Function at 0x14001d46d
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, 9
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001d480
sub rsp, 0x28
call fcn.14003f590
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14003f600
add rsp, 0x10
mov dword [0x1400f6001], 0x4000126
mov dword [0x1400f6001], 0x4000128
mov qword [rsp + 0x58], 0
mov dword [0x1400f6001], 0x4000129
mov byte [rsp + 0x68], 0
mov dword [0x1400f6001], 0x400012b
push qword [rsp + 0x28]
pop rcx
call fcn.1400322d0
mov r15, rax
and r15, r15
jle 0x14001d89e
mov dword [0x1400f6001], 0x400012c
push qword [rsp + 0x80]
pop rcx
call fcn.14001da42
mov rax, rax
push rax
pop rax
mov byte [rsp + 0x68], al
mov dword [0x1400f6001], 0x400012d
movsx r15, byte [rsp + 0x68]
cmp r15, 1
jne 0x14001d56e
mov dword [0x1400f6001], 0x400012e
movabs rax, 0x1400f9dfc
push rax
movabs rax, str.kernel32.dll
push rax
pop rcx
pop rdx
call fcn.14001d8e1
mov qword [rsp + 0x30], rax
mov dword [0x1400f6001], 0x400012f
jmp 0x14001d5dc
mov dword [0x1400f6001], 0x400012f
mov dword [0x1400f6001], 0x4000130
push 0
movabs rax, 0x1400f9dfc
push rax
movabs rax, str.kernel32.dll
push rax
push qword [rsp + 0x98]
pop rcx
pop rdx
pop r8
pop r9
call fcn.14001c75c
mov qword [rsp + 0x30], rax
mov dword [0x1400f6001], 0x4000131
jmp 0x14001d5dc
mov dword [0x1400f6001], 0x4000134
mov dword [0x1400f6001], 0x4000136
push qword [rsp + 0x80]
push 0
push 0x43a
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x50], rax
mov dword [0x1400f6001], 0x4000137
cmp qword [rsp + 0x50], 0
je 0x14001d894
mov dword [0x1400f6001], 0x4000138
push qword [rsp + 0x28]
pop rcx
call fcn.14003cae0
mov r15, rax
add r15, r15
inc r15
mov qword [rsp + 0x40], r15
mov dword [0x1400f6001], 0x4000139
push qword [rsp + 0x40]
pop rcx
call fcn.14003db00
mov qword [rsp + 0x60], rax
mov dword [0x1400f6001], 0x400013a
push 0x19
push 0xffffffffffffffff
push qword [rsp + 0x38]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
call fcn.14003de40
mov dword [0x1400f6001], 0x400013b
sub rsp, 8
push 4
push 0x1000
push qword [rsp + 0x58]
push 0
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_VirtualAllocEx
add rsp, 0x30
mov qword [rsp + 0x48], rax
mov dword [0x1400f6001], 0x400013c
cmp qword [rsp + 0x48], 0
je 0x14001d862
mov dword [0x1400f6001], 0x400013d
sub rsp, 8
push 0
push qword [rsp + 0x50]
push qword [rsp + 0x78]
push qword [rsp + 0x68]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_WriteProcessMemory
add rsp, 0x30
mov dword [0x1400f6001], 0x400013e
sub rsp, 8
push 0
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x50]
push 0
push 0
push qword [rsp + 0x88]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_CreateRemoteThread
add rsp, 0x40
mov qword [rsp + 0x38], rax
mov dword [0x1400f6001], 0x400013f
cmp qword [rsp + 0x38], 0
je 0x14001d831
mov dword [0x1400f6001], 0x4000140
push 0xffffffffffffffff
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.dll_WaitForSingleObject
mov dword [0x1400f6001], 0x4000141
push qword [rsp + 0x38]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f6001], 0x4000142
push rcx
sub rsp, 0x28
call fcn.14003f170
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003f170
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003f170
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x50]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140032168
add rsp, 0x28
call fcn.14003f4c0
push qword [rsp + 0x98]
push rax
call fcn.14003f3a0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14001c50c
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140021d5c
add rsp, 0x28
pop rax
mov qword [rsp + 0x58], rax
mov dword [0x1400f6001], 0x4000143
mov dword [0x1400f6001], 0x4000144
push 0x8000
push 0
push qword [rsp + 0x58]
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
call sub.KERNEL32.dll_VirtualFreeEx
mov dword [0x1400f6001], 0x4000145
mov dword [0x1400f6001], 0x4000146
push qword [rsp + 0x50]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f6001], 0x4000147
push qword [rsp + 0x60]
pop rcx
call fcn.14003dd10
mov dword [0x1400f6001], 0x4000148
mov dword [0x1400f6001], 0x4000149
mov dword [0x1400f6001], 0x400014b
mov rax, qword [rsp + 0x58]
jmp 0x14001d8c6
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14003f670
add rsp, 0x28
pop rax
add rsp, 0x70
pop r15
ret