Function at 0x1400a8e40
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
xor r13d, r13d
mov byte [rsp + 0x65], 0
xor eax, eax
mov qword [rbp - 0x30], r13
lea rdi, [rbp - 0x10]
mov dword [rbp - 0x80], r13d
mov ecx, 0x104
mov dword [rsp + 0x70], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp - 0x10]
mov dword [rsp + 0x74], 0xd18b4c00
mov word [rsp + 0x78], 0x50f
mov byte [rsp + 0x7a], 0xc3
mov qword [rbp + 0x260], r13
mov qword [rbp + 0x258], r13
mov qword [rbp + 0x268], r13
mov dword [rbp - 0x5c], r13d
mov dword [rbp - 0x44], r13d
cmp word [rbp - 0x10], r13w
je 0x1400a8eca
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x1400a8ec0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400a8ee0
mov word [rax], r13w
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r13w
je 0x1400a8f0a
nop
add rax, 2
cmp word [rax], r13w
jne 0x1400a8f00
lea rdx, [0x14013d920]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400a8f20
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r13w
je 0x1400a8f4e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400a8f42
add cx, cx
mov dword [rbp - 0x60], 0x30
mov word [rbp - 0x70], cx
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
add cx, 2
mov word [rbp - 0x6e], cx
lea rax, [rbp - 0x70]
movaps xmm0, xmmword [rbp - 0x70]
mov r14, r13
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x58], r13
mov dword [rbp - 0x48], 0x40
mov qword [rbp - 0x50], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a8fd1
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a8fc3
call fcn.1400a7710
test rax, rax
jne 0x1400a8fcd
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a8fb0
jmp 0x1400a8fd1
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x1400a9076
cmp word [r9], r15w
jne 0x1400a9076
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a9076
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a9076
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a9076
nop
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a906a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a9060
sub rcx, rsi
test al, al
je 0x1400a905b
cmp byte [rdx], r13b
je 0x1400a9060
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a9044
jmp 0x1400a9060
cmp byte [rdx], r13b
je 0x1400a90b2
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a90b2
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a9030
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a90c7
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a90a8
call fcn.1400a7710
test rax, rax
jne 0x1400a90c3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9095
jmp 0x1400a90c7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400a9079
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400a9167
cmp word [r9], r15w
jne 0x1400a9167
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a9167
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a9167
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a9167
nop
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400a915b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400a9151
sub rax, rsi
test dl, dl
je 0x1400a914c
cmp byte [rcx], r13b
je 0x1400a9151
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400a9135
jmp 0x1400a9151
cmp byte [rcx], r13b
je 0x1400a91a3
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400a91a3
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a9120
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a91b8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9199
call fcn.1400a7710
test rax, rax
jne 0x1400a91b4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9186
jmp 0x1400a91b8
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x1400a916a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x1400a92f2
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a92f2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a92f2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a92f2
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a92f2
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a925b
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a9251
sub rcx, rsi
test al, al
je 0x1400a924c
cmp byte [rdx], r13b
je 0x1400a9251
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a9235
jmp 0x1400a9251
cmp byte [rdx], r13b
je 0x1400a926c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a926c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a9221
jmp 0x1400a92f2
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400a92f2
test r15, r15
je 0x1400a92f2
test r12, r12
je 0x1400a92f2
lea r8, [rbp - 0x60]
mov edx, 4
lea rcx, [rbp + 0x258]
call r12
test eax, eax
js 0x1400a92f2
mov rcx, qword [rbp + 0x258]
lea rax, [rbp + 0x268]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x260]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x1400a92f2
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x1400a92f2
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a9331
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9323
call fcn.1400a7710
test rax, rax
jne 0x1400a932d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9310
jmp 0x1400a9331
lea r14, [rdi - 0x10]
mov rsi, qword [rbp + 0x260]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x1400a94df
test r14, r14
je 0x1400a94df
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x1400a93fe
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400a93fe
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400a93fe
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x1400a93fe
lea rbx, str.NtSetInformationThread
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rbx
add rcx, rsi
je 0x1400a93f2
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a93e4
sub rcx, rbx
test al, al
je 0x1400a93db
cmp byte [rdx], r13b
je 0x1400a93e4
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a93c4
jmp 0x1400a93e4
cmp byte [rdx], r13b
je 0x1400a947c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a947c
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400a93b0
mov r9, r13
cmp word [r14], r12w
jne 0x1400a94ab
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400a94ab
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400a94ab
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x1400a94ab
nop dword [rax]
mov eax, dword [rdi]
mov rcx, r15
add rax, r14
je 0x1400a949f
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400a9495
sub rax, r15
test dl, dl
je 0x1400a9490
cmp byte [rcx], r13b
je 0x1400a9495
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400a9465
jmp 0x1400a9495
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x1400a9401
cmp byte [rcx], r13b
je 0x1400a94c1
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400a94c1
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a9450
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x1400a94d1
call rax
jmp 0x1400a94e5
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x1400a94ae
movzx r13d, word [r9 + 4]
mov dword [rsp + 0x68], r13d
call rax
jmp 0x1400a94ea
mov r12d, 0x5a4d
mov dword [rsp + 0x68], r13d
xor r15d, r15d
mov word [rsp + 0x50], r13w
xor eax, eax
mov qword [rbp + 0x260], r15
lea rdi, [rbp - 0x10]
mov qword [rbp + 0x258], r15
mov ecx, 0x104
mov qword [rbp + 0x268], r15
rep stosb byte [rdi], al
lea rax, [rbp - 0x10]
mov dword [rbp - 0x5c], r15d
mov dword [rbp - 0x44], r15d
cmp word [rbp - 0x10], r15w
je 0x1400a953a
nop dword [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400a9530
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400a9550
mov word [rax], r15w
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r15w
je 0x1400a957a
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400a9570
lea rdx, [0x14013d920]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400a9590
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r15w
je 0x1400a95be
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x1400a95b2
add cx, cx
mov dword [rbp - 0x60], 0x30
mov word [rbp - 0x70], cx
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
add cx, 2
mov word [rbp - 0x6e], cx
lea rax, [rbp - 0x70]
movaps xmm0, xmmword [rbp - 0x70]
mov r14, r15
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x58], r15
mov dword [rbp - 0x48], 0x40
mov qword [rbp - 0x50], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a9641
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9633
call fcn.1400a7710
test rax, rax
jne 0x1400a963d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9620
jmp 0x1400a9641
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a96e6
cmp word [r9], r12w
jne 0x1400a96e6
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a96e6
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a96e6
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a96e6
lea rsi, str.ZwOpenSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a96da
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a96d0
sub rcx, rsi
test al, al
je 0x1400a96cb
cmp byte [rdx], r15b
je 0x1400a96d0
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a96b4
jmp 0x1400a96d0
cmp byte [rdx], r15b
je 0x1400a9722
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a9722
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a96a0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a9737
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9718
call fcn.1400a7710
test rax, rax
jne 0x1400a9733
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9705
jmp 0x1400a9737
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400a96e9
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a97f7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a97f7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a97f7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a97f7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a97f7
lea rsi, str.ZwMapViewOfSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a97da
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a97d0
sub rcx, rsi
test al, al
je 0x1400a97cb
cmp byte [rdx], r15b
je 0x1400a97d0
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a97b4
jmp 0x1400a97d0
cmp byte [rdx], r15b
je 0x1400a97e8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a97e8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a97a0
jmp 0x1400a97f7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a9836
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9828
call fcn.1400a7710
test rax, rax
jne 0x1400a9832
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9815
jmp 0x1400a9836
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a9971
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a9971
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a9971
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a9971
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x1400a9971
lea r14, str.NtClose
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400a98db
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a98d1
sub rcx, r14
test al, al
je 0x1400a98cc
cmp byte [rdx], sil
je 0x1400a98d1
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a98b5
jmp 0x1400a98d1
cmp byte [rdx], sil
je 0x1400a98ec
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a98ec
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a98a1
jmp 0x1400a9971
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400a9971
test r15, r15
je 0x1400a9971
test r12, r12
je 0x1400a9971
lea r8, [rbp - 0x60]
mov edx, 4
lea rcx, [rbp + 0x258]
call r12
test eax, eax
js 0x1400a9971
mov rcx, qword [rbp + 0x258]
lea rax, [rbp + 0x268]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x260]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x1400a9971
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x1400a9971
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a99b1
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a99a3
call fcn.1400a7710
test rax, rax
jne 0x1400a99ad
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a9990
jmp 0x1400a99b1
lea r14, [rdi - 0x10]
mov r9, qword [rbp + 0x260]
mov r10, qword [r14 + 0x30]
test r9, r9
je 0x1400a9b56
test r10, r10
je 0x1400a9b56
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x1400a9a70
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a9a70
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a9a70
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x1400a9a70
lea r14, str.NtQueryInformationThread
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400a9a64
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a9a56
sub rcx, r14
test al, al
je 0x1400a9a4d
cmp byte [rdx], r15b
je 0x1400a9a56
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a9a36
jmp 0x1400a9a56
cmp byte [rdx], r15b
je 0x1400a9af7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a9af7
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400a9a22
mov rsi, r15
cmp word [r10], r12w
jne 0x1400a9b24
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x1400a9b24
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x1400a9b24
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r10
mov r14d, dword [rax + 0x1c]
add rbx, r10
mov r11d, dword [rax + 0x14]
add r14, r10
test r11d, r11d
je 0x1400a9b24
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r10
je 0x1400a9b18
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a9b0e
sub rcx, r12
nop word [rax + rax]
test al, al
je 0x1400a9b09
cmp byte [rdx], r15b
je 0x1400a9b0e
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a9ae0
jmp 0x1400a9b0e
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, r9
jmp 0x1400a9a73
cmp byte [rdx], r15b
je 0x1400a9b3e
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a9b3e
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400a9ac6
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rsi, rsi
jne 0x1400a9b4e
call rax
movzx esi, r15w
jmp 0x1400a9b59
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x1400a9b27
movzx esi, word [rsi + 4]
call rax
jmp 0x1400a9b59
mov esi, r15d
mov word [rsp + 0x54], si
mov r12d, 0xb
test r13w, r13w
je 0x1400a9b6f
test si, si
jne 0x1400a9bd0
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400a9bb5
cmp al, 6
jne 0x1400a9ba9
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400a9ba9
sub ecx, 1
je 0x1400a9b9e
cmp ecx, 1
jne 0x1400a9bb5
lea r13d, [rcx + 0xb]
lea esi, [rcx + 0x23]
jmp 0x1400a9bc0
movzx r13d, r12w
mov esi, 0x23
jmp 0x1400a9bc0
mov r13d, 0xa
lea esi, [r13 + 0x18]
jmp 0x1400a9bc0
mov r13d, 0xd
mov esi, 0x25
mov word [rsp + 0x54], si
mov word [rsp + 0x50], r13w
mov dword [rsp + 0x68], r13d
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x1400a9c11
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a9c03
call fcn.1400a7710
test rax, rax
jne 0x1400a9c0d
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x1400a9bf0
jmp 0x1400a9c11
lea r15, [rdi - 0x10]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x1400a9cd2
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400a9cd2
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x1400a9cd2
mov r14d, dword [rax + rbx + 0x88]
add r14, rbx
je 0x1400a9cd2
mov edi, dword [r14 + 0x24]
mov r15d, dword [r14 + 0x1c]
add rdi, rbx
add r15, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [r14 + 0x14]
mov r9d, eax
mov eax, 0x88888889
mul r9d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r9d, ecx
mov ecx, eax
test r10d, r10d
je 0x1400a9cd2
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rbx + r8], 0x4c
lea rax, [rbx + r8]
jne 0x1400a9cc7
cmp byte [rax + 1], 0x8b
jne 0x1400a9cc7
cmp byte [rax + 2], 0xd1
jne 0x1400a9cc7
cmp byte [rax + 3], 0xb8
jne 0x1400a9cc7
cmp byte [rax + 0x12], 0xf
jne 0x1400a9cc7
cmp byte [rax + 0x13], 5
jne 0x1400a9cc7
inc edx
cmp edx, r9d
je 0x1400a9ce8
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x1400a9c90
xor al, al
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, r8
add rdi, rbx
je 0x1400a9cd2
lea r9, [rbp - 0x80]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x50]
cmp rcx, rax
jbe 0x1400a9d21
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x52]
movzx ecx, byte [rsp + 0x51]
lea rax, [rbp - 0x28]
mov byte [rsp + 0x72], cl
mov byte [rsp + 0x71], r13b
cmp rax, rdi
jbe 0x1400a9df1
lea rax, [rdi + 0x14]
lea rdx, [rbp - 0x28]
cmp rdx, rax
jae 0x1400a9df1
movzx edx, byte [rax - 4]
movzx r14d, byte [rax - 1]
movzx r15d, byte [rax - 2]
movzx r13d, byte [rax - 3]
mov byte [rsp + 0x64], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x63], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x62], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x61], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0x11]
mov byte [rbp + 0x268], dl
movzx edx, byte [rax - 0x12]
mov byte [rbp + 0x260], dl
movzx edx, byte [rax - 0x13]
mov byte [rbp + 0x258], dl
movzx edx, byte [rax - 0x14]
mov byte [rbp + 0x250], dl
jmp 0x1400a9e8f
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x11]
movzx r15d, byte [rdi + 0x12]
movzx r14d, byte [rdi + 0x13]
mov byte [rbp + 0x250], al
movzx eax, byte [rdi + 1]
mov byte [rbp + 0x258], al
movzx eax, byte [rdi + 2]
mov byte [rbp + 0x260], al
movzx eax, byte [rdi + 3]
mov byte [rbp + 0x268], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x60], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x61], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x62], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x63], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x64], al
lea rax, [rsp + 0x70]
cmp rdi, rax
jbe 0x1400a9ea0
lea rax, [rsp + 0x7b]
nop
mov eax, dword [rsp + 0x68]
lea r8, [rbp - 0x30]
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
mov dword [rdi + 3], 0x8b4c0000
mov edx, 0x11
mov byte [rdi + 2], cl
mov rcx, 0xfffffffffffffffe
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
call rdi
test eax, eax
jns 0x1400aa186
lea r11, [rsp + 0x70]
mov r9, r12
sub r11, rdi
mov rbx, rdi
nop dword [rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400a9f26
inc rdi
sub r9, 1
jne 0x1400a9ef0
jmp 0x1400a9f2f
cmp r8d, r10d
jne 0x1400aa186
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x1400a9cd2
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x54]
cmp rcx, rax
jbe 0x1400a9f60
lea rcx, [rsp + 0x71]
lea rax, [rsp + 0x56]
movzx eax, byte [rsp + 0x55]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x72], al
mov byte [rsp + 0x71], sil
cmp rbx, rcx
jbe 0x1400a9f80
lea rcx, [rsp + 0x7b]
nop dword [rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rsp + 0x65]
mov dword [rbx + 3], 0x8b4c0000
mov byte [rbx + 2], al
xor eax, eax
mov byte [rbx + 1], sil
mov byte [rbx], 0xb8
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rbx
lea r10, [rsp + 0x70]
mov esi, eax
sub r10, rbx
mov rdi, rbx
nop
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + r10]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r8d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x1400a9ff6
inc rbx
sub r12, 1
jne 0x1400a9fc0
jmp 0x1400a9fff
cmp r8d, r9d
jne 0x1400aa186
lea rax, [rbp - 0x28]
cmp rdi, rax
jbe 0x1400aa0c0
lea rax, [rbp - 0x14]
cmp rdi, rax
jae 0x1400aa0c0
movzx eax, byte [rsp + 0x64]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x63]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x62]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x61]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 4], al
movzx eax, byte [rbp + 0x268]
mov byte [rdi + 3], al
movzx eax, byte [rbp + 0x260]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x258]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x250]
mov byte [rdi], al
mov byte [rdi + 0x13], r14b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x11], r13b
jmp 0x1400aa15b
movzx eax, byte [rbp + 0x250]
mov byte [rdi], al
movzx eax, byte [rbp + 0x258]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x260]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x268]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x61]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x62]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x63]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x64]
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], r13b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x13], r14b
mov r8d, dword [rbp - 0x80]
lea r9, [rbp - 0x80]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x1400a9cd2
cmp byte [rsp + 0x65], 0
sete al
jmp 0x1400a9cd4
mov al, 1
jmp 0x1400a9cd4