Function at 0x140007fb0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400ab0c0]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r13d, r13d
mov byte [rbp - 0x40], 0
xor eax, eax
mov qword [rbp - 0x20], r13
lea rdi, [rbp + 0x30]
mov dword [rbp - 0x3c], r13d
mov ecx, 0x104
mov dword [rbp], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp + 4], 0xd18b4c00
mov word [rbp + 8], 0x50f
mov byte [rbp + 0xa], 0xc3
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
cmp word [rbp + 0x30], r13w
je 0x14000804a
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x140008040
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140008060
mov word [rax], r13w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x14000808a
nop
add rax, 2
cmp word [rax], r13w
jne 0x140008080
lea rdx, str.ntdll.dll
mov ecx, WSAGetLastError
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400080a0
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x1400080ce
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400080c2
add cx, cx
mov dword [rbp - 0x78], Ordinal_50
mov word [rbp - 0x30], cx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
add cx, 2
mov word [rbp - 0x2e], cx
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
mov r14, r13
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140008158
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000814a
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x140008154
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140008130
jmp 0x140008158
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x140008202
cmp word [r9], r15w
jne 0x140008202
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140008202
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140008202
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140008202
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400081f6
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400081ec
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x1400081e7
cmp byte [rcx], r13b
je 0x1400081ec
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400081d0
jmp 0x1400081ec
cmp byte [rcx], r13b
je 0x140008245
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140008245
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400081b6
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14000825a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14000823b
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x140008256
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140008221
jmp 0x14000825a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140008205
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400082f8
cmp word [r9], r15w
jne 0x1400082f8
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400082f8
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400082f8
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400082f8
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400082ec
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400082e2
sub rcx, rsi
test al, al
je 0x1400082dd
cmp byte [rdx], r13b
je 0x1400082e2
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400082c6
jmp 0x1400082e2
cmp byte [rdx], r13b
je 0x14000833b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000833b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400082b2
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140008350
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140008331
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x14000834c
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140008317
jmp 0x140008350
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x1400082fb
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x140008483
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140008483
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140008483
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140008483
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140008483
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400083fb
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400083f1
sub rax, rsi
test dl, dl
je 0x1400083ec
cmp byte [rcx], r13b
je 0x1400083f1
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400083d5
jmp 0x1400083f1
cmp byte [rcx], r13b
je 0x140008409
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140008409
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400083c0
jmp 0x140008483
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140008483
test r15, r15
je 0x140008483
test r12, r12
je 0x140008483
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x140008483
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x140008483
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140008483
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400084c8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400084ba
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x1400084c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400084a0
jmp 0x1400084c8
lea r14, [rdi - 0x10]
mov rsi, qword [rbp - 0x80]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x14000866e
test r14, r14
je 0x14000866e
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x14000858f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14000858f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14000858f
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x14000858f
lea rbx, str.NtSetInformationThread
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x140008583
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140008575
sub rax, rbx
test dl, dl
je 0x14000856c
cmp byte [rcx], r13b
je 0x140008575
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140008555
jmp 0x140008575
cmp byte [rcx], r13b
je 0x14000860b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14000860b
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140008540
mov r9, r13
cmp word [r14], r12w
jne 0x14000863a
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14000863a
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x14000863a
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x14000863a
nop
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x14000862e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140008624
sub rcx, r15
test al, al
je 0x14000861f
cmp byte [rdx], r13b
je 0x140008624
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400085f4
jmp 0x140008624
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x140008592
cmp byte [rdx], r13b
je 0x140008650
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140008650
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400085e0
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140008660
call rax
jmp 0x140008674
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x14000863d
movzx r13d, word [r9 + 4]
mov dword [rsp + 0x64], r13d
call rax
jmp 0x140008679
mov r12d, 0x5a4d
mov dword [rsp + 0x64], r13d
xor r15d, r15d
mov word [rbp - 0x48], r13w
xor eax, eax
mov qword [rbp - 0x38], r15
lea rdi, [rbp + 0x30]
mov qword [rbp - 0x80], r15
mov ecx, 0x104
mov qword [rbp - 0x30], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp - 0x74], r15d
mov dword [rbp - 0x5c], r15d
cmp word [rbp + 0x30], r15w
je 0x1400086ba
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400086b0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400086d0
mov word [rax], r15w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x1400086fa
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400086f0
lea rcx, str.ntdll.dll
mov edx, WSAGetLastError
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140008710
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x14000873e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x140008732
add cx, cx
mov dword [rbp - 0x78], Ordinal_50
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x78], rax
mov r14, r15
mov dword [rbp - 0x60], 0x40
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov word [rsp + 0x70], cx
add cx, 2
mov word [rsp + 0x72], cx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400087c8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400087ba
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x1400087c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400087a0
jmp 0x1400087c8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140008867
cmp word [r9], r12w
jne 0x140008867
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140008867
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140008867
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140008867
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14000885b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140008851
sub rax, rsi
test dl, dl
je 0x14000884c
cmp byte [rcx], r15b
je 0x140008851
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140008835
jmp 0x140008851
cmp byte [rcx], r15b
je 0x1400088aa
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400088aa
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140008820
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400088bf
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400088a0
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x1400088bb
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140008886
jmp 0x1400088bf
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14000886a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14000897b
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000897b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14000897b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14000897b
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14000897b
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14000895e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140008954
sub rcx, rsi
test al, al
je 0x14000894f
cmp byte [rdx], r15b
je 0x140008954
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140008938
jmp 0x140008954
cmp byte [rdx], r15b
je 0x14000896c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14000896c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140008924
jmp 0x14000897b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400089c8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400089ba
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x1400089c4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400089a0
jmp 0x1400089c8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140008af2
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140008af2
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140008af2
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140008af2
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x140008af2
lea r14, str.NtClose
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140008a6e
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140008a64
sub rax, r14
test dl, dl
je 0x140008a5f
cmp byte [rcx], sil
je 0x140008a64
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140008a48
jmp 0x140008a64
cmp byte [rcx], sil
je 0x140008a7c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140008a7c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140008a33
jmp 0x140008af2
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140008af2
test r15, r15
je 0x140008af2
test r12, r12
je 0x140008af2
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rbp - 0x80]
call r12
test eax, eax
js 0x140008af2
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x38]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x140008af2
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140008af2
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140008b39
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140008b2b
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x140008b35
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140008b11
jmp 0x140008b39
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x38]
mov r11, qword [r14 + 0x30]
test r9, r9
je 0x140008ce6
test r11, r11
je 0x140008ce6
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x140008bff
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140008bff
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140008bff
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x140008bff
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140008bf3
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140008be5
sub rax, r14
test dl, dl
je 0x140008bdc
cmp byte [rcx], r15b
je 0x140008be5
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140008bc5
jmp 0x140008be5
cmp byte [rcx], r15b
je 0x140008c87
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140008c87
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140008bb0
mov rsi, r15
cmp word [r11], r12w
jne 0x140008cb4
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140008cb4
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x140008cb4
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rbx, r11
mov r10d, dword [rax + 0x14]
add r14, r11
test r10d, r10d
je 0x140008cb4
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r11
je 0x140008ca8
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140008c9e
sub rcx, r12
nop dword [rax]
test al, al
je 0x140008c99
cmp byte [rdx], r15b
je 0x140008c9e
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140008c70
jmp 0x140008c9e
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, r9
jmp 0x140008c02
cmp byte [rdx], r15b
je 0x140008cce
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140008cce
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140008c55
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rsi, rsi
jne 0x140008cde
call rax
movzx esi, r15w
jmp 0x140008ce9
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140008cb7
movzx esi, word [rsi + 4]
call rax
jmp 0x140008ce9
mov esi, r15d
mov word [rbp - 0x44], si
mov r12d, recv
test r13w, r13w
je 0x140008cfe
test si, si
jne 0x140008d5d
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140008d44
cmp al, 6
jne 0x140008d38
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140008d38
sub ecx, 1
je 0x140008d2d
cmp ecx, 1
jne 0x140008d44
lea r13d, [rcx + 0xb]
lea esi, [rcx + 0x23]
jmp 0x140008d4f
movzx r13d, r12w
mov esi, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140008d4f
mov r13d, 0xa
lea esi, [r13 + 0x18]
jmp 0x140008d4f
mov r13d, reloc.WS2_32.dll_listen
mov esi, Ordinal_41
mov word [rbp - 0x44], si
mov word [rbp - 0x48], r13w
mov dword [rsp + 0x64], r13d
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140008d9e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140008d90
lea rcx, str.ntdll.dll
call fcn.1400067b0
test rax, rax
jne 0x140008d9a
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140008d76
jmp 0x140008d9e
lea r15, [rdi - 0x10]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x140008e62
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140008e62
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140008e62
mov r14d, dword [rax + rbx + 0x88]
add r14, rbx
je 0x140008e62
mov edi, dword [r14 + 0x24]
mov r15d, dword [r14 + 0x1c]
add rdi, rbx
add r15, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [r14 + 0x14]
mov r9d, eax
mov eax, 0x88888889
mul r9d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r9d, ecx
mov ecx, eax
test r10d, r10d
je 0x140008e62
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rbx + r8], 0x4c
lea rax, [rbx + r8]
jne 0x140008e57
cmp byte [rax + 1], 0x8b
jne 0x140008e57
cmp byte [rax + 2], 0xd1
jne 0x140008e57
cmp byte [rax + 3], 0xb8
jne 0x140008e57
cmp byte [rax + 0x12], 0xf
jne 0x140008e57
cmp byte [rax + 0x13], 5
jne 0x140008e57
inc edx
cmp edx, r9d
je 0x140008e94
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x140008e20
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140088500
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, r8
add rdi, rbx
je 0x140008e62
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 1]
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x140008ed0
lea rcx, [rbp + 1]
lea rax, [rbp - 0x46]
nop dword [rax]
movzx ecx, byte [rbp - 0x47]
lea rax, [rbp + 0x10]
mov byte [rbp + 2], cl
mov byte [rbp + 1], r13b
cmp rax, rdi
jbe 0x140008fa0
lea rax, [rdi + 0x14]
lea rdx, [rbp + 0x10]
cmp rdx, rax
jae 0x140008fa0
movzx edx, byte [rax - 4]
movzx r14d, byte [rax - 1]
movzx r15d, byte [rax - 2]
movzx r13d, byte [rax - 3]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x57], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x56], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x55], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x54], dl
movzx edx, byte [rax - 0x11]
mov byte [rsp + 0x53], dl
movzx edx, byte [rax - 0x12]
mov byte [rsp + 0x52], dl
movzx edx, byte [rax - 0x13]
mov byte [rsp + 0x51], dl
movzx edx, byte [rax - 0x14]
mov byte [rsp + 0x50], dl
jmp 0x140009036
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x11]
movzx r15d, byte [rdi + 0x12]
movzx r14d, byte [rdi + 0x13]
mov byte [rsp + 0x50], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x51], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x52], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x53], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x57], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x60], al
lea rax, [rbp]
cmp rdi, rax
jbe 0x140009050
lea rax, [rbp + 0xb]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x64]
lea r8, [rbp - 0x20]
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
mov dword [rdi + 3], 0x8b4c0000
mov edx, reloc.WS2_32.dll_recvfrom
mov byte [rdi + 2], cl
mov rcx, 0xfffffffffffffffe
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
call rdi
test eax, eax
jns 0x14000931e
lea r11, [rbp]
mov r9, r12
sub r11, rdi
mov rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400090d6
inc rdi
sub r9, 1
jne 0x1400090a0
jmp 0x1400090df
cmp r8d, r10d
jne 0x14000931e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x140008e62
lea rcx, [rbp + 1]
lea rax, [rbp - 0x44]
cmp rcx, rax
jbe 0x140009110
lea rcx, [rbp + 1]
lea rax, [rbp - 0x42]
nop dword [rax]
movzx eax, byte [rbp - 0x43]
lea rcx, [rbp]
mov byte [rbp + 2], al
mov byte [rbp + 1], sil
cmp rbx, rcx
jbe 0x140009130
lea rcx, [rbp + 0xb]
nop dword [rax + rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rbp - 0x40]
mov dword [rbx + 3], 0x8b4c0000
mov byte [rbx + 2], al
xor eax, eax
mov byte [rbx + 1], sil
mov byte [rbx], 0xb8
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rbx
lea r10, [rbp]
mov esi, eax
sub r10, rbx
mov rdi, rbx
nop dword [rax]
movzx r8d, byte [rbx]
movzx r9d, byte [rbx + r10]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r8d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x1400091a6
inc rbx
sub r12, 1
jne 0x140009170
jmp 0x1400091af
cmp r8d, r9d
jne 0x14000931e
lea rax, [rbp + 0x10]
cmp rdi, rax
jbe 0x140009261
lea rax, [rbp + 0x24]
cmp rdi, rax
jae 0x140009261
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
mov byte [rdi + 0x13], r14b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x11], r13b
jmp 0x1400092f4
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], r13b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x13], r14b
mov r8d, dword [rbp - 0x3c]
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x140008e62
cmp byte [rbp - 0x40], 0
sete al
jmp 0x140008e64
mov al, 1
jmp 0x140008e64