Function at 0x1400088c0
Capabilities:
Access peb ldr_data
Check os version
Create process on windows
Create process suspended
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x188
lea rdx, [0x140050476]
lea rcx, [rsp + 0x120]
mov r8d, 0x1c
call fcn.14003fba0
movabs rbp, 0x8000000000000000
cmp qword [rsp + 0x120], rbp
jne 0x140008e58
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0xf0], rax
movzx eax, byte [0x140064141]
mov ecx, 9
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x140008ea4
mov r15, rax
movabs rax, 0x6c642e6c6c64746e
mov qword [r15], rax
mov byte [r15 + 8], 0x6c
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
cmp qword [rsi + 0x30], 0
je 0x140008dba
lea rdi, [rsp + 0x80]
lea rbx, [rsp + 0x120]
lea r14, [rsp + 0x108]
jmp 0x14000899b
cmp qword [rsi + 0x30], 0
je 0x140008dba
mov rdx, qword [rsi + 0x60]
movzx r8d, word [rsi + 0x58]
shr r8d, 1
mov rcx, rdi
call fcn.140040b60
cmp qword [rsp + 0x80], rbp
je 0x140008df6
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x130], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x120], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.140040e00
mov r12, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov rcx, r14
mov rdx, r12
call fcn.140040070
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140008a1e
mov r8d, 1
mov rcx, r12
call fcn.140009c10
mov rdx, qword [rsp + 0x120]
test rdx, rdx
je 0x140008a3e
mov rcx, qword [rsp + 0x128]
mov r8d, 1
call fcn.140009c10
mov r8d, 9
mov rcx, rdi
mov rdx, r15
call fcn.140040070
mov r13, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov r12, qword [rsp + 0x110]
cmp r8, qword [rsp + 0x118]
jne 0x140008a80
mov rcx, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140008ac2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140008a9b
mov r8d, 1
mov rcx, r13
call fcn.140009c10
mov rsi, qword [rsi]
mov rdx, qword [rsp + 0x108]
test rdx, rdx
je 0x140008990
mov r8d, 1
mov rcx, r12
call fcn.140009c10
jmp 0x140008990
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140008add
mov r8d, 1
mov rcx, r13
call fcn.140009c10
mov rsi, qword [rsi + 0x30]
mov rdx, qword [rsp + 0x108]
test rdx, rdx
je 0x140008afc
mov r8d, 1
mov rcx, r12
call fcn.140009c10
mov edx, 9
mov r8d, 1
mov rcx, r15
call fcn.140009c10
lea rcx, [rsp + 0x80]
call fcn.14001b480
mov dword [rsp + 0x120], 0x68
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rsp + 0x128], xmm0
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x138], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [rsp + 0x150], xmm0
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x160], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x168], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rsp + 0x170], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x180], rax
mov rcx, r14
call fcn.14001b460
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, qword [rsp + 0xf0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessA]
test eax, eax
je 0x140008eb3
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140008f2b
movsxd rbp, dword [rsi + 0x3c]
cmp dword [rbp + rsi], 0x4550
jne 0x140008f71
add rbp, rsi
mov ebx, dword [rbp + 0x50]
call qword [sym.imp.kernel32.dll_GetProcessHeap]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffe
jae 0x140008fb7
mov rcx, rax
mov edx, 8
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r8, rax
mov qword [rsp + 0x100], 0
mov rcx, qword [rsp + 0x108]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov qword [rsp + 0xf0], r8
mov r9, rbx
call qword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x140008ff7
movzx eax, word [rbp + 6]
test rax, rax
je 0x140008d4b
mov qword [rsp + 0xf8], rsi
add rbp, 0x108
add rbp, 0xc
shl eax, 3
lea rsi, [rax + rax*4]
xor edi, edi
lea r12, [rsp + 0x80]
lea r13, [rsp + 0x70]
xor r14d, r14d
xor r15d, r15d
xor ebx, ebx
jmp 0x140008ccd
add rdi, 0x28
cmp rsi, rdi
je 0x140008d53
mov rax, qword [rbp + rdi - 0xc]
mov qword [rsp + 0x70], rax
mov r8d, 8
mov rcx, r12
mov rdx, r13
call fcn.140043070
cmp qword [rsp + 0x80], 0
jne 0x140008e1f
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
xor r8d, r8d
call fcn.1400091f0
cmp rdx, 5
jne 0x140008cc0
mov ecx, dword [rax]
mov edx, 0x7865742e
xor ecx, edx
movzx eax, byte [rax + 4]
xor eax, 0x74
or eax, ecx
jne 0x140008cc0
mov ebx, dword [rbp + rdi - 4]
mov r15d, dword [rbp + rdi]
mov rax, qword [rsp + 0xf8]
lea r14, [r15 + rax]
add r15, qword [rsp + 0xf0]
jmp 0x140008cc0
xor ebx, ebx
xor r15d, r15d
xor r14d, r14d
mov dword [rsp + 0x6c], 0
lea r9, [rsp + 0x6c]
mov rcx, r14
mov rdx, rbx
mov r8d, 0x80
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x14000906f
mov rcx, r14
mov rdx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x6c]
lea r9, [rsp + 0x6c]
mov rcx, r14
mov rdx, rbx
call qword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1400090e7
add rsp, 0x188
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 9
mov r8d, 1
mov rcx, r15
call fcn.140009c10
lea rax, [0x1400504d8]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_retrieving_ntdll
lea r9, [0x1400502f0]
lea r8, [rsp + 0x50]
mov edx, 0x1a
call fcn.14004c2e0
lea rax, [0x1400506f8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140050330]
lea r9, [0x140050360]
lea r8, [rsp + 0x50]
mov edx, 0x2b
call fcn.14004c2e0
lea rax, [rsp + 0x88]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rax, [0x1400505b0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140050330]
lea r9, [0x140050310]
lea r8, [rsp + 0x50]
mov edx, 0x2b
call fcn.14004c2e0
movups xmm0, xmmword [rsp + 0x120]
movups xmm1, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
lea rax, [0x1400504a0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140050330]
lea r9, [0x1400503a0]
lea r8, [rsp + 0x80]
mov edx, 0x2b
call fcn.14004c2e0
mov ecx, 1
mov edx, 9
call fcn.14004be60
call fcn.14001b6f0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x14001bd50]
mov qword [rsp + 0x58], rax
lea rax, str.____CreateProcessA_Failed_With_Error:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rdx, [0x1400506e0]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
lea rax, str.____INVALID_DOS_SIGNATURE
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, [0x140050690]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
lea rax, str.____INVALID_NT_SIGNATURE
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x98], xmm0
lea rdx, [0x140050648]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
call fcn.14001b6f0
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x88], edx
lea rax, [0x1400504f0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140050330]
lea r9, [0x140050380]
lea r8, [rsp + 0x80]
mov edx, 0x2b
call fcn.14004c2e0
call fcn.14001b6f0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x14001bd50]
mov qword [rsp + 0x58], rax
lea rax, str.____ReadProcessMemory_Failed_With_Error:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rdx, [0x140050608]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
call fcn.14001b6f0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x14001bd50]
mov qword [rsp + 0x58], rax
lea rax, str.____VirtualProtect_Failed_With_Error:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rdx, [0x140050598]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
call fcn.14001b6f0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], edx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rax, [0x14001bd50]
mov qword [rsp + 0x58], rax
lea rax, str.____VirtualProtect__2__Failed_With_Error:
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 1
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], 1
lea rdx, [0x140050548]
lea rcx, [rsp + 0x80]
call fcn.14004bf90
int3