Function at 0x1400010a0
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x178
lea rcx, [rsp + 0xb0]
and qword [rcx + 0x38], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x28], xmm0
lea rax, [0x140006310]
mov qword [rcx], rax
lea rax, str.ntdll.dll_n
mov qword [rcx + 8], rax
lea rax, [0x140006365]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 0x40
and qword [rcx + 0x20], 0
call section..text
test al, 1
je 0x1400011b1
mov edi, edx
lea rsi, [rsp + 0xf0]
mov edx, 8
mov rcx, rsi
call fcn.140001f54
cmp dword [rsi], 1
je 0x140001a3d
lea rbx, [rsp + 0xf0]
mov rax, qword [rbx + 8]
mov r15, qword [rbx + 0x10]
mov byte [r15], dil
lea r14, [rsp + 0x60]
mov qword [r14], rax
mov qword [r14 + 8], r15
mov qword [r14 + 0x10], 1
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movups xmm3, xmmword [rsp + 0xe0]
movaps xmmword [rbx + 0x30], xmm3
movaps xmmword [rbx + 0x20], xmm2
movaps xmmword [rbx + 0x10], xmm1
movaps xmmword [rbx], xmm0
mov edi, 1
mov rcx, rbx
call section..text
test al, 1
je 0x1400011bd
mov ebp, edx
cmp rdi, qword [rsp + 0x60]
jne 0x1400011a3
mov edx, 1
mov rcx, r14
call fcn.140001dd9
mov r15, qword [rsp + 0x68]
mov byte [r15 + rdi], bpl
inc rdi
mov qword [rsp + 0x70], rdi
jmp 0x14000117c
mov r15d, 1
xor edi, edi
xor esi, esi
jmp 0x1400011c2
mov rsi, qword [rsp + 0x60]
movabs rbp, 0x8000000000000000
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov rdx, r15
mov r8, rdi
call fcn.140002a91
test byte [rbx], 1
je 0x1400011fe
cmp rsi, rbp
jne 0x140001a3d
mov rsi, r15
mov r15, rdi
mov rdi, qword [rsp + 0xf8]
cmp rdi, 0xf
ja 0x14000121f
xor eax, eax
cmp rdi, rax
je 0x1400012b4
cmp byte [r15 + rax], 0
je 0x14000129e
inc rax
jmp 0x140001206
lea rbx, [r15 + 7]
and rbx, 0xfffffffffffffff8
sub rbx, r15
jne 0x140001230
xor ebx, ebx
jmp 0x140001241
mov rcx, r15
mov rdx, rbx
call fcn.140002a72
cmp rax, 1
je 0x14000129e
movabs rax, 0x8080808080808080
movabs rcx, 0x101010101010100
lea rdx, [rdi - 0x10]
cmp rbx, rdx
ja 0x14000128a
mov r8, qword [r15 + rbx]
mov r9, qword [r15 + rbx + 8]
mov r10, rcx
sub r10, r8
or r10, r8
mov r8, rcx
sub r8, r9
or r8, r9
and r10, rax
and r10, r8
cmp r10, rax
jne 0x14000128a
add rbx, 0x10
jmp 0x140001259
lea rcx, [r15 + rbx]
mov rdx, rdi
sub rdx, rbx
call fcn.140002a72
test rax, rax
je 0x1400012b4
mov qword [rsp + 0xa0], r15
cmp rsi, rbp
je 0x140001381
jmp 0x140001a3d
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], rdi
cmp rsi, rdi
jne 0x140001337
lea rax, [rbp - 2]
cmp rsi, rax
ja 0x140001a3d
lea rdi, [rsi + 1]
test rsi, rsi
je 0x1400012f5
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0x100], rsi
mov eax, 1
jmp 0x1400012f7
xor eax, eax
lea r8, [rsp + 0xf0]
mov qword [r8 + 8], rax
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rdi
call fcn.140001e94
mov rax, qword [rsi + 8]
test byte [rsi], 1
je 0x14000132d
lea rcx, [rbp + 1]
cmp rax, rcx
je 0x140001337
jmp 0x140001a3d
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rdi
lea rdi, [rsp + 0x60]
mov rcx, rdi
xor edx, edx
call fcn.140001d62
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi + 0x10]
cmp qword [rdi], rdx
jbe 0x140001379
test rdx, rdx
je 0x14000136a
call fcn.140001c70
mov rcx, rax
test rax, rax
jne 0x140001379
jmp 0x140001a3d
mov edx, 1
call fcn.140001c40
mov ecx, 1
mov qword [rsp + 0xa0], rcx
lea rdx, str.ntdll.dll_n
lea rsi, [rsp + 0x60]
mov r8d, 9
mov rcx, rsi
call fcn.140001fb1
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x168], rax
lea r14, [rsp + 0xf0]
xor r12d, r12d
mov esi, 0x3ff
movabs r15, 0x1000000000000
mov r13, qword [rbx + 0x30]
test r13, r13
je 0x1400015a2
mov rdi, qword [rbx + 0x60]
mov qword [rsp + 0x58], rbx
movzx ebx, word [rbx + 0x58]
mov edx, ebx
shr edx, 1
mov rcx, r14
call fcn.140001ffb
and ebx, 0xfffffffe
add rbx, rdi
test r12b, r12b
je 0x140001416
jmp 0x140001422
cmp rdi, rbx
je 0x140001496
movzx eax, word [rdi]
add rdi, 2
mov ecx, eax
and ecx, 0xf800
cmp cx, 0xd800
jne 0x140001470
cmp ax, 0xdbff
ja 0x140001a28
cmp rdi, rbx
je 0x140001a28
movzx edx, word [rdi]
lea ecx, [rdx + 0x2000]
cmp cx, 0xfc00
jb 0x140001a28
add rdi, 2
and eax, esi
and edx, esi
shl rax, 0x2a
shl rdx, 0x20
or rdx, rax
add rdx, r15
jmp 0x140001477
movzx edx, ax
shl rdx, 0x20
test dx, dx
jne 0x14000148a
shr rdx, 0x20
mov rcx, r14
call fcn.140001c9a
jmp 0x14000140f
movzx eax, dx
cmp eax, 2
jne 0x140001a28
mov qword [rsp + 0x160], r13
mov rdi, qword [rsp + 0xf0]
cmp rdi, rbp
je 0x140001a3d
mov r13, rbp
mov rbp, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
mov rcx, r14
mov rdx, rbp
call fcn.140001fb1
mov rbx, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
lea rcx, [rsp + 0xb0]
mov rdx, rbx
call fcn.14000202c
mov rcx, qword [rsp + 0xf0]
mov rdx, rbx
call fcn.140001f32
mov rcx, rdi
mov rdx, rbp
call fcn.140001f32
mov rcx, r14
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x168]
call fcn.14000202c
mov rdi, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xc0]
mov rcx, rdi
mov r8, rbp
call fcn.140002d81
mov ebx, eax
mov rcx, qword [rsp + 0xf0]
mov rdx, rdi
call fcn.140001f32
mov rcx, qword [rsp + 0xb0]
test bl, bl
jne 0x140001581
mov rbx, qword [rsp + 0x58]
mov rbx, qword [rbx]
mov rdx, rbp
call fcn.140001f32
mov rbp, r13
jmp 0x1400013e3
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xa8], rax
mov rdx, rbp
call fcn.140001f32
mov r13, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x88]
call fcn.140001f32
test r13, r13
je 0x140001a3d
mov dword [rsp + 0xf0], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x108], xmm0
movups xmmword [rsp + 0x118], xmm0
movups xmmword [rsp + 0x124], xmm0
movups xmmword [rsp + 0x138], xmm0
movups xmmword [rsp + 0x148], xmm0
movaps xmmword [rsp + 0x60], xmm0
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
and dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x140001a3f
mov rdi, qword [rsp + 0xa8]
cmp word [rdi], 0x5a4d
jne 0x140001a3d
movsxd r13, dword [rdi + 0x3c]
cmp dword [r13 + rdi], 0x4550
jne 0x140001a3d
add r13, rdi
mov esi, dword [r13 + 0x50]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffe
jae 0x140001a3f
mov rcx, rax
mov edx, 8
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r8, rax
lea rax, [rsp + 0x170]
and qword [rax], 0
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov qword [rsp + 0x88], r8
mov r9, rsi
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x140001a3f
and qword [rsp + 0x90], 0
and qword [rsp + 0x98], 0
movzx ebp, word [r13 + 6]
add r13, 0x108
lea rdx, [rsp + 0x78]
xor edi, edi
mov qword [rsp + 0x58], 0
cmp rdi, rbp
je 0x14000190f
imul r15, rdi, 0x28
mov rax, qword [r13 + r15]
mov qword [rsp + 0x78], rax
mov r8d, 8
lea rcx, [rsp + 0xb0]
call fcn.140002a91
cmp dword [rsp + 0xb0], 1
je 0x140001a3d
inc rdi
add r15, r13
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc0]
lea rdx, [rcx + r8]
xor r9d, r9d
cmp r9, r8
je 0x1400017f6
mov rax, r9
add r9, rcx
movzx r10d, byte [r9]
test r10b, r10b
js 0x14000176c
inc r9
jmp 0x1400017e2
mov r11d, r10d
and r11d, 0x1f
movzx r14d, byte [r9 + 1]
and r14d, 0x3f
cmp r10b, 0xdf
jbe 0x1400017c4
movzx ebx, byte [r9 + 2]
shl r14d, 6
and ebx, 0x3f
or ebx, r14d
cmp r10b, 0xf0
jb 0x1400017d4
movzx r10d, byte [r9 + 3]
and r11d, 7
shl r11d, 0x12
shl ebx, 6
and r10d, 0x3f
or r10d, ebx
or r10d, r11d
cmp r10d, 0x110000
je 0x140001904
add r9, 4
jmp 0x1400017e2
add r9, 2
shl r11d, 6
or r11d, r14d
mov r10d, r11d
jmp 0x1400017e2
add r9, 3
shl r11d, 0xc
or ebx, r11d
mov r10d, ebx
sub r9, rdx
add r9, r8
test r10d, r10d
je 0x14000174f
mov r10b, 1
jmp 0x1400017ff
xor r10d, r10d
mov rax, r8
mov r9, r8
mov r11, r9
sub r11, rcx
sub r11, r9
cmp r9, r8
je 0x140001897
mov rdx, r8
add r8, rcx
movsx r12d, byte [r8 - 1]
test r12d, r12d
js 0x140001826
dec r8
jmp 0x140001880
movzx r14d, byte [r8 - 2]
cmp r14b, 0xc0
jge 0x140001851
movzx ebx, byte [r8 - 3]
cmp bl, 0xc0
jge 0x14000185b
movzx esi, byte [r8 - 4]
add r8, 0xfffffffffffffffc
and esi, 7
shl esi, 6
and ebx, 0x3f
or ebx, esi
jmp 0x140001862
add r8, 0xfffffffffffffffe
and r14d, 0x1f
jmp 0x14000186c
add r8, 0xfffffffffffffffd
and ebx, 0xf
shl ebx, 6
and r14d, 0x3f
or r14d, ebx
shl r14d, 6
and r12d, 0x3f
or r12d, r14d
cmp r12d, 0x110000
je 0x140001897
add r8, r11
test r12d, r12d
je 0x140001808
test r10b, r10b
mov r8d, 0
cmove rax, r8
jmp 0x1400018aa
test r10b, r10b
mov edx, 0
cmove rax, rdx
cmove r9, rdx
mov rdx, r9
sub rdx, rax
add rcx, rax
mov r9d, 5
lea r8, str..textu
call fcn.140002d81
test al, al
lea rdx, [rsp + 0x78]
je 0x1400016fa
mov eax, dword [r15 + 0xc]
mov rcx, qword [rsp + 0xa8]
add rcx, rax
mov qword [rsp + 0x90], rcx
add rax, qword [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov eax, dword [r15 + 8]
mov qword [rsp + 0x58], rax
jmp 0x1400016fa
xor r10d, r10d
mov r9, rax
jmp 0x1400017ff
lea rsi, [rsp + 0x90]
mov qword [rsp + 0x78], rsi
lea rbx, [0x140003b17]
lea r14, [0x140006340]
lea rdi, [rsp + 0xb0]
mov qword [rdi], r14
mov r15d, 2
mov qword [rdi + 8], r15
and qword [rdi + 0x20], 0
mov qword [rsp + 0x80], rbx
mov qword [rdi + 0x10], rdx
mov r12d, 1
mov qword [rdi + 0x18], r12
mov rcx, rdi
call fcn.140004548
lea rax, [rsp + 0x98]
mov qword [rdi], r14
mov qword [rdi + 8], r15
and qword [rdi + 0x20], 0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
lea rax, [rsp + 0x78]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], r12
lea rbx, [rsp + 0x78]
lea rcx, [rsp + 0xb0]
call fcn.140004548
and dword [rsp + 0x78], 0
mov rdx, qword [rsi]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov r14, qword [rsp + 0x58]
mov r8, r14
mov r9d, 0x80
call fcn.14000105e
cmp dword [rdi], 1
je 0x140001a3d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x90]
mov r9d, dword [rsp + 0x78]
mov qword [rsp + 0x20], rbx
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov r8, r14
call fcn.14000105e
cmp dword [rsi], 1
je 0x140001a3d
add rsp, 0x178
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xf8]
call fcn.140001f32
ud2
call fcn.14000471f
ud2