Function at 0x40d008
Capabilities:
Allocate or change rwx memory
Inspect section memory permissions
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx ecx, word [0x00413060]
xor r14d, r14d
mov r12, rax
mov edi, r14d
lea r13d, [r14 + 1]
cmp r14w, cx
jae 0x40d123
lea rbx, [0x00413064]
cmp dword [rbx + 4], r14d
je 0x40d111
mov esi, dword [rbx]
lea r8, [rbp - 0x40]
mov r14d, dword [rbx + 4]
add rsi, r12
mov rdx, rsi
mov r9d, r14d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [rbp - 0x20], 0x10000
jne 0x40d107
cmp dword [rbx + 0x10], 0x20000000
mov eax, 0x40
je 0x40d0be
cmp dword [rbx + 0x10], 0x40000000
je 0x40d0b7
cmp dword [rbx + 0x10], 0x80000000
jne 0x40d0c3
mov eax, 4
jmp 0x40d0c3
mov eax, 2
jmp 0x40d0c3
mov eax, 0x10
mov r9d, 0x1000
mov dword [rsp + 0x20], eax
mov r8, r14
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor r14d, r14d
test rax, rax
jne 0x40d10a
xor r9d, r9d
lea r8, [0x004112a8]
lea rdx, [0x004112b0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r14d, r14d
movzx ecx, word [0x00413060]
add edi, r13d
movzx eax, cx
add rbx, 0x18
cmp edi, eax
jl 0x40d061
mov rdi, qword [0x00413048]
mov esi, r14d
cmp r14w, cx
jae 0x40d24e
lea rbx, [0x00413068]
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x40d1e6
cmp edx, r13d
jne 0x40d235
mov ecx, dword [rbx]
call fcn.0040f450
mov ecx, dword [rbx + 8]
lea r9, [rbp + 0x58]
mov r8d, dword [rbx + 4]
lea rdx, [rbp + 0x50]
add r8, rdi
mov qword [rbp + 0x58], rcx
mov r14, rax
mov rcx, qword [r8]
mov qword [rbp + 0x50], rcx
lea rcx, [r8 + 0x10]
mov qword [rsp + 0x20], rcx
add r8, 0x18
mov rcx, rax
call fcn.0040d3c4
cmp qword [rbp + 0x50], 0
je 0x40d30e
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [rbx - 4]
mov rdx, r14
mov r8d, dword [rbx]
add rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r14
call fcn.0040f448
xor r14d, r14d
jmp 0x40d22e
cmp dword [rbx], r14d
je 0x40d235
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, rdi
mov r8d, dword [rbx]
add rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov ecx, dword [rbx - 4]
lea r9, [rbp + 0x48]
mov edx, dword [rbx]
add rcx, rdi
mov r8d, dword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx ecx, word [0x00413060]
add esi, r13d
movzx eax, cx
add rbx, 0x18
cmp esi, eax
jl 0x40d13e
mov rdi, qword [0x00413048]
mov eax, dword [0x00413050]
mov r12d, r14d
mov ecx, dword [0x00413058]
add rax, rdi
mov ebx, dword [0x00413054]
mov qword [0x00413888], rax
add rbx, rdi
movabs rax, 0xcccccccccccccccd
mov dword [rbp + 0x58], r14d
mul rcx
mov r13, rdx
shr r13, 4
test r13d, r13d
je 0x40d388
cmp dword [rbx], r14d
je 0x40d374
mov ecx, dword [rbx + 0xc]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [rbx]
mov r15d, dword [rbx + 0x10]
add rsi, rdi
add r15, rdi
mov qword [rbp + 0x60], rax
cmp qword [rsi], 0
je 0x40d2c6
inc r14d
cmp qword [rsi + r14*8], 0
jne 0x40d2bc
mov eax, r14d
lea r9, [rbp + 0x50]
shl rax, 3
mov r8d, 0x40
mov rdx, rax
mov qword [rbp - 0x48], rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [rbp + 0x48], 0
test r14d, r14d
je 0x40d35c
mov r12, r15
sub rsi, r15
mov rcx, qword [r12 + rsi]
mov rax, rcx
shr rax, 0x3f
cmp al, 1
je 0x40d331
lea rdx, [rdi + 2]
add rdx, rcx
jmp 0x40d334
xor r9d, r9d
lea r8, [0x004112a8]
lea rdx, [0x004112c8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movzx edx, cx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40d39d
mov edx, dword [rbp + 0x48]
inc edx
mov qword [r12], rax
add r12, 8
mov dword [rbp + 0x48], edx
cmp edx, r14d
jb 0x40d2f6
mov r12d, dword [rbp + 0x58]
mov r8d, dword [rbp + 0x50]
lea r9, [rbp + 0x50]
mov rdx, qword [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r14d, r14d
inc r12d
add rbx, 0x14
mov dword [rbp + 0x58], r12d
cmp r12d, r13d
jb 0x40d291
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
jmp 0x40f440
xor r9d, r9d
lea r8, [0x004112a8]
lea rdx, [0x004112d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
push qword [0x00413888]
ret