Function at 0x140048e40
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r13d, r13d
mov byte [rbp - 0x40], 0
xor eax, eax
mov qword [rbp - 0x20], r13
lea rdi, [rbp + 0x30]
mov dword [rbp - 0x3c], r13d
mov ecx, 0x104
mov dword [rbp], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp + 4], 0xd18b4c00
mov word [rbp + 8], 0x50f
mov byte [rbp + 0xa], 0xc3
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
cmp word [rbp + 0x30], r13w
je 0x140048eda
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x140048ed0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140048ef0
mov word [rax], r13w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048f1a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140048f10
lea rdx, [0x140067660]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140048f30
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048f5e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140048f52
add cx, cx
mov dword [rbp - 0x78], 0x30
mov word [rbp - 0x30], cx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
add cx, 2
mov word [rbp - 0x2e], cx
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
mov r14, r13
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048fe8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048fda
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140048fe4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048fc0
jmp 0x140048fe8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x140049092
cmp word [r9], r15w
jne 0x140049092
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049092
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049092
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049092
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140049086
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004907c
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x140049077
cmp byte [rcx], r13b
je 0x14004907c
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049060
jmp 0x14004907c
cmp byte [rcx], r13b
je 0x1400490d5
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400490d5
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049046
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400490ea
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400490cb
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400490e6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400490b1
jmp 0x1400490ea
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140049095
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x140049188
cmp word [r9], r15w
jne 0x140049188
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049188
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049188
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049188
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004917c
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049172
sub rcx, rsi
test al, al
je 0x14004916d
cmp byte [rdx], r13b
je 0x140049172
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049156
jmp 0x140049172
cmp byte [rdx], r13b
je 0x1400491cb
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400491cb
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049142
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400491e0
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400491c1
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400491dc
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400491a7
jmp 0x1400491e0
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x14004918b
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x140049313
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049313
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049313
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049313
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049313
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004928b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049281
sub rax, rsi
test dl, dl
je 0x14004927c
cmp byte [rcx], r13b
je 0x140049281
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049265
jmp 0x140049281
cmp byte [rcx], r13b
je 0x140049299
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049299
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049250
jmp 0x140049313
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140049313
test r15, r15
je 0x140049313
test r12, r12
je 0x140049313
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x140049313
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x140049313
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140049313
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049358
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004934a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140049354
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049330
jmp 0x140049358
lea r14, [rdi - 0x10]
mov rsi, qword [rbp - 0x80]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x1400494fe
test r14, r14
je 0x1400494fe
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x14004941f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004941f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14004941f
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x14004941f
lea rbx, str.NtSetInformationThread
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x140049413
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049405
sub rax, rbx
test dl, dl
je 0x1400493fc
cmp byte [rcx], r13b
je 0x140049405
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400493e5
jmp 0x140049405
cmp byte [rcx], r13b
je 0x14004949b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004949b
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400493d0
mov r9, r13
cmp word [r14], r12w
jne 0x1400494ca
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400494ca
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400494ca
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x1400494ca
nop
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x1400494be
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400494b4
sub rcx, r15
test al, al
je 0x1400494af
cmp byte [rdx], r13b
je 0x1400494b4
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049484
jmp 0x1400494b4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x140049422
cmp byte [rdx], r13b
je 0x1400494e0
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400494e0
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049470
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x1400494f0
call rax
jmp 0x140049504
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x1400494cd
movzx r13d, word [r9 + 4]
mov dword [rsp + 0x64], r13d
call rax
jmp 0x140049509
mov r12d, 0x5a4d
mov dword [rsp + 0x64], r13d
xor r15d, r15d
mov word [rbp - 0x48], r13w
xor eax, eax
mov qword [rbp - 0x38], r15
lea rdi, [rbp + 0x30]
mov qword [rbp - 0x80], r15
mov ecx, 0x104
mov qword [rbp - 0x30], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp - 0x74], r15d
mov dword [rbp - 0x5c], r15d
cmp word [rbp + 0x30], r15w
je 0x14004954a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140049540
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140049560
mov word [rax], r15w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x14004958a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140049580
lea rcx, [0x140067660]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x1400495a0
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x1400495ce
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x1400495c2
add cx, cx
mov dword [rbp - 0x78], 0x30
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x78], rax
mov r14, r15
mov dword [rbp - 0x60], 0x40
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov word [rsp + 0x70], cx
add cx, 2
mov word [rsp + 0x72], cx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049658
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004964a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140049654
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049630
jmp 0x140049658
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400496f7
cmp word [r9], r12w
jne 0x1400496f7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400496f7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400496f7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400496f7
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400496eb
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400496e1
sub rax, rsi
test dl, dl
je 0x1400496dc
cmp byte [rcx], r15b
je 0x1400496e1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400496c5
jmp 0x1400496e1
cmp byte [rcx], r15b
je 0x14004973a
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004973a
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400496b0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004974f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049730
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x14004974b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049716
jmp 0x14004974f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400496fa
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004980b
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004980b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004980b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004980b
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004980b
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400497ee
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400497e4
sub rcx, rsi
test al, al
je 0x1400497df
cmp byte [rdx], r15b
je 0x1400497e4
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400497c8
jmp 0x1400497e4
cmp byte [rdx], r15b
je 0x1400497fc
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400497fc
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400497b4
jmp 0x14004980b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049858
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004984a
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140049854
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049830
jmp 0x140049858
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140049982
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049982
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049982
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049982
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x140049982
lea r14, str.NtClose
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x1400498fe
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400498f4
sub rax, r14
test dl, dl
je 0x1400498ef
cmp byte [rcx], sil
je 0x1400498f4
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400498d8
jmp 0x1400498f4
cmp byte [rcx], sil
je 0x14004990c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004990c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400498c3
jmp 0x140049982
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140049982
test r15, r15
je 0x140049982
test r12, r12
je 0x140049982
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rbp - 0x80]
call r12
test eax, eax
js 0x140049982
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x38]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x140049982
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140049982
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400499c9
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400499bb
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x1400499c5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400499a1
jmp 0x1400499c9
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x38]
mov r11, qword [r14 + 0x30]
test r9, r9
je 0x140049b76
test r11, r11
je 0x140049b76
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x140049a8f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049a8f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049a8f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x140049a8f
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140049a83
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049a75
sub rax, r14
test dl, dl
je 0x140049a6c
cmp byte [rcx], r15b
je 0x140049a75
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049a55
jmp 0x140049a75
cmp byte [rcx], r15b
je 0x140049b17
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049b17
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049a40
mov rsi, r15
cmp word [r11], r12w
jne 0x140049b44
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140049b44
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x140049b44
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rbx, r11
mov r10d, dword [rax + 0x14]
add r14, r11
test r10d, r10d
je 0x140049b44
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r11
je 0x140049b38
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049b2e
sub rcx, r12
nop dword [rax]
test al, al
je 0x140049b29
cmp byte [rdx], r15b
je 0x140049b2e
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049b00
jmp 0x140049b2e
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, r9
jmp 0x140049a92
cmp byte [rdx], r15b
je 0x140049b5e
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140049b5e
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049ae5
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rsi, rsi
jne 0x140049b6e
call rax
movzx esi, r15w
jmp 0x140049b79
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140049b47
movzx esi, word [rsi + 4]
call rax
jmp 0x140049b79
mov esi, r15d
mov word [rbp - 0x44], si
mov r12d, 0xb
test r13w, r13w
je 0x140049b8e
test si, si
jne 0x140049bed
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140049bd4
cmp al, 6
jne 0x140049bc8
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140049bc8
sub ecx, 1
je 0x140049bbd
cmp ecx, 1
jne 0x140049bd4
lea r13d, [rcx + 0xb]
lea esi, [rcx + 0x23]
jmp 0x140049bdf
movzx r13d, r12w
mov esi, 0x23
jmp 0x140049bdf
mov r13d, 0xa
lea esi, [r13 + 0x18]
jmp 0x140049bdf
mov r13d, 0xd
mov esi, 0x25
mov word [rbp - 0x44], si
mov word [rbp - 0x48], r13w
mov dword [rsp + 0x64], r13d
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140049c2e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049c20
lea rcx, [0x140067660]
call fcn.140047640
test rax, rax
jne 0x140049c2a
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140049c06
jmp 0x140049c2e
lea r15, [rdi - 0x10]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x140049cf2
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140049cf2
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140049cf2
mov r14d, dword [rax + rbx + 0x88]
add r14, rbx
je 0x140049cf2
mov edi, dword [r14 + 0x24]
mov r15d, dword [r14 + 0x1c]
add rdi, rbx
add r15, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [r14 + 0x14]
mov r9d, eax
mov eax, 0x88888889
mul r9d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r9d, ecx
mov ecx, eax
test r10d, r10d
je 0x140049cf2
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rbx + r8], 0x4c
lea rax, [rbx + r8]
jne 0x140049ce7
cmp byte [rax + 1], 0x8b
jne 0x140049ce7
cmp byte [rax + 2], 0xd1
jne 0x140049ce7
cmp byte [rax + 3], 0xb8
jne 0x140049ce7
cmp byte [rax + 0x12], 0xf
jne 0x140049ce7
cmp byte [rax + 0x13], 5
jne 0x140049ce7
inc edx
cmp edx, r9d
je 0x140049d24
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x140049cb0
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14005c420
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, r8
add rdi, rbx
je 0x140049cf2
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 1]
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x140049d60
lea rcx, [rbp + 1]
lea rax, [rbp - 0x46]
nop dword [rax]
movzx ecx, byte [rbp - 0x47]
lea rax, [rbp + 0x10]
mov byte [rbp + 2], cl
mov byte [rbp + 1], r13b
cmp rax, rdi
jbe 0x140049e30
lea rax, [rdi + 0x14]
lea rdx, [rbp + 0x10]
cmp rdx, rax
jae 0x140049e30
movzx edx, byte [rax - 4]
movzx r14d, byte [rax - 1]
movzx r15d, byte [rax - 2]
movzx r13d, byte [rax - 3]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x57], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x56], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x55], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x54], dl
movzx edx, byte [rax - 0x11]
mov byte [rsp + 0x53], dl
movzx edx, byte [rax - 0x12]
mov byte [rsp + 0x52], dl
movzx edx, byte [rax - 0x13]
mov byte [rsp + 0x51], dl
movzx edx, byte [rax - 0x14]
mov byte [rsp + 0x50], dl
jmp 0x140049ec6
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x11]
movzx r15d, byte [rdi + 0x12]
movzx r14d, byte [rdi + 0x13]
mov byte [rsp + 0x50], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x51], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x52], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x53], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x57], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x60], al
lea rax, [rbp]
cmp rdi, rax
jbe 0x140049ee0
lea rax, [rbp + 0xb]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x64]
lea r8, [rbp - 0x20]
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
mov dword [rdi + 3], 0x8b4c0000
mov edx, 0x11
mov byte [rdi + 2], cl
mov rcx, 0xfffffffffffffffe
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
call rdi
test eax, eax
jns 0x14004a1ae
lea r11, [rbp]
mov r9, r12
sub r11, rdi
mov rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140049f66
inc rdi
sub r9, 1
jne 0x140049f30
jmp 0x140049f6f
cmp r8d, r10d
jne 0x14004a1ae
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x140049cf2
lea rcx, [rbp + 1]
lea rax, [rbp - 0x44]
cmp rcx, rax
jbe 0x140049fa0
lea rcx, [rbp + 1]
lea rax, [rbp - 0x42]
nop dword [rax]
movzx eax, byte [rbp - 0x43]
lea rcx, [rbp]
mov byte [rbp + 2], al
mov byte [rbp + 1], sil
cmp rbx, rcx
jbe 0x140049fc0
lea rcx, [rbp + 0xb]
nop dword [rax + rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rbp - 0x40]
mov dword [rbx + 3], 0x8b4c0000
mov byte [rbx + 2], al
xor eax, eax
mov byte [rbx + 1], sil
mov byte [rbx], 0xb8
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rbx
lea r10, [rbp]
mov esi, eax
sub r10, rbx
mov rdi, rbx
nop dword [rax]
movzx r9d, byte [rbx + r10]
movzx r8d, byte [rbx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r9d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x14004a036
inc rbx
sub r12, 1
jne 0x14004a000
jmp 0x14004a03f
cmp r8d, r9d
jne 0x14004a1ae
lea rax, [rbp + 0x10]
cmp rdi, rax
jbe 0x14004a0f1
lea rax, [rbp + 0x24]
cmp rdi, rax
jae 0x14004a0f1
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
mov byte [rdi + 0x13], r14b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x11], r13b
jmp 0x14004a184
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], r13b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x13], r14b
mov r8d, dword [rbp - 0x3c]
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x140049cf2
cmp byte [rbp - 0x40], 0
sete al
jmp 0x140049cf4
mov al, 1
jmp 0x140049cf4