qword [rbp - 0x19]
mov edi, eax
call qword [sym.imp.ntdll.dll_NtClose]
mov r9d, 0x8000
mov qword [rbp - 0x31], rsi
lea r8, [rbp - 0x31]
mov rcx, r14
lea rdx, [rbp - 0x39]
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
mov eax, edi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret