Function at 0x14008b7e0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
movzx r15d, r9b
mov r14, rdx
mov r12, rcx
mov rsi, qword [rbp + 0x240]
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x14008b891
mov rax, qword [0x140103488]
cmp rax, 0xc
jb 0x14008b874
lea rdi, [0x140103470]
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0xc
mov r8d, 0xc
lea rdx, str.Invalid_file
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0xc], 0
jmp 0x14008cd5e
lea r9, str.Invalid_file
mov edx, 0xc
lea rcx, [0x140103470]
call fcn.14007d230
jmp 0x14008cd5e
movsxd r13, dword [rdx + 0x3c]
add r13, r14
mov eax, 0x8664
cmp word [r13 + 4], ax
mov rax, qword [0x140103488]
je 0x14008b90a
cmp rax, 0x10
jb 0x14008b8ed
lea rdi, [0x140103470]
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x10
mov r8d, 0x10
lea rdx, str.Invalid_platform
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x10], 0
jmp 0x14008cd5e
lea r9, str.Invalid_platform
mov edx, 0x10
lea rcx, [0x140103470]
call fcn.14007d230
jmp 0x14008cd5e
lea rdi, [0x140103470]
cmp rax, 7
jb 0x14008b94c
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 7
mov r8d, 7
lea rdx, str.File_ok
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x14008b960
lea r9, str.File_ok
mov edx, 7
mov rcx, rdi
call fcn.14007d230
mov r8d, dword [r13 + 0x50]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rbp + 0x1a8], rax
test rax, rax
jne 0x14008ba92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.14008e0c0
nop
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r8
lea r15d, [rbx + 0x2d]
lea r14, str.Target_process_memory_allocation_failed__ex_
cmp rax, r15
jb 0x14008ba37
lea rax, [r8 + 0x2d]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x68]
lea rax, [0x1400ed1b5]
cmp rax, rbx
jbe 0x14008b9fb
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008b9fb
cmp rbx, r14
ja 0x14008b9f3
xor esi, esi
jmp 0x14008b9fe
mov rsi, rbx
sub rsi, r14
jmp 0x14008b9fe
mov rsi, r15
inc r8
lea rcx, [rbx + 0x2d]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x2d]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x68]
jmp 0x14008ba4d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp - 0x68]
jmp 0x14008cd59
mov dword [rbp + 0x1b0], 0
mov r8d, dword [r13 + 0x50]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
mov qword [rbp + 0x140], rcx
mov dword [rbp + 0x14c], ecx
mov dword [rbp + 0x15c], ecx
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x120], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rbx
mov eax, dword [rbp + 0x238]
mov dword [rbp + 0x148], eax
mov qword [rbp + 0x150], rsi
movzx eax, byte [rbp + 0x230]
mov dword [rbp + 0x158], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0x1000
mov r8, r14
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008bc72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.14008e0c0
nop
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
mov r14d, 0x18
lea r15, str.Cant_write_file_header
cmp rax, r14
jb 0x14008bbfd
lea rax, [r8 + 0x18]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x48]
lea rax, [0x1400ed1d0]
cmp rax, rbx
jbe 0x14008bbb7
lea rax, [rbx + r8]
cmp r15, rax
ja 0x14008bbb7
cmp rbx, r15
ja 0x14008bbaf
xor esi, esi
jmp 0x14008bbba
mov rsi, rbx
sub rsi, r15
jmp 0x14008bbba
mov rsi, r14
inc r8
lea rcx, [rbx + 0x18]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r14, rsi
lea rdx, [0x1400ed1d0]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x48]
mov rbx, qword [rbp + 0x1a8]
jmp 0x14008bc13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp - 0x48]
call fcn.1400663b0
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x14008cd5e
movzx ebx, word [r13 + 0x14]
add rbx, 0x2c
xor esi, esi
cmp word [r13 + 6], si
je 0x14008bcca
add rbx, r13
mov eax, dword [rbx - 4]
test eax, eax
je 0x14008bcbb
mov r9d, eax
mov r8d, dword [rbx]
add r8, r14
mov edx, dword [rbx - 8]
add rdx, qword [rbp + 0x1a8]
mov qword [rsp + 0x20], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14008bd6e
inc esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008bc87
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14008bf29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 8]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, r8
lea r15d, [r14 + 0x2e]
lea r14, str.Target_process_mapping_allocation_failed__ex_
cmp rax, r15
jb 0x14008bec2
lea rax, [r8 + 0x2e]
mov qword [rbp + 8], rax
lea rbx, [rbp - 8]
cmp rcx, 0xf
cmova rbx, qword [rbp - 8]
lea rax, [0x1400ed21e]
cmp rax, rbx
jbe 0x14008be86
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008be86
cmp rbx, r14
ja 0x14008be7e
xor esi, esi
jmp 0x14008be89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x28]
call fcn.14008e0c0
nop
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
mov r15d, 0x14
lea r14, str.Cant_map_sections:
cmp rax, r15
jb 0x14008be17
lea rax, [r8 + 0x14]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x28]
lea rax, [0x1400ed1ec]
cmp rax, rbx
jbe 0x14008bddb
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008bddb
cmp rbx, r14
ja 0x14008bdd3
xor esi, esi
jmp 0x14008bdde
mov rsi, rbx
sub rsi, r14
jmp 0x14008bdde
mov rsi, r15
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x14]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x28]
jmp 0x14008be2d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp - 0x28]
call fcn.1400663b0
mov rdx, qword [rbp + 0x1a8]
jmp 0x14008bc5b
mov rsi, rbx
sub rsi, r14
jmp 0x14008be89
mov rsi, r15
inc r8
lea rcx, [rbx + 0x2e]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x2e]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 8]
jmp 0x14008bed8
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp - 8]
call fcn.1400663b0
mov rdx, qword [rbp + 0x1a8]
jmp 0x14008bc5b
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x40]
lea r8, [rbp + 0x120]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c06e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
sub rax, r8
lea r15d, [rsi + 0x14]
lea r14, str.Cant_write_mapping
cmp rax, r15
jb 0x14008bff4
lea rax, [r8 + 0x14]
mov qword [rbp + 0x28], rax
lea rbx, [rbp + 0x18]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x18]
lea rax, [0x1400ed234]
cmp rax, rbx
jbe 0x14008bfb6
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008bfb6
cmp rbx, r14
jbe 0x14008bfb9
mov rsi, rbx
sub rsi, r14
jmp 0x14008bfb9
mov rsi, r15
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x14]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x18]
xor esi, esi
jmp 0x14008c00a
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x18]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp + 0x18]
call fcn.1400663b0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x60]
jmp 0x14008bc5b
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14008c19a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x38]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
sub rax, r8
lea r15d, [rbx + 0x27]
lea r14, str.Memory_shellcode_allocation_failed__ex_
cmp rax, r15
jb 0x14008c143
lea rax, [r8 + 0x27]
mov qword [rbp + 0x48], rax
lea rbx, [rbp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x38]
lea rax, [0x1400ed25f]
cmp rax, rbx
jbe 0x14008c105
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c105
cmp rbx, r14
jbe 0x14008c108
mov rsi, rbx
sub rsi, r14
jmp 0x14008c108
mov rsi, r15
inc r8
lea rcx, [rbx + 0x27]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x27]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x38]
xor esi, esi
jmp 0x14008c159
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x38]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp + 0x38]
jmp 0x14008c046
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
lea r8, [0x14008cd90]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c2fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x58]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
sub rax, r8
mov r15d, 0x16
lea r14, str.Cant_write_shellcode
cmp rax, r15
jb 0x14008c270
lea rax, [r8 + 0x16]
mov qword [rbp + 0x68], rax
lea rbx, [rbp + 0x58]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x58]
lea rax, [0x1400ed276]
cmp rax, rbx
jbe 0x14008c22d
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c22d
cmp rbx, r14
jbe 0x14008c230
mov rsi, rbx
sub rsi, r14
jmp 0x14008c230
mov rsi, r15
inc r8
lea rcx, [rbx + 0x16]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x16]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x58]
mov rbx, qword [rsp + 0x68]
xor esi, esi
jmp 0x14008c286
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp + 0x58]
call fcn.1400663b0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x14008bc58
mov rax, qword [0x140103488]
cmp rax, 0xe
jb 0x14008c343
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0xe
mov r8d, 0xe
lea rdx, str.Data_allocated
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], sil
mov rbx, qword [rsp + 0x68]
jmp 0x14008c357
lea r9, str.Data_allocated
mov edx, 0xe
mov rcx, rdi
call fcn.14007d230
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x14008c48f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x78]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
sub rax, r8
mov r15d, 0x17
lea r14, str.Thread_creation_failed
cmp rax, r15
jb 0x14008c438
lea rax, [r8 + 0x17]
mov qword [rbp + 0x88], rax
lea rbx, [rbp + 0x78]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x78]
lea rax, [0x1400ed29f]
cmp rax, rbx
jbe 0x14008c3f5
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c3f5
cmp rbx, r14
jbe 0x14008c3f8
mov rsi, rbx
sub rsi, r14
jmp 0x14008c3f8
mov rsi, r15
inc r8
lea rcx, [rbx + 0x17]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x17]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x78]
mov rbx, qword [rsp + 0x68]
xor esi, esi
jmp 0x14008c44e
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x78]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp + 0x78]
jmp 0x14008c2c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140103488]
cmp rax, 0x25
jb 0x14008c4da
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x25
mov r8d, 0x25
lea rdx, str.Thread_created__waiting_for_return...
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x25], sil
jmp 0x14008c4f0
lea r9, str.Thread_created__waiting_for_return...
mov edx, 0x25
mov rcx, rdi
call fcn.14007d230
nop
mov dword [rbp + 0x1a0], esi
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rbp + 0x1a0]
cmp edx, 0x103
jne 0x14008cc43
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp + 0x180]
cmp rsi, 0x404040
je 0x14008cbb8
cmp rsi, 0x505050
jne 0x14008c5c8
mov rax, qword [0x140103488]
cmp rax, 0x22
jb 0x14008c5b4
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x22
mov r8d, 0x22
lea rdx, str.WARNING:_Exception_support_failed_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x22], 0
jmp 0x14008c5c8
lea r9, str.WARNING:_Exception_support_failed_
mov edx, 0x22
mov rcx, rdi
call fcn.14007d230
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
mov esi, 0
je 0x14008c4f0
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14008c652
mov rax, qword [0x140103488]
cmp rax, 0x19
jb 0x14008c639
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x19
lea r8d, [rsi + 0x19]
lea rdx, str.Unable_to_allocate_memory
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x19], sil
jmp 0x14008cd5e
lea r9, str.Unable_to_allocate_memory
mov edx, 0x19
mov rcx, rdi
call fcn.14007d230
jmp 0x14008cd5e
xor edx, edx
mov r8d, 0x1400000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r14, qword [rbp + 0x1a8]
test r15b, r15b
je 0x14008c6e0
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
mov r8, rbx
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c6e0
mov rax, qword [0x140103488]
cmp rax, 0x1c
jb 0x14008c6cc
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov esi, 0x1c
mov qword [0x140103480], rsi
mov r8d, esi
lea rdx, str.WARNING_:_Cant_clear_HEADER
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1c], 0
jmp 0x14008c6e0
lea r9, str.WARNING_:_Cant_clear_HEADER
mov edx, 0x1c
mov rcx, rdi
call fcn.14007d230
cmp byte [rbp + 0x220], 0
je 0x14008c994
movzx ebx, word [r13 + 0x14]
add rbx, 0x18
add rbx, r13
xor esi, esi
mov dword [rbp + 0x1a0], esi
cmp word [r13 + 6], si
je 0x14008c994
lea r15d, [rsi + 0x14]
lea r8, [0x1400ed368]
lea r9, str..rsrc
lea r10, str..reloc
mov edx, dword [rbx + 8]
test edx, edx
je 0x14008c97b
cmp byte [rbp + 0x230], 0
jne 0x14008c756
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14008c756
cmp rcx, 7
jne 0x14008c740
jmp 0x14008c798
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x14008c776
cmp rcx, 6
jne 0x14008c760
jmp 0x14008c798
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x14008c97b
cmp rcx, 7
jne 0x14008c780
mov r9, rdx
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c966
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xd8]
call fcn.14008e0c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], al
jne 0x14008c7f0
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140065a70
nop
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
sub rax, r8
cmp rax, 0x14
jb 0x14008c8b5
lea rax, [r8 + 0x14]
mov qword [rbp - 0x78], rax
lea rsi, [rsp + 0x78]
cmp rcx, 0xf
cmova rsi, qword [rsp + 0x78]
lea rax, [0x1400ed394]
cmp rax, rsi
jbe 0x14008c864
lea rax, [rsi + r8]
lea rcx, str.Cant_clear_section
cmp rcx, rax
ja 0x14008c864
cmp rsi, rcx
ja 0x14008c85c
xor r14d, r14d
jmp 0x14008c867
mov r14, rsi
sub r14, rcx
jmp 0x14008c867
mov r14, r15
inc r8
lea rcx, [rsi + 0x14]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, str.Cant_clear_section
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
sub r8, r14
lea rdx, [0x1400ed394]
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
mov esi, dword [rbp + 0x1a0]
mov r14, qword [rbp + 0x1a8]
jmp 0x14008c8d3
mov qword [rsp + 0x28], r15
lea rax, str.Cant_clear_section
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140085060
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xor ecx, ecx
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xf8]
call fcn.14008e150
mov rdx, rax
mov rcx, rdi
call fcn.140074f70
lea rcx, [rbp + 0xf8]
call fcn.1400663b0
nop
lea rcx, [rbp + 0xb8]
call fcn.1400663b0
nop
lea rcx, [rsp + 0x78]
call fcn.1400663b0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400663b0
lea r10, str..reloc
lea r9, str..rsrc
lea r8, [0x1400ed368]
inc esi
mov dword [rbp + 0x1a0], esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008c725
cmp byte [rbp + 0x228], 0
je 0x14008ca50
movzx ebx, word [r13 + 0x14]
add rbx, 0x3c
xor esi, esi
cmp word [r13 + 6], si
je 0x14008ca1e
add rbx, r13
lea r15d, [rsi + 0x20]
nop word [rax + rax]
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x14008ca0f
mov dword [rbp + 0x1a0], 0
mov eax, dword [rbx]
test eax, 0x80000000
jbe 0x14008c9e2
mov r9d, 4
jmp 0x14008c9f1
test eax, 0x20000000
mov r9d, 2
cmova r9d, r15d
mov r8, rcx
mov edx, dword [rbx - 0x18]
add rdx, r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008c9c0
mov dword [rbp + 0x1a8], 0
movzx eax, word [r13 + 0x14]
mov r8d, dword [rax + r13 + 0x24]
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008cacf
mov rax, qword [0x140103488]
cmp rax, 0x1e
jb 0x14008cabb
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x1e
mov r8d, 0x1e
lea rdx, str.WARNING:_Cant_clear_shellcode
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1e], 0
jmp 0x14008cacf
lea r9, str.WARNING:_Cant_clear_shellcode
mov edx, 0x1e
mov rcx, rdi
call fcn.14007d230
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x14008cb3e
mov rax, qword [0x140103488]
cmp rax, 0x28
jb 0x14008cb2a
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x28
mov r8d, 0x28
lea rdx, str.WARNING:_cant_release_shell_code_memory
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x14008cb3e
lea r9, str.WARNING:_cant_release_shell_code_memory
mov edx, 0x28
mov rcx, rdi
call fcn.14007d230
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x14008cbb1
mov rax, qword [0x140103488]
cmp rax, 0x2a
jb 0x14008cb9d
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x2a
mov r8d, 0x2a
lea rdx, str.WARNING:_cant_release_mapping_data_memory
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x2a], 0
mov al, 1
jmp 0x14008cd60
lea r9, str.WARNING:_cant_release_mapping_data_memory
mov edx, 0x2a
mov rcx, rdi
call fcn.14007d230
mov al, 1
jmp 0x14008cd60
mov rax, qword [0x140103488]
cmp rax, 0x11
jb 0x14008cbf7
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x11
mov r8d, 0x11
lea rdx, str.Wrong_mapping_ptr
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x11], 0
jmp 0x14008cc0b
lea r9, str.Wrong_mapping_ptr
mov edx, 0x11
mov rcx, rdi
call fcn.14007d230
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x68]
jmp 0x14008bc5b
lea rcx, [rbp + 0x98]
call fcn.14008e0c0
nop
mov r8, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
sub rax, r8
mov esi, 0x1c
lea r15, str.Process_crashed__exit_code:
cmp rax, rsi
jb 0x14008ccfd
lea rax, [r8 + 0x1c]
mov qword [rbp + 0xa8], rax
lea rbx, [rbp + 0x98]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x98]
lea rax, [0x1400ed2e4]
cmp rax, rbx
jbe 0x14008ccbe
lea rax, [rbx + r8]
cmp r15, rax
ja 0x14008ccbe
cmp rbx, r15
ja 0x14008ccb6
xor r14d, r14d
jmp 0x14008ccc1
mov r14, rbx
sub r14, r15
jmp 0x14008ccc1
mov r14, rsi
inc r8
lea rcx, [rbx + 0x1c]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub rsi, r14
lea rdx, [r15 + 0x1c]
add rdx, r14
lea rcx, [rbx + r14]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x98]
jmp 0x14008cd16
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdx, rsi
lea rcx, [rbp + 0x98]
call fcn.140085060
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140074f70
lea rcx, [rsp + 0x40]
call fcn.1400663b0
nop
lea rcx, [rbp + 0x98]
call fcn.1400663b0
xor al, al
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.1400af310
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret