Function at 0x140004190
Capabilities:
Access pe header
Allocate or change rwx memory
Delete file
Enumerate pe sections
Execute shellcode via indirect call
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x5f8
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x610]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
test rax, rax
je 0x1400041e7
mov dword [rsp + 0x98], 1
jmp 0x1400041f2
mov dword [rsp + 0x98], 0
movzx eax, byte [rsp + 0x98]
mov byte [rsp + 0x78], al
mov r8d, 0x35347936
mov edx, 0x58
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x68], rax
mov r8d, 0x58
xor edx, edx
mov rcx, qword [rsp + 0x68]
call fcn.1400135c0
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov rdx, qword [rsp + 0x618]
mov rcx, rax
call fcn.1400085e0
mov rax, qword [rsp + 0x68]
add rax, 0x20
mov rcx, qword [rsp + 0x68]
add rcx, 0x30
mov rdx, rax
call fcn.140008a20
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x638]
mov dword [rax + 0x4c], ecx
movzx eax, byte [rsp + 0x78]
test eax, eax
je 0x140004283
mov dword [rsp + 0x9c], 0
jmp 0x14000428e
mov dword [rsp + 0x9c], 1
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x9c]
mov dword [rax + 0x48], ecx
mov rax, qword [rsp + 0x68]
add rax, 0x20
mov rcx, qword [rsp + 0x640]
add rcx, 0x20
mov rdx, qword [rsp + 0x68]
mov r8d, dword [rdx + 0x48]
mov rdx, rax
call fcn.1400060f0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004316
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov edx, 0x35347936
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdi, qword [rsp + 0x648]
mov rsi, qword [rsp + 0xe0]
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
xor eax, eax
jmp 0x140004e79
cmp qword [rsp + 0x620], 0
jne 0x140004348
mov rax, qword [rsp + 0x68]
add rax, 0x18
mov rdx, rax
mov rcx, qword [rsp + 0x618]
call fcn.140005ea0
mov dword [rsp + 0x60], eax
mov byte [rsp + 0x630], 0
jmp 0x140004359
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x620]
mov qword [rax + 0x18], rcx
cmp dword [rsp + 0x60], 0
jl 0x140004384
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
jne 0x140004384
mov dword [rsp + 0x60], 0xc000007b
mov eax, dword [rsp + 0x638]
and eax, 0x8000
test eax, eax
jne 0x14000465d
cmp dword [rsp + 0x60], 0
jl 0x14000465d
mov dword [rsp + 0x80], 0
mov qword [rsp + 0xe8], 0
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xe8]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
call fcn.140005ae0
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x14000465d
cmp dword [rsp + 0x80], 0
je 0x14000465d
cmp qword [rsp + 0x620], 0
je 0x14000463e
lea rax, [rsp + 0x168]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x108]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0xc8], 0
lea rax, [rsp + 0x188]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rsp + 0x178]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dx, 0x200
lea rcx, [rsp + 0x108]
call fcn.140008540
lea rdx, [0x140013c50]
lea rcx, [rsp + 0x168]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov dword [rsp + 0x188], 0x30
mov qword [rsp + 0x190], 0
mov dword [rsp + 0x1a0], 0x200
lea rax, [rsp + 0x168]
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a8], 0
mov qword [rsp + 0x1b0], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x20
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x188]
mov edx, 0x110002
lea rcx, [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jl 0x1400045a7
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x178]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov dword [rsp + 0x7c], eax
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [rsp + 0x7c], 0
jl 0x140004620
movabs rax, 0xfffff78000000000
mov ecx, 0x30
add rcx, rax
mov rax, rcx
lea rcx, [0x140013ca0]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x140013cd0]
mov edx, 0x400
lea rcx, [rsp + 0x1f0]
call fcn.14000b4d0
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov r9, qword [rsp + 0x640]
mov r8d, dword [rsp + 0x80]
xor edx, edx
lea rcx, [rsp + 0x108]
call fcn.140006920
lea rcx, [rsp + 0x188]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
lea rcx, [rsp + 0x108]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x14000465d
mov r9, qword [rsp + 0x640]
mov r8d, dword [rsp + 0x80]
mov dl, 1
mov rcx, qword [rsp + 0x618]
call fcn.140006920
cmp dword [rsp + 0x60], 0
jl 0x1400048b4
mov eax, dword [rsp + 0x638]
and eax, 0x10
test eax, eax
je 0x140004760
lea rax, [rsp + 0x148]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rsp + 0x138]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x610]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov dword [rsp + 0x158], eax
mov byte [rsp + 0x164], 1
mov byte [rsp + 0x165], 1
mov dword [rsp + 0x15c], 0x40
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400046f3
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa0], eax
jmp 0x140004702
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa0], eax
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x150], rax
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0x610]
call fcn.140003320
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x14000475b
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x138]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x140]
mov qword [rax + 0x40], rcx
jmp 0x1400048b4
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140004783
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xf8], rax
jmp 0x140004793
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x34]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xf8]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400047c5
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa4], eax
jmp 0x1400047d4
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa4], eax
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x68]
add rax, 0x40
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
mov r9, rax
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jge 0x1400048b4
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x10], 0
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140004859
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa8], eax
jmp 0x140004868
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0xa8], eax
mov eax, dword [rsp + 0xa8]
mov rcx, qword [rsp + 0x68]
mov qword [rcx + 0x40], rax
mov rax, qword [rsp + 0x68]
add rax, 0x40
mov rcx, qword [rsp + 0x68]
add rcx, 0x10
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
mov r9, rax
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x140004a0b
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400048e0
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xac], eax
jmp 0x1400048ef
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xac], eax
mov eax, dword [rsp + 0xac]
mov r8d, eax
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x18]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x10]
call fcn.1400136c0
mov rax, qword [rsp + 0x70]
add rax, 0x108
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140004946
mov rax, qword [rsp + 0x70]
add rax, 0xf8
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x88], rax
jmp 0x14000496c
mov rax, qword [rsp + 0x88]
add rax, 0x28
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xd0]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x140004a0b
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x24]
and eax, 0xe0000000
test eax, eax
je 0x1400049b3
mov rax, qword [rsp + 0x88]
cmp dword [rax + 0x10], 0
jne 0x1400049b5
jmp 0x140004958
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x88]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x68]
add rcx, qword [rdx + 0x18]
mov rdx, qword [rsp + 0x88]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x68]
add rdx, qword [rdi + 0x10]
mov qword [rsp + 0x118], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x118]
mov rcx, rax
call fcn.1400136c0
jmp 0x140004958
cmp dword [rsp + 0x60], 0
jl 0x140004a32
mov r9d, 0xc000007b
mov r8d, 0xc0000018
xor edx, edx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x10]
call fcn.14000a710
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x640]
add rcx, 0x20
mov rdx, rax
call fcn.14000a2b0
cmp dword [rsp + 0x60], 0
jl 0x140004ab7
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140004a6f
mov dword [rsp + 0xb0], 1
jmp 0x140004a7a
mov dword [rsp + 0xb0], 0
mov eax, dword [rsp + 0x638]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x20], rax
movzx r9d, byte [rsp + 0xb0]
mov r8, qword [rsp + 0x610]
xor edx, edx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x10]
call fcn.140007780
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jl 0x140004cda
mov eax, dword [rsp + 0x638]
and eax, 0x10
test eax, eax
je 0x140004af2
xor r8d, r8d
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0x610]
call fcn.140006db0
mov dword [rsp + 0x60], eax
jmp 0x140004cda
mov qword [rsp + 0xc0], 0
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140004b1f
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xb4], eax
jmp 0x140004b2e
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x54]
mov dword [rsp + 0xb4], eax
mov eax, dword [rsp + 0xb4]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov rcx, qword [0x140015920]
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, [rsp + 0xc0]
mov rdx, rax
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x120]
call qword [0x140014260]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x70]
add rax, 0x108
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140004bbe
mov rax, qword [rsp + 0x70]
add rax, 0xf8
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x90], rax
jmp 0x140004be4
mov rax, qword [rsp + 0x90]
add rax, 0x28
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0xd8]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x90], rax
jae 0x140004cda
xor edx, edx
mov rax, qword [rsp + 0x90]
mov ecx, dword [rax + 0x24]
call fcn.140003a20
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x68]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
mov qword [rsp + 0xc0], rax
cmp dword [rsp + 0xb8], 1
je 0x140004cb2
mov rax, qword [0x140015920]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0xb8]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x100]
mov rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x128]
call qword [0x140014260]
mov ecx, dword [rsp + 0x60]
or ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
jmp 0x140004cd5
mov r9d, 0x4000
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x100]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
jmp 0x140004bd0
cmp dword [rsp + 0x60], 0
jl 0x140004cef
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x10]
call fcn.140003c10
mov eax, dword [rsp + 0x638]
and eax, 0x1000
test eax, eax
jne 0x140004d25
cmp dword [rsp + 0x60], 0
jl 0x140004d25
movzx eax, byte [rsp + 0x78]
test eax, eax
jne 0x140004d25
mov rax, qword [rsp + 0x68]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rsp + 0x640]
call fcn.140003d70
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x18], 0
je 0x140004d52
mov edx, 0x35347936
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x68]
mov qword [rax + 0x18], 0
cmp dword [rsp + 0x60], 0
jl 0x140004d7d
cmp qword [rsp + 0x648], 0
je 0x140004d78
mov rdi, qword [rsp + 0x648]
mov rsi, qword [rsp + 0x68]
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
jmp 0x140004e75
cmp qword [rsp + 0x68], 0
je 0x140004e75
mov rax, qword [rsp + 0x68]
mov rcx, rax
call fcn.14000aaf0
mov rax, qword [rsp + 0x68]
cmp qword [rax + 0x10], 0
je 0x140004e53
mov eax, dword [rsp + 0x638]
and eax, 0x10
test eax, eax
je 0x140004e20
lea rax, [rsp + 0x1b8]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rsp + 0x1d8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x610]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov dword [rsp + 0x1c8], eax
mov byte [rsp + 0x1d4], 0
mov byte [rsp + 0x1d5], 1
lea r8, [rsp + 0x1d8]
lea rdx, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x610]
call fcn.140003320
jmp 0x140004e53
mov qword [rsp + 0x130], 0
mov rax, qword [rsp + 0x68]
add rax, 0x10
mov r9d, 0x8000
lea r8, [rsp + 0x130]
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
mov rax, qword [rsp + 0x68]
add rax, 0x30
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov edx, 0x35347936
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [rsp + 0x60]
add rsp, 0x5f8
pop rdi
pop rsi
ret