Function at 0x1400486c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14006e010]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r13d, r13d
mov byte [rbp - 0x28], 0
xor eax, eax
mov qword [rbp - 8], r13
lea rdi, [rbp + 0x30]
mov dword [rbp - 0x24], r13d
mov ecx, 0x104
mov dword [rbp], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp + 4], 0xd18b4c00
mov word [rbp + 8], 0x50f
mov byte [rbp + 0xa], 0xc3
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x10], r13
mov dword [rbp - 0x5c], r13d
mov dword [rbp - 0x44], r13d
cmp word [rbp + 0x30], r13w
je 0x140048750
add rax, 2
cmp word [rax], r13w
jne 0x140048746
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140048760
mov word [rax], r13w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x14004878a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140048780
lea rdx, [0x140061ec0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400487a0
mov word [rax], r13w
lea rcx, [rbp + 0x30]
mov eax, r13d
cmp word [rbp + 0x30], r13w
je 0x1400487ce
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r13w
jne 0x1400487c2
add ax, ax
mov dword [rbp - 0x60], 0x30
mov word [rbp - 0x20], ax
mov r14, r13
add ax, 2
mov qword [rbp - 0x58], r13
mov word [rbp - 0x1e], ax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x48], 0x40
mov qword [rbp - 0x50], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x380], rbx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004885c
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004884e
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140048858
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048834
jmp 0x14004885c
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x140048907
cmp word [r9], r15w
jne 0x140048907
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140048907
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140048907
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140048907
nop word [rax + rax]
mov ecx, dword [rdi]
mov rax, rsi
add rcx, r9
je 0x1400488fb
movzx edx, byte [rcx]
cmp dl, 0x5a
jne 0x1400488f1
sub rcx, rsi
test dl, dl
je 0x1400488ec
cmp byte [rax], r13b
je 0x1400488f1
movzx edx, byte [rax + rcx + 1]
inc rax
cmp dl, byte [rax]
je 0x1400488d5
jmp 0x1400488f1
cmp byte [rax], r13b
je 0x14004894a
movsx ecx, byte [rax]
movsx eax, dl
cmp eax, ecx
je 0x14004894a
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400488c0
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004895f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048940
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x14004895b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048926
jmp 0x14004895f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004890a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x140048a06
cmp word [r9], r15w
jne 0x140048a06
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140048a06
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140048a06
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140048a06
nop word [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400489fa
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400489f0
sub rcx, rsi
test al, al
je 0x1400489eb
cmp byte [rdx], r13b
je 0x1400489f0
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400489d4
jmp 0x1400489f0
cmp byte [rdx], r13b
je 0x140048a49
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140048a49
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400489c0
mov r14, r13
mov rax, qword gs:[0x60]
mov r15, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048a5e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048a3f
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140048a5a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048a25
jmp 0x140048a5e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x140048a09
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x140048b90
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140048b90
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140048b90
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140048b90
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140048b90
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140048b0b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140048b01
sub rax, rsi
test dl, dl
je 0x140048afc
cmp byte [rcx], r13b
je 0x140048b01
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140048ae5
jmp 0x140048b01
cmp byte [rcx], r13b
je 0x140048b19
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140048b19
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140048ad0
jmp 0x140048b90
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140048b90
test r14, r14
je 0x140048b90
test r12, r12
je 0x140048b90
lea r8, [rbp - 0x60]
mov edx, 4
lea rcx, [rbp - 0x70]
call r12
test eax, eax
js 0x140048b90
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r14
test eax, eax
js 0x140048b90
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140048b90
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048bd8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048bca
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140048bd4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048bb0
jmp 0x140048bd8
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x68]
lea r15, str.ZwUnmapViewOfSection
test r9, r9
je 0x140048d7d
mov r11, qword [r14 + 0x30]
test r11, r11
je 0x140048d7d
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x140048c9f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140048c9f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140048c9f
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x140048c9f
lea r14, str.NtSetInformationThread
nop dword [rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140048c93
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140048c85
sub rax, r14
test dl, dl
je 0x140048c7c
cmp byte [rcx], r13b
je 0x140048c85
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140048c65
jmp 0x140048c85
cmp byte [rcx], r13b
je 0x140048d1b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140048d1b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140048c50
mov r10, r13
cmp word [r11], r12w
jne 0x140048d49
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140048d49
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x140048d49
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov esi, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rsi, r11
mov ebx, dword [rax + 0x14]
add r14, r11
test ebx, ebx
je 0x140048d49
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r11
je 0x140048d3d
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140048d33
sub rcx, r15
test al, al
je 0x140048d2e
cmp byte [rdx], r13b
je 0x140048d33
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140048d04
jmp 0x140048d33
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r10d, dword [rsi + rcx*4]
add r10, r9
jmp 0x140048ca2
cmp byte [rdx], r13b
je 0x140048d5f
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140048d5f
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x140048cf0
mov rax, r13
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r10, r10
jne 0x140048d6f
call rax
jmp 0x140048d83
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140048d4c
movzx r13d, word [r10 + 4]
mov dword [rsp + 0x50], r13d
call rax
jmp 0x140048d88
mov r12d, 0x5a4d
mov dword [rsp + 0x50], r13d
xor r15d, r15d
mov word [rbp - 0x30], r13w
xor eax, eax
mov qword [rbp - 0x68], r15
lea rdi, [rbp + 0x30]
mov qword [rbp - 0x70], r15
mov ecx, 0x104
mov qword [rbp - 0x10], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp - 0x5c], r15d
mov dword [rbp - 0x44], r15d
cmp word [rbp + 0x30], r15w
je 0x140048dca
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140048dc0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140048de0
mov word [rax], r15w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x140048e0a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140048e00
lea rcx, [0x140061ec0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140048e20
mov word [rax], r15w
lea rcx, [rbp + 0x30]
mov eax, r15d
cmp word [rbp + 0x30], r15w
je 0x140048e4e
inc eax
lea rcx, [rcx + 2]
cmp word [rcx], r15w
jne 0x140048e42
add ax, ax
mov dword [rbp - 0x60], 0x30
mov word [rbp - 0x20], ax
mov r14, r15
add ax, 2
mov qword [rbp - 0x58], r15
mov word [rbp - 0x1e], ax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x48], 0x40
mov qword [rbp - 0x50], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048ed8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048eca
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140048ed4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048eb0
jmp 0x140048ed8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140048f77
cmp word [r9], r12w
jne 0x140048f77
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140048f77
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140048f77
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140048f77
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140048f6b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140048f61
sub rax, rsi
test dl, dl
je 0x140048f5c
cmp byte [rcx], r15b
je 0x140048f61
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140048f45
jmp 0x140048f61
cmp byte [rcx], r15b
je 0x140048fba
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140048fba
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140048f30
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048fcf
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048fb0
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140048fcb
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048f96
jmp 0x140048fcf
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140048f7a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140049076
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049076
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049076
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049076
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049076
lea rsi, str.ZwMapViewOfSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004906a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049060
sub rcx, rsi
test al, al
je 0x14004905b
cmp byte [rdx], r15b
je 0x140049060
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049044
jmp 0x140049060
cmp byte [rdx], r15b
je 0x1400490b6
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400490b6
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049030
mov r14, r15
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400490cb
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400490ac
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x1400490c7
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049092
jmp 0x1400490cb
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r14d, dword [rbx + rcx*4]
add r14, r9
jmp 0x140049079
lea r15, [rdi - 0x10]
mov r9, qword [r15 + 0x30]
test r9, r9
je 0x140049202
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049202
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049202
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049202
mov edi, dword [rax + 0x20]
xor r15d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, r15d
test r10d, r10d
je 0x140049205
lea rsi, str.NtClose
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004917b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049171
sub rax, rsi
test dl, dl
je 0x14004916c
cmp byte [rcx], r15b
je 0x140049171
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049155
jmp 0x140049171
cmp byte [rcx], r15b
je 0x140049189
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049189
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049140
jmp 0x140049205
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140049205
test r14, r14
je 0x140049205
test r12, r12
je 0x140049205
lea r8, [rbp - 0x60]
mov edx, 4
lea rcx, [rbp - 0x70]
call r12
test eax, eax
js 0x140049205
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x68]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call r14
test eax, eax
js 0x140049205
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140049205
call rdi
jmp 0x140049205
xor r15d, r15d
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049249
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004923b
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x140049245
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049221
jmp 0x140049249
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x68]
test r9, r9
je 0x1400493ec
mov r10, qword [r14 + 0x30]
test r10, r10
je 0x1400493ec
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x14004930f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004930f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004930f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x14004930f
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140049303
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400492f5
sub rax, r14
test dl, dl
je 0x1400492ec
cmp byte [rcx], 0
je 0x1400492f5
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400492d5
jmp 0x1400492f5
cmp byte [rcx], 0
je 0x14004938b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004938b
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400492c0
mov r11, r15
cmp word [r10], r12w
jne 0x1400493b9
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x1400493b9
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x1400493b9
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov esi, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rsi, r10
mov ebx, dword [rax + 0x14]
add r14, r10
test ebx, ebx
je 0x1400493b9
lea r12, str.ZwUnmapViewOfSection
nop
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r10
je 0x1400493ad
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400493a3
sub rcx, r12
test al, al
je 0x14004939e
cmp byte [rdx], 0
je 0x1400493a3
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049374
jmp 0x1400493a3
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r11d, dword [rsi + rcx*4]
add r11, r9
jmp 0x140049312
cmp byte [rdx], 0
je 0x1400493d3
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400493d3
inc r8d
add rdi, 4
cmp r8d, ebx
jb 0x140049360
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r11, r11
jne 0x1400493e3
call rax
movzx r14d, r15w
jmp 0x1400493ef
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x1400493bc
movzx r14d, word [r11 + 4]
call rax
jmp 0x1400493ef
mov r14d, r15d
mov word [rbp - 0x2c], r14w
mov r12d, 0xb
test r13w, r13w
je 0x140049406
test r14w, r14w
jne 0x140049481
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140049469
cmp al, 6
jne 0x140049456
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140049456
sub ecx, 1
je 0x140049442
cmp ecx, 1
jne 0x140049469
mov r13d, 0xc
lea r14d, [rcx + 0x23]
mov dword [rsp + 0x50], r13d
mov word [rbp - 0x30], r13w
jmp 0x14004947c
movzx edx, r12w
mov r14d, 0x23
mov dword [rsp + 0x50], edx
mov word [rbp - 0x30], dx
jmp 0x14004947c
mov edx, 0xa
mov dword [rsp + 0x50], edx
mov word [rbp - 0x30], dx
lea r14d, [rdx + 0x18]
jmp 0x14004947c
mov eax, 0xd
mov r14d, 0x25
mov dword [rsp + 0x50], eax
mov word [rbp - 0x30], ax
mov word [rbp - 0x2c], r14w
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400494c8
nop word [rax + rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400494ba
lea rcx, [0x140061ec0]
call fcn.140046fc0
test rax, rax
jne 0x1400494c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400494a0
jmp 0x1400494c8
lea r15, [rdi - 0x10]
mov rsi, qword [r15 + 0x30]
test rsi, rsi
je 0x14004957f
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14004957f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004957f
mov edi, dword [rax + rsi + 0x88]
add rdi, rsi
je 0x14004957f
mov ebx, dword [rdi + 0x24]
mov r15d, dword [rdi + 0x1c]
add rbx, rsi
add r15, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rdi + 0x14]
mov r8d, eax
mov eax, 0x88888889
mul r8d
shr edx, 4
imul ecx, edx, 0x1e
xor edx, edx
sub r8d, ecx
xor ecx, ecx
test r9d, r9d
je 0x14004957f
nop word [rax + rax]
movzx eax, word [rbx]
mov edi, dword [r15 + rax*4]
add rdi, rsi
cmp byte [rdi], 0x4c
jne 0x140049574
cmp byte [rdi + 1], 0x8b
jne 0x140049574
cmp byte [rdi + 2], 0xd1
jne 0x140049574
cmp byte [rdi + 3], 0xb8
jne 0x140049574
cmp byte [rdi + 0x12], 0xf
jne 0x140049574
cmp byte [rdi + 0x13], 5
jne 0x140049574
inc edx
cmp edx, r8d
je 0x1400495b5
inc ecx
add rbx, 2
cmp ecx, r9d
jb 0x140049540
xor al, al
mov rbx, qword [rsp + 0x380]
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140057e20
lea r11, [rsp + 0x350]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test rdi, rdi
je 0x14004957f
lea r9, [rbp - 0x24]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 1]
lea rax, [rbp - 0x30]
cmp rcx, rax
jbe 0x1400495f0
lea rcx, [rbp + 1]
lea rax, [rbp - 0x2e]
nop word [rax + rax]
mov eax, dword [rsp + 0x50]
movzx ecx, byte [rbp - 0x2f]
mov byte [rbp + 1], al
lea rax, [rbp + 0x10]
mov byte [rbp + 2], cl
cmp rax, rdi
jbe 0x140049710
lea rax, [rdi + 0x14]
lea rdx, [rbp + 0x10]
cmp rdx, rax
jae 0x140049710
movzx edx, byte [rax - 1]
lea r8, [rdi + 2]
mov byte [rsp + 0x66], dl
lea r9, [rdi + 3]
movzx edx, byte [rax - 2]
lea r10, [rdi + 4]
mov byte [rsp + 0x65], dl
lea r11, [rdi + 5]
movzx edx, byte [rax - 3]
lea rbx, [rdi + 6]
mov byte [rsp + 0x64], dl
lea r15, [rdi + 7]
movzx edx, byte [rax - 4]
lea rsi, [rdi + 0xa]
mov byte [rsp + 0x63], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x62], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x61], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x57], dl
movzx edx, byte [rax - 0x11]
mov byte [rsp + 0x56], dl
movzx edx, byte [rax - 0x12]
movzx eax, byte [rax - 0x13]
mov byte [rsp + 0x54], al
lea rax, [rdi + 8]
mov qword [rsp + 0x68], rax
lea rax, [rdi + 9]
mov byte [rsp + 0x55], dl
lea rdx, [rdi + 1]
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], r10
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x10], rbx
mov qword [rbp - 0x68], r15
jmp 0x1400497f3
movzx eax, byte [rdi + 1]
lea rdx, [rdi + 1]
mov byte [rsp + 0x54], al
lea r8, [rdi + 2]
movzx eax, byte [r8]
lea r9, [rdi + 3]
mov byte [rsp + 0x55], al
lea r10, [rdi + 4]
movzx eax, byte [r9]
lea r11, [rdi + 5]
mov byte [rsp + 0x56], al
lea rbx, [rdi + 6]
movzx eax, byte [r10]
lea r15, [rdi + 7]
mov byte [rsp + 0x57], al
lea rsi, [rdi + 0xa]
movzx eax, byte [r11]
mov byte [rsp + 0x58], al
movzx eax, byte [rbx]
mov byte [rsp + 0x59], al
movzx eax, byte [r15]
mov byte [rsp + 0x5a], al
lea rax, [rdi + 8]
mov qword [rsp + 0x68], rax
movzx eax, byte [rax]
mov byte [rsp + 0x5b], al
lea rax, [rdi + 9]
mov qword [rbp - 0x70], rax
movzx eax, byte [rax]
mov byte [rsp + 0x5c], al
movzx eax, byte [rsi]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x60], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x61], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x62], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x63], al
movzx eax, byte [rdi + 0x11]
mov byte [rsp + 0x64], al
movzx eax, byte [rdi + 0x12]
mov byte [rsp + 0x65], al
movzx eax, byte [rdi + 0x13]
mov byte [rsp + 0x66], al
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x80], r9
mov qword [rbp - 0x78], r10
mov qword [rbp - 0x20], r11
mov qword [rbp - 0x10], rbx
mov qword [rbp - 0x68], r15
mov rax, rdi
movzx eax, byte [rax]
mov byte [rbp - 0x30], al
lea rax, [rbp]
cmp rdi, rax
jbe 0x140049830
lea rax, [rbp + 0xb]
cmp rdi, rax
jae 0x140049830
mov eax, dword [rsp + 0x50]
mov byte [rsi - 9], al
mov dword [rsi - 3], 0xc3050fd1
mov dword [rsi - 7], 0x8b4c0000
mov byte [rsi - 8], cl
jmp 0x14004985e
mov eax, dword [rsp + 0x50]
mov byte [rdx], al
mov rax, qword [rsp + 0x68]
mov byte [r8], cl
mov byte [r9], 0
mov byte [r10], 0
mov byte [rax], 0xf
mov rax, qword [rbp - 0x70]
mov byte [r11], 0x4c
mov byte [rbx], 0x8b
mov byte [r15], 0xd1
mov byte [rax], 5
mov byte [rsi], 0xc3
mov r9d, 0x999
mov byte [rdi], 0xb8
lea r8, [rbp - 8]
mov edx, 0x11
mov rcx, 0xfffffffffffffffe
call rdi
test eax, eax
jns 0x140049bbd
lea r15, [rbp]
mov r11, r12
sub r15, rdi
mov r8, rdi
mov rbx, rdi
nop dword [rax]
nop word [rax + rax]
movzx r10d, byte [r8 + r15]
movzx r9d, byte [r8]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r10d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x1400498d6
inc r8
sub r11, 1
je 0x1400498df
jmp 0x1400498a0
cmp r9d, r10d
jne 0x140049bbd
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x14004957f
lea rcx, [rbp + 1]
lea rax, [rbp - 0x2c]
cmp rcx, rax
jbe 0x140049910
lea rcx, [rbp + 1]
lea rax, [rbp - 0x2a]
nop dword [rax]
movzx eax, byte [rbp - 0x2b]
lea rcx, [rbp]
mov byte [rbp + 2], al
mov byte [rbp + 1], r14b
cmp rbx, rcx
jbe 0x140049950
lea rcx, [rbp + 0xb]
cmp rbx, rcx
jae 0x140049950
mov r13, qword [rsp + 0x70]
mov dword [rsi - 3], 0xc3050fd1
mov dword [rsi - 7], 0x8b4c0000
mov byte [rsi - 8], al
mov byte [rsi - 9], r14b
jmp 0x140049995
mov rcx, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov byte [rsi], 0xc3
mov byte [rcx], al
mov rax, qword [rbp - 0x80]
mov byte [r13], r14b
mov byte [rax], 0
mov rax, qword [rbp - 0x78]
mov byte [rax], 0
mov rax, qword [rbp - 0x20]
mov byte [rax], 0x4c
mov rax, qword [rbp - 0x10]
mov byte [rax], 0x8b
mov rax, qword [rbp - 0x68]
mov byte [rax], 0xd1
mov rax, qword [rsp + 0x68]
mov byte [rax], 0xf
mov rax, qword [rbp - 0x70]
mov byte [rax], 5
mov r9d, 1
mov byte [rdi], 0xb8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x20], 0
mov rcx, 0xfffffffffffffffe
lea edx, [r9 + 0x10]
call rbx
mov r14d, eax
mov r10, rbx
nop
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + r15]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r8d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x1400499f6
inc rbx
sub r12, 1
je 0x1400499ff
jmp 0x1400499c0
cmp r8d, r9d
jne 0x140049bbd
lea rax, [rbp + 0x10]
cmp r10, rax
jbe 0x140049ad0
lea rax, [rbp + 0x24]
cmp r10, rax
jae 0x140049ad0
movzx eax, byte [rsp + 0x66]
movzx ecx, byte [rsp + 0x5c]
mov byte [r10 + 0x13], al
movzx eax, byte [rsp + 0x65]
mov byte [r10 + 0x12], al
movzx eax, byte [rsp + 0x64]
mov byte [r10 + 0x11], al
movzx eax, byte [rsp + 0x63]
mov byte [r10 + 0x10], al
movzx eax, byte [rsp + 0x62]
mov byte [r10 + 0xf], al
movzx eax, byte [rsp + 0x61]
mov byte [r10 + 9], cl
movzx ecx, byte [rsp + 0x5b]
mov byte [r10 + 0xe], al
movzx eax, byte [rsp + 0x60]
mov byte [r10 + 8], cl
movzx ecx, byte [rsp + 0x5a]
mov byte [r10 + 0xd], al
movzx eax, byte [rsp + 0x5f]
mov byte [r10 + 7], cl
movzx ecx, byte [rsp + 0x59]
mov byte [r10 + 0xc], al
movzx eax, byte [rsp + 0x5e]
mov byte [r10 + 6], cl
movzx ecx, byte [rsp + 0x58]
mov byte [r10 + 0xb], al
movzx eax, byte [rsp + 0x5d]
mov byte [r10 + 5], cl
movzx ecx, byte [rsp + 0x57]
mov byte [r10 + 0xa], al
movzx eax, byte [rsp + 0x54]
mov byte [r10 + 4], cl
movzx ecx, byte [rsp + 0x56]
mov byte [r10 + 1], al
movzx eax, byte [rbp - 0x30]
mov byte [r10 + 3], cl
movzx ecx, byte [rsp + 0x55]
mov byte [rdi], al
mov byte [r10 + 2], cl
jmp 0x140049b92
movzx eax, byte [rbp - 0x30]
movzx ecx, byte [rsp + 0x55]
mov byte [r10], al
movzx eax, byte [rsp + 0x54]
mov byte [r13], al
mov rax, qword [rsp + 0x78]
mov byte [rax], cl
mov rax, qword [rbp - 0x80]
movzx ecx, byte [rsp + 0x56]
mov byte [rax], cl
mov rax, qword [rbp - 0x78]
movzx ecx, byte [rsp + 0x57]
mov byte [rax], cl
mov rax, qword [rbp - 0x20]
movzx ecx, byte [rsp + 0x58]
mov byte [rax], cl
mov rax, qword [rbp - 0x10]
movzx ecx, byte [rsp + 0x59]
mov byte [rax], cl
mov rax, qword [rbp - 0x68]
movzx ecx, byte [rsp + 0x5a]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
movzx ecx, byte [rsp + 0x5b]
mov byte [rax], cl
mov rax, qword [rbp - 0x70]
movzx ecx, byte [rsp + 0x5c]
mov byte [rax], cl
movzx eax, byte [rsp + 0x5d]
mov byte [rsi], al
movzx eax, byte [rsp + 0x5e]
mov byte [r10 + 0xb], al
movzx eax, byte [rsp + 0x5f]
mov byte [r10 + 0xc], al
movzx eax, byte [rsp + 0x60]
mov byte [r10 + 0xd], al
movzx eax, byte [rsp + 0x61]
mov byte [r10 + 0xe], al
movzx eax, byte [rsp + 0x62]
mov byte [r10 + 0xf], al
movzx eax, byte [rsp + 0x63]
mov byte [r10 + 0x10], al
movzx eax, byte [rsp + 0x64]
mov byte [r10 + 0x11], al
movzx eax, byte [rsp + 0x65]
mov byte [r10 + 0x12], al
movzx eax, byte [rsp + 0x66]
mov byte [r10 + 0x13], al
mov r8d, dword [rbp - 0x24]
lea r9, [rbp - 0x24]
mov edx, 0x1024
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test r14d, r14d
js 0x14004957f
cmp byte [rbp - 0x28], 0
sete al
jmp 0x140049581
mov al, 1
jmp 0x140049581