Function at 0x140001900
Capabilities:
Inspect section memory permissions
Parse pe header

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov eax, dword [0x14000700c]
mov rbx, qword gs:[rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x361c
jne 0x1400019f8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuItem]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
jmp 0x140001a0c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x100], r13
test rbx, rbx
je 0x140001aa0
cmp dword [rbx + 0x118], 0xa
jne 0x140001aa0
mov rsi, qword [rbx + 0x10]
movsxd rax, dword [rsi + 0x3c]
lea r10, [rsi + 0x108]
add r10, rax
xor r13d, r13d
mov ebx, r13d
movzx edi, word [rax + rsi + 6]
nop dword [rax + rax]
movzx r11d, byte [r10]
mov edx, r13d
mov r8d, r13d
mov r9, r10
nop dword [rax]
mov rax, r10
test r11b, r11b
je 0x140001a70
inc rax
cmp byte [rax], r13b
jne 0x140001a68
sub rax, r10
movsxd rcx, r8d
cmp rcx, rax
jae 0x140001a8c
movsx eax, byte [r9]
inc r8d
ror edx, 7
add edx, eax
inc r9
jmp 0x140001a60
cmp edx, 0x9f520b2d
je 0x140001ac0
add r10, 0x28
inc rbx
cmp rbx, rdi
jbe 0x140001a50
mov eax, 0xffffffff
mov r13, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x140]
add rsp, 0x110
pop rdi
pop rbx
pop rbp
ret
mov ebx, dword [r10 + 0xc]
mov edi, dword [r10 + 0x10]
add rbx, rsi
je 0x140001aa0
test rdi, rdi
je 0x140001aa0
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x14044ae
mov ecx, 7
mov dword [rsp + 0x34], 0xe67c7320
mov dword [rsp + 0x38], 0xac2eda02
mov dword [rsp + 0x3c], 0xd443ec8c
mov dword [rsp + 0x40], 0x92dd00b3
mov dword [rsp + 0x44], 0x12d71086
mov dword [rsp + 0x48], 0x7b3f64a4
call fcn.140004cf0
test eax, eax
je 0x140001aa0
call fcn.140002760
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rcx
lea r9, [0x140001780]
mov rcx, rax
mov qword [rbp + 0x38], rax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
lea rdx, [0x140001540]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
call fcn.1400027e0
test eax, eax
je 0x140001b97
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140001b89
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp + 0x38]
call fcn.1400027b0
jmp 0x140001aa0
lea rcx, [rbp + 0x38]
call fcn.1400027b0
mov eax, dword [str.hello]
mov edi, 0x3039
mov dword [rbp + 0x30], eax
mov r8d, edi
movzx eax, word [0x1400060fc]
mov word [rbp + 0x34], ax
imul eax, dword [0x140007008], 0x3e39b193
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x50], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x54], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x58], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x5c], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x60], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x64], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x68], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x6c], ecx
mov r8d, edi
sub r8d, eax
mov eax, 0x51eb851f
btr r8d, 0x1f
mul r8d
mov ecx, r8d
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
imul eax, r8d, 0x3e39b193
mov dword [rsp + 0x70], ecx
mov ecx, edi
sub ecx, eax
mov eax, 0x51eb851f
btr ecx, 0x1f
mul ecx
mov dword [0x140007008], ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov dword [rsp + 0x74], ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov ecx, edi
imul eax, dword [0x140007008], 0x3e39b193
sub ecx, eax
mov eax, 0x51eb851f
btr ecx, 0x1f
mul ecx
mov dword [0x140007008], ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov dword [rbx], ecx
mov ecx, edi
imul eax, dword [0x140007008], 0x3e39b193
sub ecx, eax
mov eax, 0x51eb851f
btr ecx, 0x1f
mul ecx
mov dword [0x140007008], ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov dword [rbx + 4], ecx
mov ecx, edi
imul eax, dword [0x140007008], 0x3e39b193
sub ecx, eax
mov eax, 0x51eb851f
btr ecx, 0x1f
mul ecx
mov dword [0x140007008], ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov dword [rbx + 8], ecx
mov ecx, edi
imul eax, dword [0x140007008], 0x3e39b193
sub ecx, eax
mov eax, 0x51eb851f
btr ecx, 0x1f
mul ecx
mov dword [0x140007008], ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
sub ecx, eax
mov eax, 0x51eb851f
mov dword [rbx + 0xc], ecx
imul ecx, dword [0x140007008], 0x3e39b193
sub edi, ecx
btr edi, 0x1f
mov dword [0x140007008], edi
mul edi
shr edx, 5
mov eax, 0x51eb851f
imul ecx, edx, 0x64
sub edi, ecx
mul edi
shr edx, 5
imul eax, edx, 0x64
sub edi, eax
mov dword [rbx + 0x10], edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], r13
test rcx, rcx
je 0x140002505
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140002505
mov qword [rsp + 0x58], rax
mov eax, 0x5a4d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
cmp word [rcx], ax
jne 0x140002505
movsxd rdi, dword [rcx + 0x3c]
add rdi, rcx
mov qword [rsp + 0x68], rdi
cmp dword [rdi], 0x4550
jne 0x140002505
lea rax, [rdi + 0x90]
mov qword [rsp + 0x70], rax
lea rcx, [rdi + 0xd0]
mov qword [rsp + 0x78], rcx
lea r8, [rdi + 0xb0]
mov qword [rbp - 0x80], r8
lea r9, [rdi + 0xa0]
mov qword [rbp - 0x78], r9
lea rdx, [rdi + 0x108]
mov qword [rbp - 0x70], rdx
test rdi, rdi
je 0x140002505
test rax, rax
je 0x140002505
test rcx, rcx
je 0x140002505
test r8, r8
je 0x140002505
test r9, r9
je 0x140002505
test rdx, rdx
je 0x140002505
mov r8d, dword [rdi + 0x50]
xor r9d, r9d
mov rdx, qword [rdi + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call fcn.140004d90
mov rbx, rax
test rax, rax
jne 0x140002035
mov ecx, dword [rdi + 0x50]
xor edx, edx
call fcn.140004ec0
mov rbx, rax
test rax, rax
je 0x140002505
mov r8d, dword [rdi + 0x54]
mov dword [rbp + 0x30], r13d
movsxd rax, dword [rbp + 0x30]
cmp rax, r8
jae 0x140002075
nop word [rax + rax]
movsxd rcx, dword [rbp + 0x30]
mov rax, qword [rsp + 0x40]
movzx edx, byte [rcx + rax]
movsxd rax, dword [rbp + 0x30]
mov byte [rax + rbx], dl
mov eax, dword [rbp + 0x30]
inc eax
mov dword [rbp + 0x30], eax
movsxd rax, dword [rbp + 0x30]
cmp rax, r8
jb 0x140002050
mov rsi, qword [rsp + 0x68]
mov edi, r13d
cmp r13w, word [rsi + 6]
jae 0x1400020e5
mov r11, qword [rbp - 0x70]
add r11, 0x14
nop dword [rax]
mov r8d, dword [r11]
add r8, qword [rsp + 0x40]
mov r10d, dword [r11 - 4]
mov r9d, dword [r11 - 8]
mov dword [rbp + 0x30], r13d
add r9, rbx
movsxd rax, dword [rbp + 0x30]
cmp rax, r10
jae 0x1400020d2
movsxd rax, dword [rbp + 0x30]
movzx edx, byte [rax + r8]
movsxd rax, dword [rbp + 0x30]
mov byte [rax + r9], dl
mov eax, dword [rbp + 0x30]
inc eax
mov dword [rbp + 0x30], eax
movsxd rax, dword [rbp + 0x30]
cmp rax, r10
jb 0x1400020b0
movzx eax, word [rsi + 6]
inc edi
add r11, 0x28
cmp edi, eax
jl 0x140002090
mov rsi, qword [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rbp - 0x60]
movaps xmm1, xmmword [rsp + 0x60]
mov rdx, rbx
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rbp - 0x40], xmm0
movaps xmm0, xmmword [rbp - 0x80]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [rbp - 0x70]
movsd qword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x50], xmm1
call fcn.1400015b0
test eax, eax
je 0x140002505
mov rcx, qword [rsi + 0x30]
movaps xmm0, xmmword [rbp - 0x80]
cmp rbx, rcx
je 0x14000220e
movq rax, xmm0
mov r11, rbx
sub r11, rcx
mov r8d, dword [rax]
add r8, rbx
cmp dword [r8], r13d
je 0x14000220e
mov eax, dword [r8 + 4]
lea r10, [r8 + 8]
add rax, r8
cmp r10, rax
je 0x140002202
nop word [rax + rax]
movzx r9d, word [r10]
mov ecx, r9d
movzx edx, r9w
shr ecx, 0xc
test ecx, ecx
je 0x1400021ee
sub ecx, 1
je 0x1400021d5
sub ecx, 1
je 0x1400021c1
sub ecx, 1
je 0x1400021ae
cmp ecx, 7
jne 0x140002505
mov ecx, dword [r8]
and r9d, 0xfff
lea rax, [rbx + r9]
add qword [rcx + rax], r11
jmp 0x1400021ee
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rbx + rdx]
add dword [rcx + rax], r11d
jmp 0x1400021ee
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rbx + rdx]
add word [rcx + rax], r11w
jmp 0x1400021ee
mov ecx, dword [r8]
and edx, 0xfff
add rdx, rbx
mov rax, r11
add rdx, rcx
shr rax, 0x10
add word [rdx], ax
mov eax, dword [r8 + 4]
add r10, 2
add rax, r8
cmp r10, rax
jne 0x140002170
mov r8, r10
cmp dword [r10], r13d
jne 0x140002151
psrldq xmm0, 8
movq rdi, xmm0
mov qword [rsp + 0xf8], r14
cmp dword [rdi + 4], r13d
je 0x140002278
mov r14d, dword [rdi]
lea rcx, str.KERNEL32.DLL
add r14, rbx
call section..text
mov rcx, rax
mov edx, 0x9219585c
call fcn.140001160
mov r9, rax
test rax, rax
je 0x1400024fd
mov edx, dword [rdi + 4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
mov r8, rbx
mov rcx, r14
shr rdx, 3
dec edx
call r9
test al, al
je 0x1400024fd
mov qword [rsp + 0x108], r12
lea rcx, [0x1400060c0]
mov qword [rsp + 0xf0], r15
mov rdi, r13
mov r15, r13
mov dword [rbp + 0x30], r13d
mov r14, r13
call fcn.1400025b0
lea rcx, str.NTDLL.DLL
mov r12, rax
call section..text
mov r8, rax
test r12, r12
je 0x1400024ed
test rax, rax
je 0x1400024ed
mov eax, 0x5a4d
cmp word [r8], ax
jne 0x1400024ed
movsxd rcx, dword [r8 + 0x3c]
add rcx, r8
cmp dword [rcx], 0x4550
jne 0x1400024ed
movzx edx, word [rcx + 6]
test rdx, rdx
je 0x1400024ed
movzx eax, word [rcx + 0x14]
add rcx, 0x24
mov r9d, dword [0x140007004]
add rcx, rax
mov r10d, dword [str..tex____90]
nop dword [rax]
mov eax, dword [rcx - 0xc]
or eax, r9d
cmp eax, r10d
jne 0x140002329
mov eax, dword [rcx]
mov r14d, dword [rcx - 4]
lea rdi, [r8 + rax]
lea r15, [r12 + rax]
add rcx, 0x28
sub rdx, 1
jne 0x140002310
test r14, r14
je 0x1400024ed
test rdi, rdi
je 0x1400024ed
test r15, r15
je 0x1400024ed
lea rax, [rbp + 0x30]
mov r9d, 0x80
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, rdi
xor ecx, ecx
call fcn.140005130
mov r12d, eax
cmp dword [rbp + 0x30], r13d
jl 0x1400024ed
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.140001700
lea rax, [rbp + 0x30]
mov r9d, r12d
mov r8, r14
mov qword [rsp + 0x20], rax
mov rdx, rdi
xor ecx, ecx
call fcn.140005130
cmp dword [rbp + 0x30], r13d
jl 0x1400024ed
mov edi, r13d
mov r14, qword [rbp - 0x70]
cmp r13w, word [rsi + 6]
jae 0x140002485
mov r12d, 2
mov r8d, 4
mov r10d, 0x10
mov r11d, 0x20
mov r15d, 0x80
nop dword [rax + rax]
mov eax, edi
mov qword [rsp + 0x20], r13
lea rcx, [rax + rax*4]
lea rdx, [r14 + rcx*8]
mov ecx, dword [r14 + rcx*8 + 0x24]
mov r9d, ecx
sar r9d, 0x1f
mov eax, ecx
and r9d, 8
bt ecx, 0x1e
cmovb r9d, r12d
and eax, 0xc0000000
cmp eax, 0xc0000000
mov eax, ecx
cmove r9d, r8d
mov r8d, dword [rdx + 0x10]
mov edx, dword [rdx + 0xc]
bt ecx, 0x1d
cmovb r9d, r10d
and eax, 0xa0000000
cmp eax, 0xa0000000
mov eax, ecx
cmove r9d, r15d
and eax, 0x60000000
cmp eax, 0x60000000
mov eax, 0x40
cmove r9d, r11d
and ecx, 0xe0000000
cmp ecx, 0xe0000000
cmove r9d, eax
add rdx, rbx
xor ecx, ecx
call fcn.140005130
movzx eax, word [rsi + 6]
inc edi
mov r8d, 4
mov r10d, 0x10
mov r11d, 0x20
cmp edi, eax
jb 0x1400023e0
movaps xmm0, xmmword [rsp + 0x70]
psrldq xmm0, 8
movq rax, xmm0
cmp dword [rax + 4], r13d
je 0x1400024ca
mov eax, dword [rax]
mov rdi, qword [rax + rbx + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x1400024ca
nop dword [rax]
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call rax
mov rax, qword [rdi + 8]
lea rdi, [rdi + 8]
test rax, rax
jne 0x1400024b0
mov edi, dword [rsi + 0x28]
mov r8d, dword [r14 + 0xc]
add rdi, rbx
shr r8, 2
test r8, r8
je 0x1400024eb
shl r8, 2
xor edx, edx
mov rcx, rbx
call fcn.140002540
call rdi
mov r12, qword [rsp + 0x108]
mov r15, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
xor eax, eax
jmp 0x140001aa5