Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov rdi, rcx
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x14000f914], 0xa
setl al
or al, cl
movzx ecx, word [rdx]
cmp ecx, 0x5a4d
jne 0x14000106a
movsxd r12, dword [rdx + 0x3c]
movzx ecx, word [rdx + r12 + 4]
cmp ecx, 0x8664
jne 0x140001077
mov esi, r9d
mov qword [rsp + 0x50], rdx
add r12, rdx
test al, al
je 0x1400010cb
jmp 0x140001084
test al, al
je 0x1400015d7
jmp 0x1400015ae
test al, al
je 0x14000160e
jmp 0x1400015e5
lea rcx, str.File_ok_n
call fcn.140002950
mov r8d, dword [r12 + 0x50]
mov dword [rsp + 0x20], 4
mov rcx, rdi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
cmp dword [0x14000f914], 0xa
jl 0x1400010f7
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400010f7
lea rcx, str.File_ok_n
call fcn.140002950
mov r8d, dword [r12 + 0x50]
mov dword [rsp + 0x20], 4
mov rcx, rdi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jmp 0x140001084
test rbx, rbx
je 0x1400013e3
mov byte [rsp + 0x47], sil
movzx eax, byte [rsp + 0x190]
mov dword [rsp + 0x60], eax
lea r14, [rsp + 0xe0]
lea rax, [rsp + 0x6c]
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov r15, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x6c], 0
mov r8d, dword [r12 + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
mov r9d, 0x40
call rsi
movups xmmword [r14 + 0x10], xmm6
mov r12, r14
movups xmmword [r14], xmm6
mov r14, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xc0], r14
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc8], rbp
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], rbx
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0xe8], eax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xf0], rax
mov esi, dword [rsp + 0x60]
mov dword [rsp + 0xf8], esi
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r13, rdi
mov rcx, rdi
mov rdx, rbx
mov r8, qword [rsp + 0x50]
call r15
mov edx, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea ebx, [rdx - 1]
imul ebx, edx
cmp ecx, 0xa
jl 0x1400012d2
mov edi, ebx
and edi, 1
je 0x1400012d2
mov dword [rsp + 0x6c], 0
mov rax, qword [rsp + 0x58]
mov r8d, dword [rax + 0x50]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x20], rax
mov rdi, r13
mov rcx, r13
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
mov r9d, 0x40
mov r15d, esi
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rsi
movups xmmword [r12 + 0x10], xmm6
movups xmmword [r12], xmm6
mov qword [rsp + 0xc0], r14
mov qword [rsp + 0xc8], rbp
mov r13, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], rbx
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0xe8], eax
mov rbp, qword [rsp + 0x1a0]
mov r14, r12
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0xf0], rbp
mov dword [rsp + 0xf8], r15d
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, rdi
mov rdx, rbx
mov r8, qword [rsp + 0x50]
mov r15, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call r15
lea rax, [rsp + 0x6c]
jmp 0x140001140
test eax, eax
je 0x14000146e
mov rbp, qword [rsp + 0x58]
lea rdi, [rbp + 0x18]
cmp word [rbp + 6], 0
sete r15b
mov r14, qword [rsp + 0x38]
mov qword [rsp + 0x78], rdi
je 0x1400014f8
cmp ecx, 0xa
setl r8b
test bl, 1
sete al
or al, r8b
movzx ebp, word [rbp + 0x14]
add rdi, rbp
add rdi, 0x14
xor esi, esi
mov r12, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140001367
test eax, eax
je 0x14000152c
add esi, 1
lea eax, [rdx - 1]
imul eax, edx
test al, 1
sete bl
cmp ecx, 0xa
setl al
or al, bl
mov rbp, qword [rsp + 0x58]
movzx ebp, word [rbp + 6]
add rdi, 0x28
cmp esi, ebp
sete r15b
je 0x1400014ff
mov ebp, dword [rdi - 4]
test rbp, rbp
je 0x140001338
test al, 1
mov rbx, qword [rsp + 0x50]
je 0x1400013c3
nop dword [rax + rax]
mov edx, dword [rdi - 8]
mov r8d, dword [rdi]
add r8, rbx
add rdx, r14
mov qword [rsp + 0x20], 0
mov rcx, r13
mov r9, rbp
call r12
mov edx, dword [0x14000f918]
mov ecx, dword [0x14000f914]
cmp ecx, 0xa
jl 0x140001330
lea ebx, [rdx - 1]
imul ebx, edx
and ebx, 1
mov rbx, qword [rsp + 0x50]
je 0x140001330
mov edx, dword [rdi - 8]
mov r8d, dword [rdi]
add r8, rbx
add rdx, r14
mov qword [rsp + 0x20], 0
mov rcx, r13
mov r9, rbp
call r12
jmp 0x140001380
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Target_process_memory_allocation_failed__ex__0x_X_n
mov edx, eax
call fcn.140002950
xor r12d, r12d
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rsi, str.Target_process_memory_allocation_failed__ex__0x_X_n
nop word [rax + rax]
call rdi
mov rcx, rsi
mov edx, eax
call fcn.140002950
call rdi
mov rcx, rsi
mov edx, eax
call fcn.140002950
xor r12d, r12d
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x140001430
jmp 0x14000161c
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, str.Cant_write_file_header_0x_X_n
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rsi, qword [rsp + 0x38]
nop dword [rax + rax]
call r14
mov rcx, rbx
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, r13
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x8000
call rdi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call r14
mov rcx, rbx
mov edx, eax
call fcn.140002950
mov rcx, r13
mov rsi, qword [rsp + 0x38]
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x8000
call rdi
jmp 0x140001490
mov r12, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
test r15b, 1
je 0x140001524
cmp ecx, 0xa
jl 0x14000163b
test eax, eax
jne 0x140001677
jmp 0x14000163b
xor r12d, r12d
jmp 0x14000161c
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, str.Cant_map_sections:_0x_x_n
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop word cs:[rax + rax]
nop dword [rax + rax]
call rsi
mov rcx, rbx
mov edx, eax
call fcn.140002950
mov rcx, r13
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
mov edx, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea eax, [rdx - 1]
imul eax, edx
and eax, 1
cmp ecx, 0xa
jl 0x140001508
test eax, eax
je 0x140001508
call rsi
mov rcx, rbx
mov edx, eax
call fcn.140002950
mov rcx, r13
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
jmp 0x140001550
lea rcx, str.Invalid_file_n
call fcn.140002950
xor r12d, r12d
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
lea rcx, str.Invalid_file_n
call fcn.140002950
jmp 0x1400015ae
lea rcx, str.Invalid_platform_n
call fcn.140002950
xor r12d, r12d
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
lea rcx, str.Invalid_platform_n
call fcn.140002950
jmp 0x1400015e5
mov eax, r12d
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x20], 4
mov r8d, 0x40
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
cmp dword [0x14000f914], 0xa
jl 0x140001698
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140001698
mov dword [rsp + 0x20], 4
mov r8d, 0x40
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
jmp 0x14000163b
test rbx, rbx
je 0x1400019b2
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0xc0]
mov r9d, 0x40
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [0x14000f914], 0xa
jl 0x140001740
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x140001740
lea rbp, [rsp + 0xc0]
nop word cs:[rax + rax]
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, r13
mov rdx, rbx
mov r8, rbp
call r12
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, r13
mov rdx, rbx
mov r8, rbp
call r12
cmp dword [0x14000f914], 0xa
jl 0x140001740
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x1400016f0
test eax, eax
je 0x140001a36
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
cmp dword [0x14000f914], 0xa
jl 0x1400017e3
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400017e3
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop dword [rax + rax]
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call rsi
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1000
mov rcx, r13
xor edx, edx
mov r9d, 0x3000
call rsi
mov rdi, rax
cmp dword [0x14000f914], 0xa
jl 0x1400017e3
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x140001790
test rdi, rdi
je 0x140001eea
mov qword [rsp + 0x20], 0
lea r8, str.AWAVAUATVWUSH
mov r9d, 0x1000
mov rcx, r13
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [0x14000f914], 0xa
jl 0x14000187f
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x14000187f
lea rbp, str.AWAVAUATVWUSH
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, r13
mov rdx, rdi
mov r8, rbp
call r12
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, r13
mov rdx, rdi
mov r8, rbp
call r12
cmp dword [0x14000f914], 0xa
jl 0x14000187f
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
jne 0x14000182f
test eax, eax
mov qword [rsp + 0x50], rdi
je 0x140001f8b
lea r14, str.Mapped_DLL_at__p_n
lea rbp, str.Mapping_info_at__p_n
lea rsi, str.Data_allocated_n
mov r15, qword [rsp + 0x38]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], r13
mov r12, r14
mov rcx, r14
mov rdx, r15
call fcn.140002950
mov r15, rbp
mov rcx, rbp
mov rdx, rbx
call fcn.140002950
lea rbp, str.Shell_code_at__p_n
mov rcx, rbp
mov rdx, rdi
call fcn.140002950
mov rcx, rsi
call fcn.140002950
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rcx, r13
xor edx, edx
xor r8d, r8d
mov r13, rdi
mov r9, rdi
mov rbx, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rbx
mov rsi, rax
cmp dword [0x14000f914], 0xa
jl 0x140001adb
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140001adb
mov rsi, rbp
mov r14, r12
mov rcx, r12
mov r12, rbx
mov rdi, qword [rsp + 0x38]
mov rdx, rdi
call fcn.140002950
mov rbp, r15
mov rcx, r15
mov rbx, qword [rsp + 0x60]
mov r15, rdi
mov rdx, rbx
call fcn.140002950
mov rcx, rsi
lea rsi, str.Data_allocated_n
mov rdi, r13
mov rdx, r13
call fcn.140002950
mov rcx, rsi
call fcn.140002950
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r13, qword [rsp + 0x48]
mov rcx, r13
xor edx, edx
xor r8d, r8d
mov r9, rdi
call r12
jmp 0x1400018b0
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbx, str.Target_process_mapping_allocation_failed__ex__0x_X_n
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop word [rax + rax]
call rsi
mov rcx, rbx
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, r13
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call rsi
mov rcx, rbx
mov edx, eax
call fcn.140002950
mov rcx, r13
mov r14, qword [rsp + 0x38]
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
jmp 0x1400019d0
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str.Cant_write_mapping_0x_X_n
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop dword [rax + rax]
call rsi
mov rcx, rbp
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, r13
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rdi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call rsi
mov rcx, rbp
mov edx, eax
call fcn.140002950
mov rcx, r13
mov r14, qword [rsp + 0x38]
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rdi
jmp 0x140001a50
test rsi, rsi
je 0x140002059
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Thread_created_at:__p__waiting_for_return..._n
mov rdx, r13
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x140001b6d
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x140001b6d
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbp, str.Thread_created_at:__p__waiting_for_return..._n
mov rcx, rsi
call r15
mov rcx, rbp
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
call fcn.140002950
mov rcx, rsi
call r15
mov rcx, rbp
mov rdx, rdi
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x140001b6d
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
jne 0x140001b28
xor r14d, r14d
lea rsi, [rsp + 0x68]
xorps xmm6, xmm6
jmp 0x140001b8e
xor r14d, r14d
xor r12d, r12d
test r15d, r15d
lea rsi, [rsp + 0x68]
jne 0x14000161c
lea r12d, [rdi - 1]
imul r12d, edi
and r12d, 1
sete al
cmp r13d, 0xa
setl bl
or bl, al
test r14, r14
jne 0x14000212f
test bl, bl
mov rbx, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rdi, qword [rsp + 0x48]
je 0x140001bed
mov dword [rsp + 0x68], 0
mov rcx, rdi
mov rdx, rsi
call rbx
mov ebp, dword [rsp + 0x68]
cmp dword [0x14000f914], 0xa
jl 0x140001bff
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140001bff
mov dword [rsp + 0x68], 0
mov rcx, rdi
mov rdx, rsi
call rbx
jmp 0x140001bbf
cmp ebp, 0x103
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
lea r13, [rsp + 0x80]
mov r15, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jne 0x140001cdf
nop word cs:[rax + rax]
nop
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rdi
mov rbx, rsi
mov rdx, rsi
mov r8, r13
call r15
mov r14, qword [rsp + 0xa0]
mov edx, dword [0x14000f918]
mov eax, dword [0x14000f914]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140001d5b
test ecx, ecx
je 0x140001d5b
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rdi
mov rsi, rbx
mov rdx, rbx
mov r8, r13
call r15
jmp 0x140001c30
lea rsi, str.Process_crashed__exit_code:__d_n
mov rcx, rsi
mov edx, ebp
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
mov r15d, 1
cmp r13d, 0xa
jl 0x140001b7a
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x140001b7a
nop dword [rax]
mov rcx, rsi
mov edx, ebp
call fcn.140002950
mov rcx, rsi
mov edx, ebp
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x140001b7a
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
jne 0x140001d20
jmp 0x140001b7a
cmp r14, 0x505050
je 0x140001e5f
cmp r14, 0x404040
mov r13, rbx
lea r15, str.Wrong_mapping_ptr_n
mov rbp, qword [rsp + 0x38]
jne 0x140001ea0
nop word cs:[rax + rax]
nop
mov rbx, r15
mov rcx, r15
call fcn.140002950
mov rcx, rdi
mov rdx, rbp
xor r8d, r8d
mov r9d, 0x8000
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rsi
mov rcx, rdi
mov rdx, r13
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rdi
mov rdx, r12
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
mov r15d, 1
cmp r13d, 0xa
jl 0x140001b7d
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x140001b7d
mov r15, rbx
mov rcx, rbx
call fcn.140002950
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
mov rbp, qword [rsp + 0x38]
mov rdx, rbp
xor r8d, r8d
mov r9d, 0x8000
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
call rsi
mov rcx, rdi
mov r13, qword [rsp + 0x60]
mov rdx, r13
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rdi
mov r12, qword [rsp + 0x50]
mov rdx, r12
xor r8d, r8d
mov r9d, 0x8000
call rsi
jmp 0x140001d90
lea rsi, str.WARNING:_Exception_support_failed__n
nop word cs:[rax + rax]
mov rcx, rsi
call fcn.140002950
mov edx, dword [0x14000f918]
mov eax, dword [0x14000f914]
lea ecx, [rdx - 1]
imul ecx, edx
and ecx, 1
cmp eax, 0xa
jl 0x140001ea0
test ecx, ecx
je 0x140001ea0
mov rcx, rsi
call fcn.140002950
jmp 0x140001e70
cmp eax, 0xa
jl 0x140001ea9
test ecx, ecx
jne 0x140001edd
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
xor r15d, r15d
cmp r13d, 0xa
jl 0x140001b7d
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x140001b7d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001ea9
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea rbp, str.Memory_shellcode_allocation_failed__ex__0x_X_n
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
call rsi
mov rcx, rbp
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, r13
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rdi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call rsi
mov rcx, rbp
mov edx, eax
call fcn.140002950
mov rcx, r13
mov r14, qword [rsp + 0x38]
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rdi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rdi
jmp 0x140001f00
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r14, str.Cant_write_shellcode_0x_X_n
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rbp, qword [rsp + 0x38]
call r15
mov rcx, r14
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, r13
mov rdx, rbp
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, r13
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call rsi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call r15
mov rcx, r14
mov edx, eax
call fcn.140002950
mov rcx, r13
mov rbp, qword [rsp + 0x38]
mov rdx, rbp
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, r13
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, r13
mov rdi, qword [rsp + 0x50]
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call rsi
jmp 0x140001fa5
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r15, str.Thread_creation_failed_0x_X_n
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
call rdi
mov rcx, r15
mov edx, eax
call fcn.140002950
xor r12d, r12d
mov rcx, rbp
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rbp
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rbp
mov rdx, r13
xor r8d, r8d
mov r9d, 0x8000
call rsi
cmp dword [0x14000f914], 0xa
jl 0x14000161c
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x14000161c
call rdi
mov rcx, r15
mov edx, eax
call fcn.140002950
mov rcx, rbp
mov rbx, qword [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rbp
mov rdx, r14
xor r8d, r8d
mov r9d, 0x8000
call rsi
mov rcx, rbp
mov r13, qword [rsp + 0x50]
mov rdx, r13
xor r8d, r8d
mov r9d, 0x8000
call rsi
jmp 0x14000207d
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14000216a
mov r8d, 0x1400000
mov qword [rsp + 0x70], rax
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
cmp byte [rsp + 0x47], 0
mov rsi, qword [rsp + 0x78]
je 0x1400021f0
test bl, bl
je 0x1400021c2
jmp 0x14000217a
test bl, bl
mov rbx, rax
je 0x140002647
jmp 0x140002619
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
lea r12d, [rdi - 1]
imul r12d, edi
and r12d, 1
cmp r13d, 0xa
jl 0x1400021e8
test r12d, r12d
je 0x1400021e8
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x14000217a
test eax, eax
je 0x14000259d
cmp byte [rsp + 0x180], 0
je 0x1400023a3
mov rax, qword [rsp + 0x58]
cmp word [rax + 6], 0
je 0x140002397
movzx r14d, word [rax + 0x14]
add r14, rsi
xor r15d, r15d
lea r12, str.Processing__s_removal_n
jmp 0x140002250
test eax, eax
mov rsi, qword [rsp + 0x78]
mov rbx, qword [sym.imp.KERNEL32.dll_GetLastError]
je 0x14000233f
add r15d, 1
add r14, 0x28
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 6]
cmp r15d, eax
je 0x140002397
cmp dword [r14 + 8], 0
je 0x140002236
cmp byte [rsp + 0x190], 0
jne 0x140002274
mov rcx, r14
lea rdx, [0x14000c71f]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000229a
mov rcx, r14
lea rdx, str..rsrc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000229a
mov rcx, r14
lea rdx, str..reloc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140002236
mov rsi, qword [rsp + 0x38]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x48]
mov rcx, r12
mov rdx, r14
call fcn.140002950
mov r9d, dword [r14 + 8]
mov edx, dword [r14 + 0xc]
add rdx, rsi
mov qword [rsp + 0x20], 0
mov rcx, rbp
mov r8, rbx
call rdi
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x140002222
lea ecx, [rdi - 1]
imul ecx, edi
and ecx, 1
je 0x140002222
mov rcx, r12
mov rdx, r14
call fcn.140002950
mov r9d, dword [r14 + 8]
mov edx, dword [r14 + 0xc]
mov rsi, qword [rsp + 0x38]
add rdx, rsi
mov qword [rsp + 0x20], 0
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
mov rbx, qword [rsp + 0x70]
mov r8, rbx
mov rdi, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rdi
jmp 0x1400022b0
call rbx
lea rcx, str.Cant_clear_section__s:_0x_x_n
mov rdx, r14
mov r8d, eax
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x140002236
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x140002236
call rbx
lea rdi, str.Cant_clear_section__s:_0x_x_n
mov rcx, rdi
mov rdx, r14
mov r8d, eax
call fcn.140002950
call rbx
mov rcx, rdi
jmp 0x140002348
lea r12d, [rdi - 1]
imul r12d, edi
and r12d, 1
mov r15, qword [rsp + 0x60]
cmp byte [rsp + 0x188], 0
je 0x1400026eb
mov rdx, qword [rsp + 0x58]
cmp word [rdx + 6], 0
je 0x140002563
cmp r13d, 0xa
setl cl
lea eax, [rdi - 1]
imul eax, edi
test al, 1
sete al
or al, cl
movzx ecx, word [rdx + 0x14]
add rsi, rcx
xor r15d, r15d
mov r14, qword [rsp + 0x38]
jmp 0x140002419
add r15d, 1
add rsi, 0x28
lea eax, [rdi - 1]
imul eax, edi
test al, 1
sete cl
cmp r13d, 0xa
setl al
or al, cl
mov rcx, qword [rsp + 0x58]
movzx ecx, word [rcx + 6]
cmp r15d, ecx
je 0x140002563
mov ecx, dword [rsi + 8]
test ecx, ecx
je 0x1400023eb
mov dword [rsp + 0x80], 0
mov edx, dword [rsi + 0x24]
test edx, 0x20000000
mov ebp, 0x20
mov ebx, 2
cmove ebp, ebx
test edx, edx
mov edx, 4
cmovs ebp, edx
test al, 1
mov rbx, rsi
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r12, [rsp + 0x80]
mov r13, qword [rsp + 0x48]
je 0x1400024ae
mov r8d, ecx
mov rsi, rbx
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, r13
mov r9d, ebp
call rdi
cmp dword [0x14000f914], 0xa
jl 0x1400024c9
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400024c9
mov rbx, rsi
mov ecx, dword [rsi + 8]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r12, [rsp + 0x80]
mov r8d, ecx
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, r13
mov r9d, ebp
call rdi
mov ecx, dword [rbx + 8]
jmp 0x140002466
test eax, eax
je 0x140002518
lea rbx, str.section__s_set_as__lX_n
mov rcx, rbx
mov rdx, rsi
mov r8d, ebp
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x1400023eb
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x1400023eb
mov rcx, rbx
mov rdx, rsi
mov r8d, ebp
call fcn.140002950
jmp 0x1400024d4
lea r12, str.FAIL:_section__s_not_set_as__lX_n
mov rcx, r12
mov rdx, rsi
mov r8d, ebp
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
cmp r13d, 0xa
jl 0x1400023eb
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
je 0x1400023eb
mov rcx, r12
mov rdx, rsi
mov r8d, ebp
call fcn.140002950
jmp 0x14000251f
cmp r13d, 0xa
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
lea rbx, [rsp + 0x80]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x48]
jl 0x140002655
lea eax, [rdi - 1]
imul eax, edi
and eax, 1
jne 0x1400026bb
jmp 0x140002655
lea rcx, str.WARNING_:_Cant_clear_HEADER_n
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
lea r12d, [rdi - 1]
imul r12d, edi
and r12d, 1
cmp r13d, 0xa
jl 0x1400021f0
test r12d, r12d
je 0x1400021f0
lea rbp, str.WARNING_:_Cant_clear_HEADER_n
mov rcx, rbp
call fcn.140002950
mov rcx, rbp
call fcn.140002950
mov edi, dword [0x14000f918]
mov r13d, dword [0x14000f914]
lea r12d, [rdi - 1]
imul r12d, edi
and r12d, 1
cmp r13d, 0xa
jl 0x1400021f0
test r12d, r12d
jne 0x1400025dc
jmp 0x1400021f0
lea rcx, str.Unable_to_allocate_memory_n
call fcn.140002950
cmp dword [0x14000f914], 0xa
jl 0x1400028e2
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400028e2
lea rcx, str.Unable_to_allocate_memory_n
call fcn.140002950
jmp 0x140002619
mov dword [rsp + 0x80], 0
movzx eax, word [rbp + 0x14]
mov r8d, dword [rbp + rax + 0x24]
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rsi
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [0x14000f918]
mov r13d, dword [0x14000f914]
lea r12d, [rax - 1]
imul r12d, eax
and r12d, 1
cmp r13d, 0xa
jl 0x1400026eb
test r12d, r12d
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x58]
lea rbx, [rsp + 0x80]
mov r14, qword [rsp + 0x48]
je 0x1400026f0
mov dword [rsp + 0x80], 0
movzx eax, word [rbp + 0x14]
mov r8d, dword [rbp + rax + 0x24]
mov qword [rsp + 0x20], rbx
mov rcx, r14
mov rdx, rsi
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x140002655
mov r14, qword [rsp + 0x48]
cmp r13d, 0xa
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x70]
jl 0x140002705
test r12d, r12d
jne 0x140002741
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rbp - 1]
imul edx, ebp
and edx, 1
cmp ecx, 0xa
jl 0x140002761
test edx, edx
je 0x140002761
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rcx, r14
mov rdx, rsi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x140002705
test eax, eax
je 0x140002779
cmp ecx, 0xa
mov rsi, qword [rsp + 0x50]
jl 0x1400027da
test edx, edx
jne 0x14000280d
jmp 0x1400027da
lea rcx, str.WARNING:_Cant_clear_shellcode_n
call fcn.140002950
mov eax, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140002765
test edx, edx
je 0x140002765
lea rsi, str.WARNING:_Cant_clear_shellcode_n
mov rcx, rsi
call fcn.140002950
mov rcx, rsi
call fcn.140002950
mov eax, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140002765
test edx, edx
jne 0x1400027aa
jmp 0x140002765
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ebp, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rbp - 1]
imul edx, ebp
and edx, 1
cmp ecx, 0xa
jl 0x140002824
test edx, edx
je 0x140002824
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1400027da
test eax, eax
je 0x140002837
cmp ecx, 0xa
jl 0x140002898
test edx, edx
jne 0x1400028c7
jmp 0x140002898
lea rcx, str.WARNING:_cant_release_shell_code_memory_n
call fcn.140002950
mov eax, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140002828
test edx, edx
je 0x140002828
lea rsi, str.WARNING:_cant_release_shell_code_memory_n
mov rcx, rsi
call fcn.140002950
mov rcx, rsi
call fcn.140002950
mov eax, dword [0x14000f918]
mov ecx, dword [0x14000f914]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
cmp ecx, 0xa
jl 0x140002828
test edx, edx
jne 0x140002868
jmp 0x140002828
mov rcx, r14
mov rdx, r15
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [0x14000f914], 0xa
jl 0x1400028de
mov ecx, dword [0x14000f918]
lea edx, [rcx - 1]
imul edx, ecx
and edx, 1
je 0x1400028de
mov rcx, r14
mov rdx, r15
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x140002898
test eax, eax
je 0x1400028ee
test rbx, rbx
setne r12b
jmp 0x14000161c
lea rcx, str.WARNING:_cant_release_mapping_data_memory_n
call fcn.140002950
cmp dword [0x14000f914], 0xa
jl 0x1400028e2
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400028e2
lea rsi, str.WARNING:_cant_release_mapping_data_memory_n
mov rcx, rsi
call fcn.140002950
mov rcx, rsi
call fcn.140002950
cmp dword [0x14000f914], 0xa
jl 0x1400028e2
mov eax, dword [0x14000f918]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x14000291b
jmp 0x1400028e2