Function at 0x14002e680
Capabilities:
Create thread
Get system information on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140044088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, 0x5a4d
mov qword [rsp + 0x40], r8
xorps xmm0, xmm0
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x38], rdx
movups xmmword [rsp + 0x48], xmm0
cmp word [rcx], ax
jne 0x14002ebd5
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x14002ebd5
cmp dword [rsi], 0x4550
jne 0x14002ebd5
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x14002ebd5
mov r9d, dword [rsi + 0x38]
test r9b, 1
jne 0x14002ebd5
movzx ecx, word [rsi + 0x14]
xor edx, edx
movzx eax, word [rsi + 6]
add rcx, 0x24
movzx r14d, word [rsi + 0x16]
mov ebx, edx
mov dword [rsp + 0x30], r14d
cmp dx, ax
jae 0x14002e752
add rcx, rsi
mov r8d, eax
nop word [rax + rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x14002e73f
lea eax, [rdx + r9]
jmp 0x14002e741
add eax, edx
cmp eax, ebx
cmovbe eax, ebx
add rcx, 0x28
mov ebx, eax
sub r8, 1
jne 0x14002e730
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x64]
mov eax, edx
neg eax
lea ebp, [rdx - 1]
add ebp, dword [rsi + 0x50]
lea rcx, [rdx - 1]
and rbp, rax
mov eax, ebx
add rcx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
cmp rbp, rcx
jne 0x14002ebd5
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14002e7c5
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
movsxd rax, dword [r13 + 0x3c]
mov dword [rdi + 0x3c], eax
mov r8d, dword [rsi + 0x54]
sub r8d, dword [r13 + 0x3c]
lea rdx, [rax + r13]
lea rcx, [rdi + rax]
call fcn.140030090
movsxd r15, dword [rdi + 0x3c]
xor ebp, ebp
add r15, rdi
mov esi, ebp
movzx ebx, word [r15 + 0x14]
add rbx, 0x2c
cmp bp, word [r15 + 6]
jae 0x14002e823
add rbx, r15
nop
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, r13
mov r8d, dword [rbx - 4]
add rcx, rdi
call fcn.140030090
movzx eax, word [r15 + 6]
lea rbx, [rbx + 0x28]
inc esi
cmp esi, eax
jb 0x14002e800
mov r10, rdi
sub r10, qword [r15 + 0x30]
je 0x14002e90b
cmp dword [r15 + 0xb4], ebp
je 0x14002e90b
mov r8d, dword [r15 + 0xb0]
add r8, rdi
cmp dword [r8], ebp
je 0x14002e90b
mov eax, dword [r8 + 4]
lea r9, [r8 + 8]
add rax, r8
cmp r9, rax
je 0x14002e8ff
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9]
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x14002e897
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rdi + rdx]
add qword [rcx + rax], r10
jmp 0x14002e8eb
cmp cx, 3
jne 0x14002e8b0
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov eax, r10d
jmp 0x14002e8e8
cmp cx, 1
jne 0x14002e8d0
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov rax, r10
shr rax, 0x10
movzx eax, ax
jmp 0x14002e8e8
cmp cx, 2
jne 0x14002e8eb
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
movzx eax, r10w
add qword [rdx], rax
mov eax, dword [r8 + 4]
add r9, 2
add rax, r8
cmp r9, rax
jne 0x14002e870
mov r8, r9
cmp dword [r9], ebp
jne 0x14002e850
cmp dword [r15 + 0x94], ebp
je 0x14002e9cb
mov ebp, dword [r15 + 0x90]
add rbp, rdi
cmp dword [rbp + 0xc], 0
je 0x14002e9c9
xor r12d, r12d
nop
mov ecx, dword [rbp + 0xc]
add rcx, rdi
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, dword [rbp]
mov r14, rax
mov esi, dword [rbp + 0x10]
add rbx, rdi
add rsi, rdi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002e9b1
jns 0x14002e95e
movzx r8d, word [rbx]
mov rdx, r12
jmp 0x14002e995
mov rdx, qword [rbx]
mov rcx, r12
add rdx, 2
add rdx, rdi
cmp byte [rdx], cl
je 0x14002e97e
mov rax, rdx
inc rcx
lea rax, [rax + 1]
cmp byte [rax], r12b
jne 0x14002e972
mov qword [rsp + 0x50], rdx
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov word [rsp + 0x48], cx
mov word [rsp + 0x4a], cx
mov r9, rsi
mov rcx, r14
call sub.ntdll.dll_LdrGetProcedureAddress
mov rcx, qword [rbx + 8]
add rbx, 8
add rsi, 8
test rcx, rcx
jne 0x14002e953
add rbp, 0x14
cmp dword [rbp + 0xc], r12d
jne 0x14002e930
mov r12, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x30]
xor ebp, ebp
movzx ebx, word [r15 + 0x14]
mov esi, ebp
add rbx, 0x28
mov edx, 1
cmp bp, word [r15 + 6]
jae 0x14002eaac
add rbx, r15
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
nop dword [rax + rax]
cmp dword [rbx], 0
je 0x14002ea99
mov ecx, dword [rbx + 0x14]
mov eax, ecx
and eax, 0x40000000
bt ecx, 0x1d
jb 0x14002ea39
test eax, eax
jne 0x14002ea2b
test ecx, ecx
mov r8d, 8
cmovns r8d, edx
jmp 0x14002ea57
test ecx, ecx
mov r8d, 4
cmovns r8d, r9d
jmp 0x14002ea57
test eax, eax
jne 0x14002ea4b
test ecx, ecx
mov r8d, 0x80
cmovns r8d, r10d
jmp 0x14002ea57
test ecx, ecx
mov r8d, 0x40
cmovns r8d, r11d
mov dword [rsp + 0x58], r8d
test dword [rbx + 0x14], 0x4000000
je 0x14002ea6f
bts r8d, 9
mov dword [rsp + 0x58], r8d
mov ecx, dword [rbx - 4]
lea r9, [rsp + 0x58]
mov edx, dword [rbx]
add rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov edx, 1
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
movzx eax, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jb 0x14002ea00
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [r15 + 0x28]
add rax, rdi
bt r14d, 0xd
jb 0x14002eae2
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], ebp
mov r8, rax
jmp 0x14002eb8b
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
test r12, r12
je 0x14002ebb2
cmp dword [r15 + 0x8c], 0
je 0x14002ebb2
mov r14d, dword [r15 + 0x88]
add r14, rdi
mov eax, dword [r14 + 0x18]
test eax, eax
je 0x14002ebb2
cmp dword [r14 + 0x14], 0
je 0x14002ebb2
mov esi, dword [r14 + 0x20]
mov ebx, dword [r14 + 0x24]
add rsi, rdi
add rbx, rdi
test eax, eax
je 0x14002ebb2
nop dword [rax]
mov edx, dword [rsi]
add rdx, rdi
je 0x14002ebb2
mov rcx, r12
call fcn.140032e38
test eax, eax
jne 0x14002eb58
test rbx, rbx
jne 0x14002eb6a
inc ebp
add rsi, 4
add rbx, 2
cmp ebp, dword [r14 + 0x18]
jb 0x14002eb40
jmp 0x14002ebb2
movzx edx, word [rbx]
mov ecx, dword [r14 + 0x1c]
mov r9, qword [rsp + 0x40]
add rcx, rdi
mov r8d, dword [rcx + rdx*4]
add r8, rdi
xor edx, edx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x14002ebd5
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.kernel32.dll_VirtualFree]
test eax, eax
jne 0x14002ebd0
mov rcx, r13
call qword [sym.imp.kernel32.dll_LocalFree]
mov rax, rdi
jmp 0x14002ebd7
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14002f010
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret