Function at 0x180011433
Capabilities:
Create process on windows
Create process suspended
Map section object
Print debug messages

Disassembly:
jmp 0x180018a60
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xb38
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1fa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb58]
lea rcx, [0x1800324c7]
call fcn.18001147e
nop
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xc8], 0x1000
mov qword [rbp + 0xe8], 0
call fcn.180011505
cmp eax, 0xc00000bb
je 0x180018ae3
mov ecx, 0x66306666
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
nop
cmp dword [rbp + 0xb08], 1
jne 0x180018fcd
mov rcx, qword [rbp + 0xb00]
call qword [sym.imp.ntdll.dll_LdrDisableThreadCalloutsForDll]
nop
lea rcx, str._PCADLL__Entry_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov edx, 0x100
lea rcx, [rbp + 0x340]
call fcn.180011343
nop
lea rdx, [rbp + 0x340]
mov cx, 0x3066
call fcn.1800111b3
nop
lea rdx, str.Sessions_
lea rcx, [rbp + 0x110]
call fcn.1800110aa
nop
lea rcx, [rbp + 0x110]
call fcn.1800114d8
mov qword [rbp + 0xad8], rax
call fcn.180011294
mov rcx, qword [rbp + 0xad8]
mov rdx, rcx
mov ecx, dword [rax + 0x2c0]
call fcn.180011325
nop
lea rdx, str.BaseNamedObjects_
lea rcx, [rbp + 0x110]
call fcn.18001143d
nop
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x110]
call fcn.18001143d
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x6a8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop
mov dword [rbp + 0x6d8], 0x30
mov qword [rbp + 0x6e0], 0
mov dword [rbp + 0x6f0], 0x40
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x6f8], 0
mov qword [rbp + 0x700], 0
lea r8, [rbp + 0x6d8]
mov edx, 0xf001f
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtOpenSection]
test eax, eax
jl 0x180018fbf
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x38], 2
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x1000
xor r9d, r9d
lea r8, [rbp + 0x88]
mov rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 0
jl 0x180018fa4
cmp qword [rbp + 0x88], 0
je 0x180018fa4
mov edx, 0x20a
lea rcx, [rbp + 0x480]
call fcn.180011343
nop
mov rax, qword [rbp + 0x88]
add rax, 4
mov r9d, 0x104
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x480]
call fcn.180011235
nop
lea rcx, str._PCADLL__NtMapViewOfSection_success_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov edx, 0x100
lea rcx, [rbp + 0x340]
call fcn.180011343
nop
lea rdx, str.BaseNamedObjects_
lea rcx, [rbp + 0x110]
call fcn.1800110aa
nop
lea rdx, [rbp + 0x340]
mov cx, 0x3166
call fcn.1800111b3
nop
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x110]
call fcn.18001143d
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x6a8]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop
mov dword [rbp + 0x6d8], 0x30
mov qword [rbp + 0x6e0], 0
mov dword [rbp + 0x6f0], 0x40
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x6f8], 0
mov qword [rbp + 0x700], 0
lea r8, [rbp + 0x6d8]
mov edx, 2
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtOpenEvent]
test eax, eax
jl 0x180018f7f
mov edx, 0x834
lea rcx, [0x18002b8c0]
call fcn.180011343
nop
lea rcx, [0x18002b8c0]
call fcn.180011285
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x180018ddf
lea rcx, str._PCADLL__Shared_parameters_read_OK_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
lea rax, [0x18002b8cc]
mov qword [rbp + 0x28], rax
lea rcx, [0x18002b8cc]
call fcn.1800110ff
shl rax, 1
mov dword [rbp + 0x44], eax
jmp 0x180018dfc
lea rcx, str._PCADLL__Shared_parameters_defaulted_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov qword [rbp + 0x28], 0
mov dword [rbp + 0x44], 0
mov eax, 0x30
add rax, 0x7ffe0000
mov rdx, rax
lea rcx, str.windir
call fcn.180011488
nop
mov edx, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x28]
call fcn.1800114c9
test eax, eax
je 0x180018e44
lea rcx, str._PCADLL__Payload_executed_OK_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rax, qword [rbp + 0x88]
mov dword [rax], 1
jmp 0x180018e52
lea rcx, str._PCADLL__Error_during_payload_execution_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov edx, 0x68
lea rcx, [rbp + 0x760]
call fcn.180011343
nop
mov dword [rbp + 0x760], 0x68
mov eax, 2
imul rax, rax, 0
mov ecx, 0x32
mov word [rbp + rax + 0x454], cx
mov eax, 2
imul rax, rax, 1
xor ecx, ecx
mov word [rbp + rax + 0x454], cx
lea rax, [rbp + 0x728]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x760]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x454]
lea rcx, [rbp + 0x480]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180018f30
lea rcx, str._PCADLL__Loader_run_OK_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rbp + 0x730]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x728]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x88]
mov eax, dword [rax]
or eax, 2
mov rcx, qword [rbp + 0x88]
mov dword [rcx], eax
jmp 0x180018f3e
lea rcx, str._PCADLL__Error_during_loader_execution_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtSetEvent]
nop
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtClose]
nop
lea rcx, str._PCADLL__Shared_event_signaled_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
cmp dword [rbp + 4], 0
je 0x180018f7d
lea rcx, [0x18002beea]
call fcn.18001116d
nop
jmp 0x180018f8d
lea rcx, str._PCADLL__NtOpenEvent_failed_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rdx, qword [rbp + 0x88]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
nop
jmp 0x180018fb2
lea rcx, str._PCADLL__MapViewOfFile_failed_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ntdll.dll_NtClose]
nop
jmp 0x180018fcd
lea rcx, str._PCADLL__OpenFileMapping_failed_r_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x180023ff0]
call fcn.1800113d4
mov eax, edi
lea rsp, [rbp + 0xae8]
pop rdi
pop rbp
ret