Function at 0x180001c80
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test rcx, rcx
je 0x180001fe0
test edx, edx
je 0x180001fe0
test r8, r8
je 0x180001fe0
test r9, r9
je 0x180001fe0
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
je 0x180001ced
lea rcx, str.____The_PE_file_is_not_valid__n
jmp 0x180001fe7
lea rcx, str.___PE_file_is_valid._n
call fcn.180001010
xorps xmm0, xmm0
mov dword [rbp + 0x450], 0x68
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x68], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x48], rax
mov rcx, rsi
lea rax, [rbp + 0x450]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
movups xmmword [rbp + 0x458], xmm0
movups xmmword [rbp + 0x468], xmm0
movups xmmword [rbp + 0x478], xmm0
movups xmmword [rbp + 0x488], xmm0
movups xmmword [rbp + 0x498], xmm0
movups xmmword [rbp + 0x4a8], xmm0
movups xmmword [rsp + 0x58], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x180001d8f
lea rcx, str.____Failed_to_create_the_target_process__n
jmp 0x180001fe7
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x440]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movsxd rax, dword [rbx + 0x3c]
mov ecx, 0x10b
cmp word [rax + rbx + 0x18], cx
jne 0x180001ddf
mov esi, 1
cmp dword [rbp + 0x440], edi
jne 0x180001de9
lea rcx, str.____Architectures_are_not_compatible__n
call fcn.180001010
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180001fec
mov esi, edi
cmp dword [rbp + 0x440], edi
jne 0x180001dbe
lea rcx, str.___Architectures_are_compatible._n
call fcn.180001010
xor edx, edx
mov qword [rsp + 0x50], rdi
cmp dword [rbp + 0x440], edi
je 0x180001e5e
mov r8d, 0x2c8
lea rcx, [rsp + 0x74]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x14]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
add edx, 8
mov r9d, 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180001e59
mov rcx, rdi
mov rax, rdi
jmp 0x180001ebd
mov ecx, dword [rbp + 0x14]
jmp 0x180001eb8
mov r8d, 0x4d0
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x70]
mov dword [rbp - 0x60], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp - 8]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180001eb4
mov rcx, rdi
mov rax, rdi
jmp 0x180001ebd
mov rcx, qword [rbp - 8]
mov rax, qword [rsp + 0x50]
test rcx, rcx
je 0x180001fc2
test rax, rax
je 0x180001fc2
lea rcx, str.___Retrieved_process_address_information._n
call fcn.180001010
movsxd rax, dword [rbx + 0x3c]
lea rdx, str.___The_source_image_has_a_relocation_table._n
lea rcx, str.___The_source_image_does_not_have_a_relocation_table._n
test esi, esi
je 0x180001f23
mov eax, dword [rax + rbx + 0xa0]
test eax, eax
setne dil
test eax, eax
cmovne rcx, rdx
call fcn.180001010
lea rcx, [rsp + 0x58]
mov rdx, rbx
test edi, edi
je 0x180001f1c
call fcn.1800014f0
jmp 0x180001f53
call fcn.180001070
jmp 0x180001f53
mov eax, dword [rax + rbx + 0xb0]
test eax, eax
setne dil
test eax, eax
cmovne rcx, rdx
call fcn.180001010
lea rcx, [rsp + 0x58]
mov rdx, rbx
test edi, edi
je 0x180001f4e
call fcn.1800018d0
jmp 0x180001f53
call fcn.1800012b0
test eax, eax
je 0x180001fa4
lea rcx, str.___The_injection_has_succeeded__n
call fcn.180001010
cmp rbx, 0xffffffffffffffff
je 0x180001f7d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180001f8d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180001f9d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180001fee
lea rcx, str.____The_injection_has_failed__n
call fcn.180001010
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180001fec
lea rcx, str.____Failed_to_retrieve_process_address_information__n
call fcn.180001010
mov rcx, qword [rsp + 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x180001fec
lea rcx, str.____Invalid_parameters_provided._n
call fcn.180001010
xor eax, eax
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.180002020
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5d0
pop rdi
pop rsi
pop rbp
ret