Function at 0x180004b50
Capabilities:
Access peb ldr_data
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x180047080]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov qword [rbp - 0x19], rcx
movsd xmm0, qword [0x18003fbc8]
movsd qword [rbp + 0x17], xmm0
mov eax, dword [0x18003fbd0]
mov dword [rbp + 0x1f], eax
movzx eax, word [0x18003fbd4]
mov word [rbp + 0x23], ax
movzx eax, byte [0x18003fbd6]
mov byte [rbp + 0x25], al
movsd xmm0, qword [str.CreateEventW]
movsd qword [rbp + 7], xmm0
mov eax, dword [0x18003fbe0]
mov dword [rbp + 0xf], eax
movzx eax, byte [0x18003fbe4]
mov byte [rbp + 0x13], al
mov dword [rbp - 0x29], 0x1f04
xor r13d, r13d
mov qword [rbp - 9], r13
mov rsi, qword gs:[0x60]
mov rax, qword [rsi + 0x18]
add rax, 0x20
mov rbx, qword [rax]
cmp rbx, rax
je 0x180004c29
nop dword [rax + rax]
lea rdx, str.KERNELBASE.dll
mov rcx, qword [rbx + 0x40]
call fcn.1800109ac
test rax, rax
jne 0x180004cc7
mov rbx, qword [rbx]
mov rax, qword [rsi + 0x18]
add rax, 0x20
cmp rbx, rax
jne 0x180004c00
lea rdx, str.wRLbKgZxqJBipHAndFkSODGNhIz
lea rcx, [0x180048780]
call fcn.18000a0f0
mov rcx, rax
lea rdx, [rbp + 0x17]
call fcn.18000a0f0
mov rcx, rax
call fcn.18000a3a0
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180004c95
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180004c85
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800051be
mov rcx, r8
call fcn.18000eb40
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xfffffffe
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.18000eb20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbx + 0x20]
test rbx, rbx
je 0x180004c29
lea rdx, str.VXKrlSkGFnjhsWRDCgvQPLtdiTZmxzyboJONEIB
lea rcx, [0x180048780]
call fcn.18000a0f0
mov rcx, rax
call fcn.18000a3a0
lea rdx, str.CreateEventW
mov rcx, rbx
call fcn.180003ad0
mov r14, rax
lea rcx, [0x180048780]
test rax, rax
jne 0x180004d28
lea rdx, str.yARVPXBugZl
call fcn.18000a0f0
mov rcx, rax
xor edx, edx
call fcn.180006700
jmp 0x180004c48
lea rdx, str.KGOYEfv
call fcn.18000a0f0
mov rcx, rax
mov rdx, r14
call fcn.180006700
mov rcx, rax
call fcn.18000a3a0
mov edx, 0x1f04
lea rcx, str.sjvzCJTUVyewMgSGi
call fcn.180001320
xor edx, edx
mov ecx, 0x1fffff
mov r8d, 0x1f04
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp - 0x21], rax
lea r8, [rbp - 0x29]
lea rcx, [rbp - 0x21]
call fcn.180004650
mov edx, dword [rbp - 0x29]
cmp qword [rbp - 0x21], r13
jne 0x180004d96
lea rcx, str.nNkFzAlYdjcaiGrXxVtgTWbfKuq
call fcn.180001320
jmp 0x180004e1b
lea rcx, str.UqTotuinkNPxeW
call fcn.180001320
lea rcx, str.WufaQnHtgIzTGjbZC
call fcn.180001320
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
mov r12, qword [rbp - 0x21]
mov rsi, r14
and rsi, 0xfffffffffff70000
sub rsi, 0x70000000
lea rbx, [r14 + 0x70000000]
cmp rsi, rbx
jae 0x180004e0e
add eax, 0x38
movsxd r15, eax
nop dword [rax]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r15
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
jne 0x180004e69
add rsi, 0x10000
cmp rsi, rbx
jb 0x180004de0
lea rcx, str.AbsWBeOzZEL
call fcn.180001320
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180004e5f
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180004e4f
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800051be
mov rcx, r8
call fcn.18000eb40
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov eax, 0xffffff9d
jmp 0x180004c9a
mov rdx, rsi
lea rcx, str.YNDJcr
call fcn.180001320
test rsi, rsi
je 0x180004e0e
lea rdx, str.OaMY
lea rcx, [0x180048780]
call fcn.18000a0f0
mov rcx, rax
call fcn.18000a3a0
lea rdx, [rbp + 7]
lea rcx, str.HiqMWtKJXrVpyuYmeN
call fcn.180001320
mov rbx, qword [r14]
mov r8, rbx
mov rdx, r14
lea rcx, str.oCMXIPxiABNcGZYvdKEQLhfpzFqwTgrybWUS
call fcn.180001320
lea rcx, str.SGHcJYranZMfVCmjigQhIuEXtFWyolADLTNsBdKvbekROPqx
call fcn.180001320
mov qword [0x180047ce2], rbx
lea rcx, str.pyVaTYUlcqFGfJkS
call fcn.180001320
lea rdx, [rbp + 7]
lea rcx, str.oJsNpIRwgSumblDZyLMHBztdxahOTAckGifFQVnXeEC
call fcn.180001320
mov dword [rbp - 0x11], r13d
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, r14
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x180004f20
lea rcx, str.xowPWTCjSvIspkLaErM
jmp 0x180004e15
lea rdx, [rbp + 7]
lea rcx, str.LGqFkeDTKCYgWwOtyfiEcINJsproAnhZBm
call fcn.180001320
lea rcx, str.aPnbCkMVmTwUOBFfsyjdtWlKXucISqRDEZA
call fcn.180001320
mov eax, esi
sub eax, r14d
sub eax, 5
mov byte [rbp - 1], 0xe8
mov dword [rbp], eax
mov qword [rsp + 0x20], r13
mov r9d, 0x40
lea r8d, [r9 - 0x3b]
lea rdx, [rbp - 1]
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8, [rbp - 1]
mov rdx, r14
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [rbp + 7]
test eax, eax
jne 0x180004fa1
lea rcx, str.EsrDLNqJSnbMoVyGYFfxjZBOQkzuPITHgUaheCcXwRWvtAlmKp
call fcn.180001320
jmp 0x180004e1b
lea rcx, str.RgobXEz
call fcn.180001320
mov r14, qword [rdi + 8]
sub r14, qword [rdi]
add r14d, 0x38
lea rdx, str.CaJWfTOxBkLwqZvlGUzVMouSKeRQdHcmINb
lea rcx, [0x180048780]
call fcn.18000a0f0
mov rcx, rax
mov edx, r14d
call fcn.180007100
mov rcx, rax
call fcn.18000a3a0
movsxd r15, r14d
mov rcx, r15
call fcn.18000ee4c
mov rbx, rax
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
sub r8, rcx
add rax, 0x37
lea rdx, [0x180047d07]
cmp rbx, rdx
ja 0x180005033
lea r10, [0x180047cd0]
cmp rax, r10
jb 0x180005033
mov rdx, rbx
sub r10, rbx
mov r9d, 0x38
nop
movzx eax, byte [r10 + rdx]
mov byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180005020
jmp 0x180005060
movups xmm0, xmmword [0x180047cd0]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x180047ce0]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [0x180047cf0]
movups xmmword [rbx + 0x20], xmm0
movsd xmm1, qword [0x180047d00]
movsd qword [rbx + 0x30], xmm1
test r8, r8
je 0x180005081
mov rdx, rbx
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x38], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x180005070
lea rdx, str.KJHAkoOTsgjfnNhrEqtPipuRxVeCLyIFdSaZBGUwYzXmbv
lea rcx, [0x180048780]
call fcn.18000a0f0
mov rcx, rax
mov edx, r14d
call fcn.180007100
mov rcx, rax
lea rdx, str.NPzd
call fcn.18000a0f0
mov rdx, rbx
mov rcx, rax
call fcn.18000a0f0
mov rcx, rax
call fcn.18000a3a0
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, r15
mov rdx, rsi
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, rsi
test eax, eax
jne 0x1800050f8
lea rcx, str.NPzKt
call fcn.180001320
jmp 0x180004e1b
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, rbx
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, rsi
test eax, eax
jne 0x180005129
lea rcx, str.xkceuAnSBGfKPRtiThZwqMmbvIHloYzJXgrD
call fcn.180001320
jmp 0x180004e1b
movsxd r8, r14d
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18000515d
mov rdx, rsi
lea rcx, str.DEkHO
call fcn.180001320
jmp 0x180004e1b
lea rcx, [0x18003fec8]
call fcn.180001320
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x180004c9a
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800051a9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800051be
mov rcx, r8
call fcn.18000eb40
mov qword [rdi], r13
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
jmp 0x180004c9a
call fcn.180018bc4
int3