Function at 0x140048db0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14006e040]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r13d, r13d
mov byte [rbp - 0x40], 0
xor eax, eax
mov qword [rbp - 0x20], r13
lea rdi, [rbp + 0x30]
mov dword [rbp - 0x3c], r13d
mov ecx, 0x104
mov dword [rbp], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp + 4], 0xd18b4c00
mov word [rbp + 8], 0x50f
mov byte [rbp + 0xa], 0xc3
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
cmp word [rbp + 0x30], r13w
je 0x140048e4a
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x140048e40
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140048e60
mov word [rax], r13w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048e8a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140048e80
lea rdx, [0x140063500]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140048ea0
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048ece
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140048ec2
add cx, cx
mov dword [rbp - 0x78], 0x30
mov word [rbp - 0x30], cx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
add cx, 2
mov word [rbp - 0x2e], cx
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
mov r14, r13
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048f58
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048f4a
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140048f54
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048f30
jmp 0x140048f58
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x140049002
cmp word [r9], r15w
jne 0x140049002
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049002
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049002
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049002
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140048ff6
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140048fec
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x140048fe7
cmp byte [rcx], r13b
je 0x140048fec
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140048fd0
jmp 0x140048fec
cmp byte [rcx], r13b
je 0x140049045
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049045
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140048fb6
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004905a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004903b
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140049056
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049021
jmp 0x14004905a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140049005
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400490f8
cmp word [r9], r15w
jne 0x1400490f8
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400490f8
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400490f8
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400490f8
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400490ec
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400490e2
sub rcx, rsi
test al, al
je 0x1400490dd
cmp byte [rdx], r13b
je 0x1400490e2
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400490c6
jmp 0x1400490e2
cmp byte [rdx], r13b
je 0x14004913b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004913b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400490b2
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049150
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049131
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x14004914c
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049117
jmp 0x140049150
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x1400490fb
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x140049283
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049283
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049283
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049283
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049283
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400491fb
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400491f1
sub rax, rsi
test dl, dl
je 0x1400491ec
cmp byte [rcx], r13b
je 0x1400491f1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400491d5
jmp 0x1400491f1
cmp byte [rcx], r13b
je 0x140049209
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049209
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400491c0
jmp 0x140049283
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140049283
test r15, r15
je 0x140049283
test r12, r12
je 0x140049283
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x140049283
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x140049283
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140049283
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400492c8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400492ba
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400492c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400492a0
jmp 0x1400492c8
lea r14, [rdi - 0x10]
mov rsi, qword [rbp - 0x80]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x14004946e
test r14, r14
je 0x14004946e
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x14004938f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004938f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14004938f
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x14004938f
lea rbx, str.NtSetInformationThread
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x140049383
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049375
sub rax, rbx
test dl, dl
je 0x14004936c
cmp byte [rcx], r13b
je 0x140049375
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049355
jmp 0x140049375
cmp byte [rcx], r13b
je 0x14004940b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004940b
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140049340
mov r9, r13
cmp word [r14], r12w
jne 0x14004943a
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14004943a
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x14004943a
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x14004943a
nop
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x14004942e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049424
sub rcx, r15
test al, al
je 0x14004941f
cmp byte [rdx], r13b
je 0x140049424
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400493f4
jmp 0x140049424
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x140049392
cmp byte [rdx], r13b
je 0x140049450
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140049450
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400493e0
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140049460
call rax
jmp 0x140049474
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x14004943d
movzx r13d, word [r9 + 4]
mov dword [rsp + 0x64], r13d
call rax
jmp 0x140049479
mov r12d, 0x5a4d
mov dword [rsp + 0x64], r13d
xor r15d, r15d
mov word [rbp - 0x48], r13w
xor eax, eax
mov qword [rbp - 0x38], r15
lea rdi, [rbp + 0x30]
mov qword [rbp - 0x80], r15
mov ecx, 0x104
mov qword [rbp - 0x30], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp - 0x74], r15d
mov dword [rbp - 0x5c], r15d
cmp word [rbp + 0x30], r15w
je 0x1400494ba
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400494b0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400494d0
mov word [rax], r15w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x1400494fa
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400494f0
lea rcx, [0x140063500]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140049510
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x14004953e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x140049532
add cx, cx
mov dword [rbp - 0x78], 0x30
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x78], rax
mov r14, r15
mov dword [rbp - 0x60], 0x40
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov word [rsp + 0x70], cx
add cx, 2
mov word [rsp + 0x72], cx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400495c8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400495ba
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400495c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400495a0
jmp 0x1400495c8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140049667
cmp word [r9], r12w
jne 0x140049667
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049667
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049667
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049667
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004965b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140049651
sub rax, rsi
test dl, dl
je 0x14004964c
cmp byte [rcx], r15b
je 0x140049651
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049635
jmp 0x140049651
cmp byte [rcx], r15b
je 0x1400496aa
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400496aa
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049620
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400496bf
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400496a0
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400496bb
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049686
jmp 0x1400496bf
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004966a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004977b
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004977b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004977b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004977b
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004977b
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004975e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049754
sub rcx, rsi
test al, al
je 0x14004974f
cmp byte [rdx], r15b
je 0x140049754
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049738
jmp 0x140049754
cmp byte [rdx], r15b
je 0x14004976c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004976c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049724
jmp 0x14004977b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400497c8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400497ba
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x1400497c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400497a0
jmp 0x1400497c8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400498f2
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400498f2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400498f2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400498f2
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x1400498f2
lea r14, str.NtClose
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x14004986e
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049864
sub rax, r14
test dl, dl
je 0x14004985f
cmp byte [rcx], sil
je 0x140049864
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049848
jmp 0x140049864
cmp byte [rcx], sil
je 0x14004987c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004987c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049833
jmp 0x1400498f2
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400498f2
test r15, r15
je 0x1400498f2
test r12, r12
je 0x1400498f2
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rbp - 0x80]
call r12
test eax, eax
js 0x1400498f2
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x38]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x1400498f2
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400498f2
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049939
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004992b
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140049935
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049911
jmp 0x140049939
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x38]
mov r11, qword [r14 + 0x30]
test r9, r9
je 0x140049ae6
test r11, r11
je 0x140049ae6
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x1400499ff
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400499ff
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400499ff
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x1400499ff
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x1400499f3
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400499e5
sub rax, r14
test dl, dl
je 0x1400499dc
cmp byte [rcx], r15b
je 0x1400499e5
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400499c5
jmp 0x1400499e5
cmp byte [rcx], r15b
je 0x140049a87
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049a87
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400499b0
mov rsi, r15
cmp word [r11], r12w
jne 0x140049ab4
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140049ab4
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x140049ab4
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rbx, r11
mov r10d, dword [rax + 0x14]
add r14, r11
test r10d, r10d
je 0x140049ab4
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r11
je 0x140049aa8
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049a9e
sub rcx, r12
nop dword [rax]
test al, al
je 0x140049a99
cmp byte [rdx], r15b
je 0x140049a9e
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049a70
jmp 0x140049a9e
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, r9
jmp 0x140049a02
cmp byte [rdx], r15b
je 0x140049ace
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140049ace
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049a55
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rsi, rsi
jne 0x140049ade
call rax
movzx esi, r15w
jmp 0x140049ae9
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140049ab7
movzx esi, word [rsi + 4]
call rax
jmp 0x140049ae9
mov esi, r15d
mov word [rbp - 0x44], si
mov r12d, 0xb
test r13w, r13w
je 0x140049afe
test si, si
jne 0x140049b5d
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140049b44
cmp al, 6
jne 0x140049b38
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140049b38
sub ecx, 1
je 0x140049b2d
cmp ecx, 1
jne 0x140049b44
lea r13d, [rcx + 0xb]
lea esi, [rcx + 0x23]
jmp 0x140049b4f
movzx r13d, r12w
mov esi, 0x23
jmp 0x140049b4f
mov r13d, 0xa
lea esi, [r13 + 0x18]
jmp 0x140049b4f
mov r13d, 0xd
mov esi, 0x25
mov word [rbp - 0x44], si
mov word [rbp - 0x48], r13w
mov dword [rsp + 0x64], r13d
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140049b9e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049b90
lea rcx, [0x140063500]
call fcn.1400475b0
test rax, rax
jne 0x140049b9a
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140049b76
jmp 0x140049b9e
lea r15, [rdi - 0x10]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x140049c62
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140049c62
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140049c62
mov r14d, dword [rax + rbx + 0x88]
add r14, rbx
je 0x140049c62
mov edi, dword [r14 + 0x24]
mov r15d, dword [r14 + 0x1c]
add rdi, rbx
add r15, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [r14 + 0x14]
mov r9d, eax
mov eax, 0x88888889
mul r9d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r9d, ecx
mov ecx, eax
test r10d, r10d
je 0x140049c62
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rbx + r8], 0x4c
lea rax, [rbx + r8]
jne 0x140049c57
cmp byte [rax + 1], 0x8b
jne 0x140049c57
cmp byte [rax + 2], 0xd1
jne 0x140049c57
cmp byte [rax + 3], 0xb8
jne 0x140049c57
cmp byte [rax + 0x12], 0xf
jne 0x140049c57
cmp byte [rax + 0x13], 5
jne 0x140049c57
inc edx
cmp edx, r9d
je 0x140049c94
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x140049c20
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140058b30
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, r8
add rdi, rbx
je 0x140049c62
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 1]
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x140049cd0
lea rcx, [rbp + 1]
lea rax, [rbp - 0x46]
nop dword [rax]
movzx ecx, byte [rbp - 0x47]
lea rax, [rbp + 0x10]
mov byte [rbp + 2], cl
mov byte [rbp + 1], r13b
cmp rax, rdi
jbe 0x140049da0
lea rax, [rdi + 0x14]
lea rdx, [rbp + 0x10]
cmp rdx, rax
jae 0x140049da0
movzx edx, byte [rax - 4]
movzx r14d, byte [rax - 1]
movzx r15d, byte [rax - 2]
movzx r13d, byte [rax - 3]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x57], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x56], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x55], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x54], dl
movzx edx, byte [rax - 0x11]
mov byte [rsp + 0x53], dl
movzx edx, byte [rax - 0x12]
mov byte [rsp + 0x52], dl
movzx edx, byte [rax - 0x13]
mov byte [rsp + 0x51], dl
movzx edx, byte [rax - 0x14]
mov byte [rsp + 0x50], dl
jmp 0x140049e36
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x11]
movzx r15d, byte [rdi + 0x12]
movzx r14d, byte [rdi + 0x13]
mov byte [rsp + 0x50], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x51], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x52], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x53], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x57], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x60], al
lea rax, [rbp]
cmp rdi, rax
jbe 0x140049e50
lea rax, [rbp + 0xb]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x64]
lea r8, [rbp - 0x20]
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
mov dword [rdi + 3], 0x8b4c0000
mov edx, 0x11
mov byte [rdi + 2], cl
mov rcx, 0xfffffffffffffffe
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
call rdi
test eax, eax
jns 0x14004a11e
lea r11, [rbp]
mov r9, r12
sub r11, rdi
mov rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140049ed6
inc rdi
sub r9, 1
jne 0x140049ea0
jmp 0x140049edf
cmp r8d, r10d
jne 0x14004a11e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x140049c62
lea rcx, [rbp + 1]
lea rax, [rbp - 0x44]
cmp rcx, rax
jbe 0x140049f10
lea rcx, [rbp + 1]
lea rax, [rbp - 0x42]
nop dword [rax]
movzx eax, byte [rbp - 0x43]
lea rcx, [rbp]
mov byte [rbp + 2], al
mov byte [rbp + 1], sil
cmp rbx, rcx
jbe 0x140049f30
lea rcx, [rbp + 0xb]
nop dword [rax + rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rbp - 0x40]
mov dword [rbx + 3], 0x8b4c0000
mov byte [rbx + 2], al
xor eax, eax
mov byte [rbx + 1], sil
mov byte [rbx], 0xb8
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rbx
lea r10, [rbp]
mov esi, eax
sub r10, rbx
mov rdi, rbx
nop dword [rax]
movzx r9d, byte [rbx + r10]
movzx r8d, byte [rbx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r9d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140049fa6
inc rbx
sub r12, 1
jne 0x140049f70
jmp 0x140049faf
cmp r8d, r9d
jne 0x14004a11e
lea rax, [rbp + 0x10]
cmp rdi, rax
jbe 0x14004a061
lea rax, [rbp + 0x24]
cmp rdi, rax
jae 0x14004a061
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
mov byte [rdi + 0x13], r14b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x11], r13b
jmp 0x14004a0f4
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], r13b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x13], r14b
mov r8d, dword [rbp - 0x3c]
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x140049c62
cmp byte [rbp - 0x40], 0
sete al
jmp 0x140049c64
mov al, 1
jmp 0x140049c64