Function at 0x401870
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov dword [rsp + 0xf0], r8d
mov rbx, rcx
mov r14, rdx
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.ZwQueryInformationThread
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, rax
call rbp
lea rdx, str.LdrLoadDll
mov rcx, r12
mov rsi, rax
call rbp
mov r9d, 0x40
mov rdx, rsi
mov rcx, qword [rbx]
mov r15, rax
mov r8d, 0x100
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x401ae0
xor edx, edx
mov r9d, 0x3000
mov rcx, qword [rbx]
mov r8d, 0x1000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edx, 0xffffc3ff
mov rcx, qword [rbx]
mov dword [rsp + 0x5a], 0xffffff04
mov r13, rax
xor eax, eax
mov word [rsp + 0x5e], dx
mov r9d, 0xe
mov word [rsp + 0x50], ax
lea r8, [rsp + 0x44]
mov rdx, rsi
movabs rax, 0x2444c7ffffffff68
mov qword [rsp + 0x52], rax
mov rax, r13
shr rax, 0x20
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x44], 0
mov dword [rsp + 0x53], r13d
mov dword [rsp + 0x5b], eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x401b60
mov qword [rsp + 0x20], 0
mov r9d, 0xe
mov rdx, rsi
mov rcx, qword [rbx]
lea r8, [rsp + 0x52]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rdi
test eax, eax
je 0x401b40
movzx eax, byte [rsp + 0x44]
mov r8, r14
mov rdx, r13
mov qword [r14 + 0x129], r15
mov qword [r14 + 0x135], rsi
mov qword [r14 + 0x169], rsi
mov byte [r14 + 0xb], al
movzx eax, byte [rsp + 0x45]
mov byte [r14 + 0x10], al
movzx eax, byte [rsp + 0x46]
mov byte [r14 + 0x15], al
movzx eax, byte [rsp + 0x47]
mov byte [r14 + 0x1a], al
movzx eax, byte [rsp + 0x48]
mov byte [r14 + 0x1f], al
movzx eax, byte [rsp + 0x49]
mov byte [r14 + 0x24], al
movzx eax, byte [rsp + 0x4a]
mov byte [r14 + 0x29], al
movzx eax, byte [rsp + 0x4b]
mov byte [r14 + 0x2e], al
movzx eax, byte [rsp + 0x4c]
mov byte [r14 + 0x33], al
movzx eax, byte [rsp + 0x4d]
mov byte [r14 + 0x38], al
movzx eax, byte [rsp + 0x4e]
mov byte [r14 + 0x3d], al
movzx eax, byte [rsp + 0x4f]
mov byte [r14 + 0x42], al
movzx eax, byte [rsp + 0x50]
mov byte [r14 + 0x47], al
movzx eax, byte [rsp + 0x51]
mov byte [r14 + 0x4c], al
lea rax, [rsi + 0xe]
mov qword [r14 + 0x14a], rax
mov qword [rsp + 0x20], 0
mov rcx, qword [rbx]
movsxd r9, dword [rsp + 0xf0]
call rdi
test eax, eax
je 0x401b20
lea rdx, str.NtQueryInformationProcess
mov rcx, r12
call rbp
lea rdx, [rsp + 0x40]
mov r9d, 0x30
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x60]
xor edx, edx
call rax
mov rax, qword [rsp + 0x68]
mov r9d, 1
mov qword [rsp + 0x20], 0
lea r8, [0x0040517e]
mov rcx, qword [rbx]
lea rdx, [rax + 2]
call rdi
test eax, eax
je 0x401b00
xor eax, eax
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.VirtualProtect_failed__d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x4018f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Modify_debug_flag__d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x401ac0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Write_code_failed__d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x401a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Write_ZwQueryInformationThreadAddr_failed__d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x4019ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Read_ZwQueryInformationThreadAddr_failed__d_n
mov edx, eax
call sub.msvcrt.dll_printf
jmp 0x401983