Function at 0x1400471c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rax, qword [0x14006e010]
xor rax, rsp
mov qword [rbp + 0x230], rax
xor r13d, r13d
mov dword [rbp - 0x10], 0xb8
xor eax, eax
mov dword [rbp - 0x44], r13d
lea rdi, [rbp]
mov dword [rbp - 0x40], r13d
mov ecx, 0x14
mov dword [rbp - 0xc], 0xd18b4c00
rep stosb byte [rdi], al
lea rdi, [rbp + 0x20]
mov word [rbp - 8], 0x50f
mov ecx, 0x104
mov byte [rbp - 6], 0xc3
rep stosb byte [rdi], al
lea rax, [rbp + 0x20]
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
cmp word [rbp + 0x20], r13w
je 0x14004725a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140047250
mov r12d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r12w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140047270
mov word [rax], r13w
lea rax, [rbp + 0x20]
cmp word [rbp + 0x20], r13w
je 0x14004729a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140047290
lea rdx, [0x140061ec0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400472b0
mov word [rax], r13w
lea rcx, [rbp + 0x20]
mov eax, r13d
cmp word [rbp + 0x20], r13w
je 0x1400472de
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x1400472d2
add ax, ax
mov dword [rbp - 0x78], 0x30
mov word [rbp - 0x30], ax
mov r14, r13
add ax, 2
mov qword [rbp - 0x70], r13
mov word [rbp - 0x2e], ax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x370], rbx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004736c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004735e
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047368
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047344
jmp 0x14004736c
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov eax, 0x5a4d
test r9, r9
je 0x140047416
cmp word [r9], ax
jne 0x140047416
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047416
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047416
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047416
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004740a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047400
sub rcx, rsi
test al, al
je 0x1400473fb
cmp byte [rdx], r13b
je 0x140047400
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400473e4
jmp 0x140047400
cmp byte [rdx], r13b
je 0x140047459
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047459
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400473d0
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004746e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004744f
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004746a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047435
jmp 0x14004746e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x140047419
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x140047516
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140047516
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047516
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047516
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047516
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004750a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047500
sub rcx, rsi
test al, al
je 0x1400474fb
cmp byte [rdx], r13b
je 0x140047500
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400474e4
jmp 0x140047500
cmp byte [rdx], r13b
je 0x140047556
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047556
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400474d0
mov r14, r13
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004756b
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004754c
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047567
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047532
jmp 0x14004756b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x140047519
lea r13, [rdi - 0x10]
mov r9, qword [r13 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x1400476a4
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400476a4
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400476a4
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400476a4
mov edi, dword [rax + 0x20]
xor r13d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r13d
test r10d, r10d
je 0x1400476a7
nop word [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004761a
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140047610
sub rcx, rsi
test al, al
je 0x14004760b
cmp byte [rdx], r13b
je 0x140047610
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400475f4
jmp 0x140047610
cmp byte [rdx], r13b
je 0x140047628
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047628
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400475e0
jmp 0x1400476a7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400476a7
test r14, r14
je 0x1400476a7
test r15, r15
je 0x1400476a7
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x70]
call r15
test eax, eax
js 0x1400476a7
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r14
test eax, eax
js 0x1400476a7
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400476a7
call rdi
jmp 0x1400476a7
xor r13d, r13d
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400476eb
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400476dd
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x1400476e7
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400476c3
jmp 0x1400476eb
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x80]
lea r15, str.ZwUnmapViewOfSection
test r9, r9
je 0x140047894
mov r10, qword [r14 + 0x30]
test r10, r10
je 0x140047894
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400477ae
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400477ae
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400477ae
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x1400477ae
lea r14, str.NtQueryInformationProcess
nop
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400477a2
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140047794
sub rcx, r14
test al, al
je 0x14004778b
cmp byte [rdx], 0
je 0x140047794
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047774
jmp 0x140047794
cmp byte [rdx], 0
je 0x14004782b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004782b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140047760
mov r11, r13
mov ecx, 0x5a4d
cmp word [r10], cx
jne 0x140047859
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140047859
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140047859
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov ebx, dword [rax + 0x14]
add r14, r10
test ebx, ebx
je 0x140047859
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r10
je 0x14004784d
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047843
sub rcx, r15
test al, al
je 0x14004783e
cmp byte [rdx], 0
je 0x140047843
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047814
jmp 0x140047843
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r11d, dword [rsi + rcx*4]
add r11, r9
jmp 0x1400477b1
cmp byte [rdx], 0
je 0x140047877
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047877
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x140047800
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r11, r11
jne 0x140047887
call rax
movzx edi, r13w
mov dword [rsp + 0x64], edi
jmp 0x14004789c
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x14004785c
movzx edi, word [r11 + 4]
mov dword [rsp + 0x64], edi
call rax
jmp 0x14004789c
mov edi, r13d
mov dword [rsp + 0x64], r13d
xor eax, eax
mov word [rbp - 0x48], di
lea rdi, [rbp + 0x20]
mov qword [rbp - 0x38], r13
mov ecx, 0x104
mov qword [rbp - 0x80], r13
rep stosb byte [rdi], al
cmp word [rbp + 0x20], 0
lea rax, [rbp + 0x20]
mov qword [rbp - 0x30], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
je 0x1400478da
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x1400478d0
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r12w
lea rax, [rax + 2]
movzx r12d, word [rcx + rax]
test r12w, r12w
jne 0x1400478f0
mov word [rax], r13w
lea rax, [rbp + 0x20]
cmp word [rbp + 0x20], r12w
je 0x14004791c
add rax, 2
cmp word [rax], 0
jne 0x140047912
lea rcx, [0x140061ec0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax + rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140047930
mov word [rax], r13w
lea rcx, [rbp + 0x20]
mov eax, r13d
cmp word [rbp + 0x20], dx
je 0x14004795d
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140047951
add ax, ax
mov dword [rbp - 0x78], 0x30
mov word [rsp + 0x70], ax
mov r14, r13
add ax, 2
mov qword [rbp - 0x70], r13
mov word [rsp + 0x72], ax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x20]
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400479e8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400479da
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x1400479e4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400479c0
jmp 0x1400479e8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r12d, 0x5a4d
test r9, r9
je 0x140047a92
cmp word [r9], r12w
jne 0x140047a92
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047a92
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047a92
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047a92
lea rsi, str.ZwOpenSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140047a86
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047a7c
sub rcx, rsi
nop word [rax + rax]
test al, al
je 0x140047a77
cmp byte [rdx], 0
je 0x140047a7c
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047a60
jmp 0x140047a7c
cmp byte [rdx], 0
je 0x140047ad5
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047ad5
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047a46
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047aea
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047acb
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047ae6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047ab1
jmp 0x140047aea
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x140047a95
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140047b88
cmp word [r9], r12w
jne 0x140047b88
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047b88
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047b88
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047b88
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140047b7c
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047b72
sub rcx, rsi
test al, al
je 0x140047b6d
cmp byte [rdx], 0
je 0x140047b72
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047b56
jmp 0x140047b72
cmp byte [rdx], 0
je 0x140047bc8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047bc8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047b42
mov rsi, r13
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140047bdc
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047bbe
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047bd8
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140047ba4
jmp 0x140047bdc
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov esi, dword [rbx + rcx*4]
add rsi, r9
jmp 0x140047b8b
lea r13, [rdi - 0x10]
mov r9, qword [r13 + 0x30]
test r9, r9
je 0x140047d03
cmp word [r9], r12w
jne 0x140047d03
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047d03
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047d03
mov edi, dword [rax + 0x20]
xor r13d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r13d
test r10d, r10d
je 0x140047d06
lea r14, str.NtClose
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x140047c7d
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140047c73
sub rcx, r14
test al, al
je 0x140047c6e
cmp byte [rdx], r13b
je 0x140047c73
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047c57
jmp 0x140047c73
cmp byte [rdx], r13b
je 0x140047c8b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047c8b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047c43
jmp 0x140047d06
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140047d06
test rsi, rsi
je 0x140047d06
test r15, r15
je 0x140047d06
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rbp - 0x80]
call r15
test eax, eax
js 0x140047d06
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x38]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call rsi
test eax, eax
js 0x140047d06
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140047d06
call rdi
jmp 0x140047d06
xor r13d, r13d
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047d4a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047d3c
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047d46
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047d22
jmp 0x140047d4a
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x38]
test r9, r9
je 0x140047ee0
mov r10, qword [r14 + 0x30]
test r10, r10
je 0x140047ee0
cmp word [r9], r12w
jne 0x140047e00
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047e00
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047e00
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x140047e00
lea r14, str.NtSetInformationProcess
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x140047df4
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140047de6
sub rcx, r14
test al, al
je 0x140047ddd
cmp byte [rdx], 0
je 0x140047de6
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047dc6
jmp 0x140047de6
cmp byte [rdx], 0
je 0x140047e7f
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047e7f
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140047db2
mov r11, r13
cmp word [r10], r12w
jne 0x140047ead
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140047ead
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140047ead
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov ebx, dword [rax + 0x14]
add r14, r10
test ebx, ebx
je 0x140047ead
lea r15, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r10
je 0x140047ea1
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047e97
sub rcx, r15
test al, al
je 0x140047e92
cmp byte [rdx], 0
je 0x140047e97
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047e68
jmp 0x140047e97
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r11d, dword [rsi + rcx*4]
add r11, r9
jmp 0x140047e03
cmp byte [rdx], 0
je 0x140047ec7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047ec7
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x140047e54
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r11, r11
jne 0x140047ed7
call rax
movzx r14d, r13w
jmp 0x140047ee3
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x140047eb0
movzx r14d, word [r11 + 4]
call rax
jmp 0x140047ee3
mov r14d, r13d
mov r12d, dword [rsp + 0x64]
mov word [rsp + 0x70], r14w
test r12w, r12w
je 0x140047efa
test r14w, r14w
jne 0x140047f69
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140047f4d
cmp al, 6
jne 0x140047f37
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140047f37
sub ecx, 1
je 0x140047f2a
cmp ecx, 1
jne 0x140047f4d
lea r12d, [rcx + 0x17]
lea r14d, [rcx + 0x1a]
jmp 0x140047f59
mov r12d, 0x17
lea r14d, [r12 + 3]
jmp 0x140047f59
mov eax, 0x19
mov r12d, 0x16
movzx r14d, ax
mov word [rsp + 0x70], ax
jmp 0x140047f5f
mov r12d, 0x19
mov r14d, 0x1c
mov word [rsp + 0x70], r14w
mov word [rbp - 0x48], r12w
mov dword [rsp + 0x64], r12d
mov rax, qword gs:[0x60]
mov r15, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047fad
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047f9f
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140047fa9
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047f85
jmp 0x140047fad
lea r15, [rdi - 0x10]
mov rsi, qword [r15 + 0x30]
test rsi, rsi
je 0x14004805f
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14004805f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004805f
mov edi, dword [rax + rsi + 0x88]
add rdi, rsi
je 0x14004805f
mov ebx, dword [rdi + 0x24]
mov r15d, dword [rdi + 0x1c]
add rbx, rsi
add r15, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rdi + 0x14]
mov r8d, eax
mov eax, 0x88888889
mul r8d
shr edx, 4
imul ecx, edx, 0x1e
mov edx, r13d
sub r8d, ecx
mov ecx, r13d
test r9d, r9d
je 0x14004805f
nop
movzx eax, word [rbx]
mov edi, dword [r15 + rax*4]
add rdi, rsi
cmp byte [rdi], 0x4c
jne 0x140048054
cmp byte [rdi + 1], 0x8b
jne 0x140048054
cmp byte [rdi + 2], 0xd1
jne 0x140048054
cmp byte [rdi + 3], 0xb8
jne 0x140048054
cmp byte [rdi + 0x12], 0xf
jne 0x140048054
cmp byte [rdi + 0x13], 5
jne 0x140048054
inc edx
cmp edx, r8d
je 0x140048062
inc ecx
add rbx, 2
cmp ecx, r9d
jb 0x140048020
mov rdi, r13
test rdi, rdi
je 0x1400484b1
lea r9, [rbp - 0x40]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp - 0xf]
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x1400480a0
lea rcx, [rbp - 0xf]
lea rax, [rbp - 0x46]
nop dword [rax + rax]
movzx r15d, byte [rbp - 0x47]
lea rax, [rbp]
mov byte [rbp - 0xe], r15b
mov byte [rbp - 0xf], r12b
cmp rax, rdi
jbe 0x140048170
lea rax, [rdi + 0x14]
lea rcx, [rbp]
cmp rcx, rax
jae 0x140048170
movzx ecx, byte [rax - 2]
movzx r13d, byte [rax - 1]
mov byte [rsp + 0x62], cl
movzx ecx, byte [rax - 3]
mov byte [rsp + 0x61], cl
movzx ecx, byte [rax - 4]
mov byte [rsp + 0x60], cl
movzx ecx, byte [rax - 5]
mov byte [rsp + 0x5f], cl
movzx ecx, byte [rax - 6]
mov byte [rsp + 0x5e], cl
movzx ecx, byte [rax - 7]
mov byte [rsp + 0x5d], cl
movzx ecx, byte [rax - 8]
mov byte [rsp + 0x5c], cl
movzx ecx, byte [rax - 9]
mov byte [rsp + 0x5b], cl
movzx ecx, byte [rax - 0xa]
mov byte [rsp + 0x5a], cl
movzx ecx, byte [rax - 0xb]
mov byte [rsp + 0x59], cl
movzx ecx, byte [rax - 0xc]
mov byte [rsp + 0x58], cl
movzx ecx, byte [rax - 0xd]
mov byte [rsp + 0x57], cl
movzx ecx, byte [rax - 0xe]
mov byte [rsp + 0x56], cl
movzx ecx, byte [rax - 0xf]
mov byte [rsp + 0x55], cl
movzx ecx, byte [rax - 0x10]
mov byte [rsp + 0x54], cl
movzx ecx, byte [rax - 0x11]
mov byte [rsp + 0x53], cl
movzx ecx, byte [rax - 0x12]
mov byte [rsp + 0x52], cl
movzx ecx, byte [rax - 0x13]
mov byte [rsp + 0x51], cl
movzx ecx, byte [rdi]
mov byte [rsp + 0x50], cl
jmp 0x14004820c
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x13]
mov byte [rsp + 0x50], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x51], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x52], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x53], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x57], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x60], al
movzx eax, byte [rdi + 0x11]
mov byte [rsp + 0x61], al
movzx eax, byte [rdi + 0x12]
mov byte [rsp + 0x62], al
lea rax, [rbp - 0x10]
cmp rdi, rax
jbe 0x140048220
lea rax, [rbp - 5]
nop dword [rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x44]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], r15b
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], r12b
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
js 0x140048267
cmp dword [rbp - 0x44], 0
je 0x140048682
mov esi, 0xb
lea rbx, [rbp - 0x10]
mov r11d, esi
sub rbx, rdi
mov r9, rdi
nop dword [rax]
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400482b6
inc r9
sub r11, 1
jne 0x140048280
jmp 0x1400482bf
cmp r8d, r10d
jne 0x140048682
lea rcx, [rbp - 0xf]
lea rax, [rsp + 0x70]
cmp rcx, rax
jbe 0x1400482e0
lea rcx, [rbp - 0xf]
lea rax, [rsp + 0x72]
nop word [rax + rax]
movzx r12d, byte [rsp + 0x71]
lea rax, [rbp - 0x10]
mov byte [rbp - 0xe], r12b
mov byte [rbp - 0xf], r14b
cmp rdi, rax
jbe 0x140048300
lea rax, [rbp - 5]
nop dword [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x44]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], r12b
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], r14b
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov dword [rbp - 0x44], 0
call rdi
test eax, eax
jns 0x1400484b8
lea rax, [rbp]
cmp rdi, rax
jbe 0x140048400
lea rax, [rbp + 0x14]
cmp rdi, rax
jae 0x140048400
movzx eax, byte [rsp + 0x62]
mov byte [rdi + 0x13], r13b
mov byte [rdi + 0x12], al
movzx eax, byte [rsp + 0x61]
mov byte [rdi + 0x11], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
jmp 0x14004849b
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x61]
mov byte [rdi + 0x11], al
movzx eax, byte [rsp + 0x62]
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], r13b
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x40]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor al, al
jmp 0x140048684
mov r11, rsi
mov r9, rdi
nop
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400484f6
inc r9
sub r11, 1
jne 0x1400484c0
jmp 0x1400484ff
cmp r8d, r10d
jne 0x140048682
lea rcx, [rbp - 0xf]
mov dword [rbp - 0x44], 1
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x140048520
lea rcx, [rbp - 0xf]
lea rax, [rbp - 0x46]
nop dword [rax + rax]
mov eax, dword [rsp + 0x64]
lea rcx, [rbp - 0x10]
mov byte [rbp - 0xe], r15b
mov byte [rbp - 0xf], al
cmp rdi, rcx
jbe 0x140048540
lea rcx, [rbp - 5]
nop dword [rax + rax]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x44]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], r15b
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], 0
call rdi
test eax, eax
js 0x140048586
cmp dword [rbp - 0x44], 0
jne 0x140048682
mov r11, rsi
mov r9, rdi
nop dword [rax]
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400485c6
inc r9
sub r11, 1
jne 0x140048590
jmp 0x1400485cf
cmp r8d, r10d
jne 0x140048682
lea rcx, [rbp - 0xf]
lea rax, [rsp + 0x70]
cmp rcx, rax
jbe 0x1400485f0
lea rcx, [rbp - 0xf]
lea rax, [rsp + 0x72]
nop word [rax + rax]
lea rax, [rbp - 0x10]
mov byte [rbp - 0xe], r12b
mov byte [rbp - 0xf], r14b
cmp rdi, rax
jbe 0x140048605
lea rax, [rbp - 5]
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rbp - 0x44]
mov dword [rdi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rdi + 2], r12b
mov rcx, 0xffffffffffffffff
mov byte [rdi + 1], r14b
mov byte [rdi], 0xb8
lea edx, [r9 + 0x1b]
mov dword [rbp - 0x44], 1
call rdi
mov r9, rdi
nop
movzx r8d, byte [r9]
movzx r10d, byte [r9 + rbx]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140048679
inc r9
sub rsi, 1
jne 0x140048640
jmp 0x14004833f
cmp r8d, r10d
je 0x14004833f
mov al, 1
mov rbx, qword [rsp + 0x370]
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140057e20
lea r11, [rsp + 0x340]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret