Function at 0x1800013b0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get ntdll base address
Map section object
Parse pe header
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa18
movaps xmmword [rsp + 0xa00], xmm6
cmp qword [0x180005090], 0
jne 0x18000142d
mov qword [rsp + 0x200], 0
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x18]
lea rdx, [rsp + 0x200]
call qword [sym.imp.ntdll.dll_RtlPcToFileHeader]
mov rax, qword [rsp + 0x200]
test rax, rax
jne 0x180001426
mov rcx, qword [sym.imp.ntdll.dll_RtlPcToFileHeader]
lea rdx, [rsp + 0x200]
call rcx
mov rax, qword [rsp + 0x200]
mov qword [0x180005090], rax
mov rsi, qword [sym.imp.ntdll.dll_NtYieldExecution]
mov di, 1
jmp 0x18000144f
call rsi
xor eax, eax
lock cmpxchg word [0x180005080], di
je 0x180001466
movzx eax, word [0x180005080]
cwde
cmp eax, 1
je 0x180001440
cmp eax, 2
jne 0x180001442
jmp 0x1800021c8
movaps xmm0, xmmword [0x180003c60]
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmm0, xmmword [str.PACKER_LOG_FOLDER]
movaps xmmword [rsp + 0x1d0], xmm0
mov dword [rsp + 0x1f0], 0x52
xor esi, esi
lea rdi, [rsp + 0x200]
mov r8d, 0x400
mov rcx, rdi
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x200
lea rdx, [rsp + 0x1d0]
mov r8d, 0x11
xor ecx, ecx
mov r9, rdi
call qword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
cmp eax, 0xc0000100
je 0x180001971
test eax, eax
jns 0x180001503
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov rsi, qword [rsp + 0xa0]
cmp word [rsp + rsi*2 + 0x1fe], 0x5c
je 0x180001534
cmp rsi, 0x1fe
ja 0x180001534
mov word [rsp + rsi*2 + 0x200], 0x5c
inc rsi
mov qword [rsp + 0xa0], rsi
lea rbx, [rsp + 0x600]
mov r8d, 0x400
mov rcx, rbx
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0x98], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x200
lea rdx, [rsp + 0x200]
xor ecx, ecx
mov r8, rsi
mov r9, rbx
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings]
test eax, eax
jns 0x180001598
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x600]
lea rdx, [rsp + 0xb0]
lea r9, [rsp + 0x120]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
jns 0x1800015e8
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
movzx ebx, word [rsp + 0xb0]
mov ebp, 0xc000000d
cmp rbx, 8
jb 0x1800017bc
mov rax, qword [rsp + 0xb8]
cmp word [rax], 0x5c
jne 0x1800017bc
cmp word [rax + 2], 0x3f
jne 0x1800017bc
cmp word [rax + 4], 0x3f
jne 0x1800017bc
cmp word [rax + 6], 0x5c
jne 0x1800017bc
shr rbx, 1
cmp word [rax + rbx*2 - 2], 0x5c
jne 0x1800017bc
lea r13, [rbx - 1]
xor r12d, r12d
xorps xmm6, xmm6
lea r15, [rsp + 0x80]
mov r14, qword [sym.imp.ntdll.dll_NtClose]
xor esi, esi
jmp 0x18000175c
inc r12
mov qword [rsp + 0xf0], 0
lea rax, [rax + rcx*2]
mov qword [rsp + 0xf8], rax
mov eax, r12d
sub eax, ecx
add eax, eax
mov word [rsp + 0xf2], ax
mov word [rsp + 0xf0], ax
mov qword [rsp + 0xd0], 0
movaps xmmword [rsp + 0x150], xmm6
movaps xmmword [rsp + 0x160], xmm6
mov dword [rsp + 0x150], 0x30
mov qword [rsp + 0x158], rsi
mov dword [rsp + 0x168], 0x40
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x170]
movups xmmword [rax], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x204021
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0xd0]
mov edx, 0x100001
lea r8, [rsp + 0x150]
mov r9, r15
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov ebp, eax
mov rcx, rsi
call r14
mov rsi, qword [rsp + 0xd0]
test ebp, ebp
js 0x1800017bc
cmp r12, r13
jae 0x1800017ce
mov rax, qword [rsp + 0xb8]
test r12, r12
je 0x180001780
cmp word [rax + r12*2], 0x5c
jne 0x180001784
inc r12
cmp r13, r12
jne 0x180001769
jmp 0x1800017ce
xor ecx, ecx
jmp 0x180001787
mov rcx, r12
test r12, r12
lea r12, [rcx + 1]
mov edx, 4
cmove r12, rdx
cmp r12, rbx
jae 0x180001661
cmp word [rax + r12*2], 0x5c
je 0x180001661
inc r12
cmp rbx, r12
jne 0x1800017a0
mov r12, rbx
jmp 0x180001661
lea r8, [0x180000000]
mov ecx, ebp
mov dl, 1
call fcn.180001190
xor esi, esi
xorps xmm6, xmm6
movaps xmmword [rsp + 0x1c0], xmm6
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm6
movaps xmmword [rsp + 0x190], xmm6
movaps xmmword [rsp + 0x180], xmm6
movaps xmmword [rsp + 0x170], xmm6
movaps xmmword [rsp + 0x160], xmm6
movaps xmmword [rsp + 0x150], xmm6
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x40]
mov r9, qword [0x7ffe0320]
mov ecx, r9d
mov edx, dword [0x7ffe0004]
imul rcx, rdx
shr rcx, 0x18
shr r9, 0x18
and r9, 0xffffffffffffff00
imul r9, rdx
add r9, rcx
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x150]
mov rcx, rbx
call fcn.1800026a0
mov qword [rsp + 0x80], 0
mov rcx, rbx
call sub.ntdll.dll_wcslen
lea ecx, [rax + rax]
add ecx, 2
add eax, eax
mov word [rsp + 0x80], ax
mov word [rsp + 0x82], cx
mov qword [rsp + 0x88], rbx
movaps xmmword [rsp + 0x100], xmm6
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xc8], 0
mov dword [rsp + 0xf0], 0x30
mov qword [rsp + 0xf8], rsi
mov dword [rsp + 0x108], 0x40
lea rax, [rsp + 0x80]
mov qword [rsp + 0x100], rax
movaps xmmword [rsp + 0x110], xmm6
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0xc8]
lea r8, [rsp + 0xf0]
lea r9, [rsp + 0xd0]
mov edx, 0x40110000
call qword [sym.imp.ntdll.dll_NtCreateFile]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
jns 0x180001969
lea r8, [0x180000000]
mov ecx, ebx
mov dl, 1
call fcn.180001190
mov rsi, qword [rsp + 0xc8]
mov qword [0x180005088], rsi
mov qword [rsp + 0x98], 0
mov rcx, qword [0x180005090]
movaps xmm6, xmmword [str.wine_get_version]
movaps xmmword [rsp + 0x200], xmm6
mov byte [rsp + 0x210], 0
mov dword [rsp + 0x600], 0x110010
mov qword [rsp + 0x608], rdi
mov qword [rsp + 0x150], 0
lea rdx, [rsp + 0x600]
lea r9, [rsp + 0x150]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
mov rbp, qword [rsp + 0x150]
test rbp, rbp
je 0x180001b5e
mov rsi, qword [0x180005090]
mov qword [rsp + 0x98], rsi
test rsi, rsi
jne 0x180001a12
lea r8, [0x180000000]
mov ecx, 0xe1110000
mov dl, 1
call fcn.180001190
movaps xmmword [rsp + 0x200], xmm6
mov byte [rsp + 0x210], 0
mov dword [rsp + 0x600], 0x110010
mov qword [rsp + 0x608], rdi
mov qword [rsp + 0x150], 0
lea rdx, [rsp + 0x600]
lea rbx, [rsp + 0x150]
mov rcx, rsi
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.ntdll.dll_LdrGetProcedureAddress]
cmp qword [rsp + 0x150], 0
mov ecx, 0xe111000b
jne 0x180001b97
mov qword [rsp + 0x210], 0
mov qword [rsp + 0x600], 0
mov qword [rsp + 0x200], 0x10
mov qword [rsp + 0x208], 1
lea rdx, [rsp + 0x200]
lea r9, [rsp + 0x600]
mov rcx, rsi
mov r8d, 3
call qword [sym.imp.ntdll.dll_LdrFindResource_U]
test eax, eax
js 0x180001b95
mov qword [rsp + 0x150], 0
mov dword [rsp + 0xf0], 0
mov rdx, qword [rsp + 0x600]
lea r8, [rsp + 0x150]
lea r9, [rsp + 0xf0]
mov rcx, rsi
call qword [sym.imp.ntdll.dll_LdrAccessResource]
test eax, eax
js 0x180001b95
mov ecx, 0xe111000c
cmp dword [rsp + 0xf0], 0x40
jb 0x180001b97
mov rax, qword [rsp + 0x150]
cmp word [rax], 0x40
jb 0x180001b97
cmp word [rax + 2], 0x18
jb 0x180001b97
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x180001b97
mov ecx, dword [rax + 0x30]
shl rcx, 0x20
mov rdx, rcx
shr rdx, 0x21
cmp edx, 0x28001
jae 0x180002571
lea rax, [0x1800034a0]
jmp 0x18000264c
lea rcx, [rsp + 0x98]
call section..text
test eax, eax
jns 0x180001b7f
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov rsi, qword [rsp + 0x98]
test rsi, rsi
jne 0x180001a12
jmp 0x1800019ff
mov ecx, eax
lea r8, [0x180000000]
mov dl, 1
call fcn.180001190
lea r14, [0x180000000]
lea rdx, [rsp + 0xc8]
mov rcx, r14
call qword [sym.imp.ntdll.dll_LdrFindEntryForAddress]
test eax, eax
jns 0x180001bd1
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov r15, qword [rsp + 0xc8]
movzx r12d, word [r15 + 0x48]
add r15, 0x48
add r12, 0x18
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
xor edx, edx
mov r8, r12
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r13, rax
test rax, rax
jne 0x180001c1d
lea r8, [0x180000000]
mov ecx, 0xc0000017
mov dl, 1
call fcn.180001190
mov qword [0x180005038], r13
lea r13, [0x180005030]
mov word [0x180005032], r12w
mov rcx, r13
mov rdx, r15
call qword [sym.imp.ntdll.dll_RtlCopyUnicodeString]
movups xmm0, xmmword [0x1800039f0]
movaps xmmword [rsp + 0xf0], xmm0
mov word [rsp + 0x6e], 0
lea r8, [rsp + 0xf0]
lea r9, [rsp + 0x6e]
mov ecx, 1
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlFindCharInUnicodeString]
test eax, eax
je 0x180001c87
lea r8, [0x180000000]
mov ecx, 0xc000003a
mov dl, 1
call fcn.180001190
movzx eax, word [rsp + 0x6e]
add eax, 2
mov word [0x180005030], ax
lea rcx, [0x180005030]
mov rdx, qword [0x180005038]
and eax, 0xfffe
mov word [rax + rdx + 2], 0
lea rdx, str.runtime.dll
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
test eax, eax
jns 0x180001cd1
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov rcx, qword [0x180005038]
lea r15, [0x180005040]
mov rdx, r15
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
test eax, eax
jns 0x180001d02
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov qword [rsp + 0xe8], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x1d0], xmm0
mov dword [rsp + 0x600], 0x30
mov qword [rsp + 0x608], 0
mov dword [rsp + 0x618], 0x40
mov qword [rsp + 0x610], r15
movups xmmword [rsp + 0x620], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 5
lea rcx, [rsp + 0xe8]
lea r8, [rsp + 0x600]
lea r9, [rsp + 0x1d0]
mov edx, 0x100021
call qword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jns 0x180001d92
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov qword [rsp + 0x60], 0
test rbp, rbp
je 0x180001ea3
mov r15, qword [rsp + 0xe8]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x120], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], 0x200
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x18000207e
movzx ecx, word [rsp + 0x200]
mov eax, 0xc000012f
cmp ecx, 0x5a4d
jne 0x18000207e
movsxd rdx, dword [rsp + 0x23c]
mov eax, 0xc000007b
cmp dword [rsp + rdx + 0x200], 0x4550
jne 0x18000207e
movzx ecx, word [rsp + rdx + 0x218]
cmp ecx, 0x20b
jne 0x18000207e
mov qword [rsp + 0x78], rbp
mov eax, dword [rsi + 0x3c]
mov eax, dword [rax + rsi + 0x50]
mov rcx, rsi
and rsi, 0xffffffffffe00000
mov qword [rsp + 0x70], rcx
lea rdi, [rcx + rax]
add rdi, 0x1fffff
and rdi, 0xffffffffffe00000
mov rbp, rsi
sub rbp, 0xffffffff80000000
mov eax, 0xc00004c2
sub rbp, rdi
jne 0x1800021e4
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
jmp 0x18000207e
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
lea rcx, [rsp + 0x200]
mov edx, 0xd
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtCreateSection]
test eax, eax
js 0x18000207e
mov eax, dword [rsi + 0x3c]
mov eax, dword [rax + rsi + 0x50]
mov r14, rsi
and r14, 0xffffffffffe00000
lea r12, [rsi + rax]
add r12, 0x1fffff
and r12, 0xffffffffffe00000
mov r13, r14
sub r13, 0xffffffff80000000
mov eax, 0xc00004c2
sub r13, r12
jne 0x180001f30
lea r14, [0x180000000]
jmp 0x18000207e
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbp
mov edi, 0x800000
xor ebp, ebp
xorps xmm6, xmm6
lea r15, [rsp + 0x60]
mov rsi, qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov qword [rsp + 0x150], 0
lea rax, [r14 + rbp]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x200]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x48], 0x80
mov dword [rsp + 0x38], 1
nop dword [rax + rax]
mov rdx, 0xffffffffffffffff
mov r8, r15
xor r9d, r9d
call rsi
cmp eax, 0xc00000f7
jne 0x180001fe0
mov rcx, qword [rsp + 0x200]
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x48], 0x80
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
xor edi, edi
jmp 0x180001f90
test eax, eax
jns 0x180002059
mov rax, r12
sub rax, rbp
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x200]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], rbx
movups xmmword [rsp + 0x20], xmm6
mov dword [rsp + 0x48], 0x80
mov dword [rsp + 0x38], 1
mov rdx, 0xffffffffffffffff
mov r8, r15
xor r9d, r9d
call rsi
test eax, eax
jns 0x180002059
mov qword [rsp + 0x60], 0
add rbp, 0x200000
cmp rbp, r13
jne 0x180001f50
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea r14, [0x180000000]
mov eax, 0xc00004c2
jmp 0x18000207e
mov rcx, qword [rsp + 0x60]
test rcx, rcx
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea r14, [0x180000000]
mov eax, 0xc00004c2
je 0x18000207e
call fcn.1800026e0
test eax, eax
jns 0x180002092
lea r8, [0x180000000]
mov ecx, eax
mov dl, 1
call fcn.180001190
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 0x3c]
mov ecx, dword [rax + rcx + 0x28]
add rcx, rax
movabs rdx, 0x90c062bbe98248dd
mov qword [section..data], rdx
movabs rdx, 0x7622d7acff1249ef
mov qword [0x180005008], rdx
mov qword [0x180005010], r14
mov qword [0x180005018], rax
mov qword [0x180005028], rcx
mov qword [0x180005020], rsi
mov rax, qword [0x180005088]
mov qword [0x180005050], rax
lea rax, [fcn.180001190]
mov qword [0x180005058], rax
lea rax, [0x180001170]
mov qword [0x180005060], rax
movaps xmm0, xmmword [0x180003050]
movaps xmmword [rsp + 0x160], xmm0
movaps xmm0, xmmword [str.PACKER_CRASH_AT]
movaps xmmword [rsp + 0x150], xmm0
xor esi, esi
lea rdi, [rsp + 0x200]
mov r8d, 0x400
mov rcx, rdi
xor edx, edx
call sub.ntdll.dll_memset
mov qword [rsp + 0x120], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x200
lea rdx, [rsp + 0x150]
mov r8d, 0xf
xor ecx, ecx
mov r9, rdi
call qword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
test eax, eax
js 0x180002198
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0xa
call sub.ntdll.dll_wcstoul
mov esi, eax
test rbp, rbp
mov dword [0x180005068], esi
lea r9, [section..data]
setne byte [0x18000506c]
xor ecx, ecx
mov edx, 0x25665cd7
xor r8d, r8d
call qword [0x180005028]
mov word [0x180005080], 2
movaps xmm6, xmmword [rsp + 0xa00]
add rsp, 0xa18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x148], r15
mov qword [rsp + 0xe0], rdx
mov r14d, dword [rsp + rdx + 0x250]
add r14, 0xfff
and r14, 0xfffffffffffff000
lea r12, [rsp + 0x60]
lea r15, [rsp + 0x80]
mov r13, qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x2000
mov rcx, 0xffffffffffffffff
mov rdx, r12
xor r8d, r8d
mov r9, r15
call r13
test eax, eax
jns 0x1800022af
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x2000
mov rcx, 0xffffffffffffffff
mov rdx, r12
xor r8d, r8d
mov r9, r15
call r13
test eax, eax
jns 0x1800022af
mov qword [rsp + 0x60], 0
add rdi, 0xffffffffffe00000
add rsi, 0x200000
add rbp, 0xffffffffffe00000
jne 0x18000221e
jmp 0x180002041
mov rdx, qword [rsp + 0x60]
test rdx, rdx
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea r14, [0x180000000]
lea rdi, [rsp + 0x120]
mov eax, 0xc00004c2
mov r12, qword [rsp + 0xe0]
mov r15, qword [rsp + 0x148]
je 0x18000207e
mov ecx, dword [rsp + r12 + 0x254]
add rcx, 0xfff
movabs rax, 0x1fffff000
and rcx, rax
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0xb0], rdx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea rdx, [rsp + 0xb0]
lea r9, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x18000207e
mov qword [rsp + 0x120], 0
mov eax, dword [rsp + r12 + 0x254]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x18000207e
mov dword [rsp + 0xac], 0
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x80]
mov rcx, 0xffffffffffffffff
mov r9d, 2
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x18000207e
movzx eax, word [rsp + r12 + 0x206]
test rax, rax
movabs rdi, 0x1fffff000
je 0x180002551
mov ecx, dword [rsp + 0x23c]
movzx edx, word [rsp + r12 + 0x214]
mov r8, qword [rsp + 0xb0]
add rdx, rcx
lea r14, [r8 + rdx]
add r14, 0x20
shl rax, 3
lea rax, [rax + rax*4]
mov qword [rsp + 0xe0], rax
xor r12d, r12d
lea rsi, [rsp + 0xa0]
mov rbp, qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov eax, dword [r14 + r12 + 4]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0xd0], rax
mov eax, dword [r14 + r12]
add rax, 0xfff
and rax, rdi
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xd0]
xor r8d, r8d
mov r9, rsi
call r13
test eax, eax
js 0x18000255b
cmp dword [r14 + r12 + 8], 0
je 0x1800024ff
mov eax, dword [r14 + r12 + 0xc]
mov qword [rsp + 0x120], rax
mov eax, dword [r14 + r12]
mov ecx, dword [r14 + r12 + 8]
cmp eax, ecx
cmovb ecx, eax
mov rax, qword [rsp + 0xd0]
lea rdx, [rsp + 0x120]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 0
mov rcx, r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
test eax, eax
js 0x18000255b
mov eax, dword [r14 + r12 + 0x1c]
shr rax, 0x1b
and eax, 0x1c
xor rax, 0x10
lea rcx, [0x180003114]
mov r9d, dword [rax + rcx]
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xd0]
mov r8, rsi
call rbp
test eax, eax
js 0x18000255b
add r12, 0x28
cmp qword [rsp + 0xe0], r12
jne 0x180002444
mov rcx, qword [rsp + 0x60]
call fcn.1800026e0
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea r14, [0x180000000]
jmp 0x18000207e
mov eax, dword [rax + 0x34]
or rcx, rax
mov rax, rcx
shr rax, 0x31
cmp eax, 3
jae 0x18000258f
lea rax, [0x1800034b8]
jmp 0x18000264c
mov rdx, rcx
shr rdx, 0x20
cmp edx, 0x60001
jae 0x1800025aa
lea rax, [0x1800034d0]
jmp 0x18000264c
movabs r8, 0x6000100000000
add r8, 0x1db15fe1
xor eax, eax
cmp rcx, r8
lea r8, [0x1800034e8]
cmovb rax, r8
mov r8, rcx
shr r8, 0x21
cmp r8d, 0x30001
jae 0x1800025e5
test rax, rax
jne 0x18000264c
jmp 0x180001ba5
cmp edx, 0x60003
jae 0x1800025f6
lea rax, [0x180003500]
jmp 0x18000264c
movabs rdx, 0x6000300000000
add rdx, 0x258050ee
cmp rcx, rdx
lea rdx, [0x180003518]
cmovb rax, rdx
mov rdx, rcx
shr rdx, 0x22
cmp edx, 0x18001
jb 0x1800025db
movabs rdx, 0xa000028000000
sub rcx, rdx
lea rdx, [0x180003530]
cmovb rax, rdx
cmp rcx, 0x10390000
jae 0x1800025db
lea rax, [0x180003548]
mov ecx, dword [rax + 0x10]
test ecx, ecx
jns 0x180001ba5
jmp 0x180001b97