Function at 0x180003da8
Capabilities:
Create process on windows
Read file on windows
Resume thread
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x608
mov r13, r9
mov r12d, r8d
mov rbx, rdx
mov rsi, rcx
lea rax, [rcx + 2]
xor ecx, ecx
cmp word [rsi], 0x22
sete cl
lea edx, [rcx + rcx + 0x20]
cmovne rax, rsi
xor ecx, ecx
movzx ebp, word [rax + rcx*2]
test ebp, ebp
je 0x180003e04
cmp edx, ebp
je 0x180003e04
mov word [rsp + rcx*2 + 0x130], bp
inc rcx
cmp ecx, 0x104
jb 0x180003dde
xor edi, edi
jmp 0x1800040cd
xor edi, edi
cmp ecx, 0x102
ja 0x1800040cd
mov word [rsp + rcx*2 + 0x130], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x130]
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x18000409f
mov r15, rax
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
je 0x1800040a9
mov r14, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
mov rcx, r15
mov rdx, rax
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800040b3
movzx eax, word [r14]
xor edi, edi
cmp eax, 0x5a4d
jne 0x1800040bb
movsxd rax, dword [r14 + 0x3c]
cmp rax, 0x3ff
jg 0x1800040bb
movzx ecx, word [rbx]
cmp ecx, 0x5a4d
jne 0x1800040bb
movsxd rcx, dword [rbx + 0x3c]
cmp rcx, 0x3ff
jg 0x1800040bb
movzx eax, word [r14 + rax + 4]
cmp ax, word [rbx + rcx + 4]
jne 0x1800040bb
xor ebp, ebp
lea rdx, [rsp + 0xc8]
mov ecx, 0xd
xor eax, eax
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rsp + 0x50]
mov qword [rax + 0x10], rbp
mov qword [rax + 8], rbp
mov qword [rax], rbp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x404
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800040b3
lea rax, [0x18000f3c8]
mov qword [rsp + 0x80], rax
movabs rax, 0x5ec00000000
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x90], rax
movabs rax, 0x10000005ec
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
mov eax, 0x5fc
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], r12d
mov qword [rsp + 0xb0], r13
lea edi, [r12 + 0x5fc]
mov dword [rsp + 0xb8], edi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + rax]
add ebx, 2
mov dword [rsp + 0xbc], ebx
lea r13d, [r12 + rax*2]
add r13d, 0x5fe
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r8, r13
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x18000415e
mov rsi, rax
lea eax, [rax + 0x5fc]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], r12d
add edi, esi
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], ebx
mov rcx, qword [rsp + 0x50]
lea r12, [rsp + 0xc0]
mov qword [rsp + 0x20], r12
lea r8, [0x18000f3c8]
mov r9d, 0x5ec
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000415e
lea rbx, [rsp + 0x9c]
mov edi, 1
mov rbp, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp rdi, 3
ja 0x1800040e3
mov r9d, dword [rbx]
mov r8, qword [rbx - 0xc]
mov edx, dword [rbx - 4]
add rdx, rsi
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], r12
call rbp
inc rdi
add rbx, 0x10
test eax, eax
jne 0x180004070
jmp 0x18000415e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1800040cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x1800040c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x608
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp edi, 4
jne 0x18000415e
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8, r13
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18000415e
lea rdx, [rsp + 0x338]
mov dword [rdx], 0x100002
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x18000415e
lea rdx, [rsp + 0x338]
mov dword [rdx + 0xb0], esi
lea eax, [rsi + 0x5ec]
mov dword [rdx + 0xa4], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor edi, edi
jmp 0x180004173
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x50]
call rsi
jmp 0x1800040bb