Function at 0x140026dd0
Capabilities:
Create thread
Get system information on windows
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x14003b088]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov eax, 0x5a4d
mov qword [rsp + 0x40], r8
xorps xmm0, xmm0
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x38], rdx
movups xmmword [rsp + 0x48], xmm0
cmp word [rcx], ax
jne 0x140027325
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
je 0x140027325
cmp dword [rsi], 0x4550
jne 0x140027325
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x140027325
mov r9d, dword [rsi + 0x38]
test r9b, 1
jne 0x140027325
movzx ecx, word [rsi + 0x14]
xor edx, edx
movzx eax, word [rsi + 6]
add rcx, 0x24
movzx r14d, word [rsi + 0x16]
mov ebx, edx
mov dword [rsp + 0x30], r14d
cmp dx, ax
jae 0x140026ea2
add rcx, rsi
mov r8d, eax
nop word [rax + rax]
mov eax, dword [rcx + 4]
mov edx, dword [rcx]
test eax, eax
jne 0x140026e8f
lea eax, [rdx + r9]
jmp 0x140026e91
add eax, edx
cmp eax, ebx
cmovbe eax, ebx
add rcx, 0x28
mov ebx, eax
sub r8, 1
jne 0x140026e80
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x64]
mov eax, edx
neg eax
lea ebp, [rdx - 1]
add ebp, dword [rsi + 0x50]
lea rcx, [rdx - 1]
and rbp, rax
mov eax, ebx
add rcx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
cmp rbp, rcx
jne 0x140027325
mov rcx, qword [rsi + 0x30]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140026f15
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
movsxd rax, dword [r13 + 0x3c]
mov dword [rdi + 0x3c], eax
mov r8d, dword [rsi + 0x54]
sub r8d, dword [r13 + 0x3c]
lea rdx, [rax + r13]
lea rcx, [rdi + rax]
call fcn.1400287e0
movsxd r15, dword [rdi + 0x3c]
xor ebp, ebp
add r15, rdi
mov esi, ebp
movzx ebx, word [r15 + 0x14]
add rbx, 0x2c
cmp bp, word [r15 + 6]
jae 0x140026f73
add rbx, r15
nop
mov edx, dword [rbx]
mov ecx, dword [rbx - 8]
add rdx, r13
mov r8d, dword [rbx - 4]
add rcx, rdi
call fcn.1400287e0
movzx eax, word [r15 + 6]
lea rbx, [rbx + 0x28]
inc esi
cmp esi, eax
jb 0x140026f50
mov r10, rdi
sub r10, qword [r15 + 0x30]
je 0x14002705b
cmp dword [r15 + 0xb4], ebp
je 0x14002705b
mov r8d, dword [r15 + 0xb0]
add r8, rdi
cmp dword [r8], ebp
je 0x14002705b
mov eax, dword [r8 + 4]
lea r9, [r8 + 8]
add rax, r8
cmp r9, rax
je 0x14002704f
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r9]
movzx ecx, dx
movzx eax, dx
shr cx, 0xc
cmp cx, 0xa
jne 0x140026fe7
mov ecx, dword [r8]
and edx, 0xfff
lea rax, [rdi + rdx]
add qword [rcx + rax], r10
jmp 0x14002703b
cmp cx, 3
jne 0x140027000
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov eax, r10d
jmp 0x140027038
cmp cx, 1
jne 0x140027020
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
mov rax, r10
shr rax, 0x10
movzx eax, ax
jmp 0x140027038
cmp cx, 2
jne 0x14002703b
mov edx, dword [r8]
and eax, 0xfff
add rax, rdi
add rdx, rax
movzx eax, r10w
add qword [rdx], rax
mov eax, dword [r8 + 4]
add r9, 2
add rax, r8
cmp r9, rax
jne 0x140026fc0
mov r8, r9
cmp dword [r9], ebp
jne 0x140026fa0
cmp dword [r15 + 0x94], ebp
je 0x14002711b
mov ebp, dword [r15 + 0x90]
add rbp, rdi
cmp dword [rbp + 0xc], 0
je 0x140027119
xor r12d, r12d
nop
mov ecx, dword [rbp + 0xc]
add rcx, rdi
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov ebx, dword [rbp]
mov r14, rax
mov esi, dword [rbp + 0x10]
add rbx, rdi
add rsi, rdi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140027101
jns 0x1400270ae
movzx r8d, word [rbx]
mov rdx, r12
jmp 0x1400270e5
mov rdx, qword [rbx]
mov rcx, r12
add rdx, 2
add rdx, rdi
cmp byte [rdx], cl
je 0x1400270ce
mov rax, rdx
inc rcx
lea rax, [rax + 1]
cmp byte [rax], r12b
jne 0x1400270c2
mov qword [rsp + 0x50], rdx
mov r8d, r12d
lea rdx, [rsp + 0x48]
mov word [rsp + 0x48], cx
mov word [rsp + 0x4a], cx
mov r9, rsi
mov rcx, r14
call sub.ntdll.dll_LdrGetProcedureAddress
mov rcx, qword [rbx + 8]
add rbx, 8
add rsi, 8
test rcx, rcx
jne 0x1400270a3
add rbp, 0x14
cmp dword [rbp + 0xc], r12d
jne 0x140027080
mov r12, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x30]
xor ebp, ebp
movzx ebx, word [r15 + 0x14]
mov esi, ebp
add rbx, 0x28
mov edx, 1
cmp bp, word [r15 + 6]
jae 0x1400271fc
add rbx, r15
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
nop dword [rax + rax]
cmp dword [rbx], 0
je 0x1400271e9
mov ecx, dword [rbx + 0x14]
mov eax, ecx
and eax, 0x40000000
bt ecx, 0x1d
jb 0x140027189
test eax, eax
jne 0x14002717b
test ecx, ecx
mov r8d, 8
cmovns r8d, edx
jmp 0x1400271a7
test ecx, ecx
mov r8d, 4
cmovns r8d, r9d
jmp 0x1400271a7
test eax, eax
jne 0x14002719b
test ecx, ecx
mov r8d, 0x80
cmovns r8d, r10d
jmp 0x1400271a7
test ecx, ecx
mov r8d, 0x40
cmovns r8d, r11d
mov dword [rsp + 0x58], r8d
test dword [rbx + 0x14], 0x4000000
je 0x1400271bf
bts r8d, 9
mov dword [rsp + 0x58], r8d
mov ecx, dword [rbx - 4]
lea r9, [rsp + 0x58]
mov edx, dword [rbx]
add rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualProtect]
mov edx, 1
mov r9d, 2
mov r10d, 0x10
mov r11d, 0x20
movzx eax, word [r15 + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jb 0x140027150
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.kernel32.dll_FlushInstructionCache]
mov eax, dword [r15 + 0x28]
add rax, rdi
bt r14d, 0xd
jb 0x140027232
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x20], ebp
mov r8, rax
jmp 0x1400272db
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
test r12, r12
je 0x140027302
cmp dword [r15 + 0x8c], 0
je 0x140027302
mov r14d, dword [r15 + 0x88]
add r14, rdi
mov eax, dword [r14 + 0x18]
test eax, eax
je 0x140027302
cmp dword [r14 + 0x14], 0
je 0x140027302
mov esi, dword [r14 + 0x20]
mov ebx, dword [r14 + 0x24]
add rsi, rdi
add rbx, rdi
test eax, eax
je 0x140027302
nop dword [rax]
mov edx, dword [rsi]
add rdx, rdi
je 0x140027302
mov rcx, r12
call fcn.14002b588
test eax, eax
jne 0x1400272a8
test rbx, rbx
jne 0x1400272ba
inc ebp
add rsi, 4
add rbx, 2
cmp ebp, dword [r14 + 0x18]
jb 0x140027290
jmp 0x140027302
movzx edx, word [rbx]
mov ecx, dword [r14 + 0x1c]
mov r9, qword [rsp + 0x40]
add rcx, rdi
mov r8d, dword [rcx + rdx*4]
add r8, rdi
xor edx, edx
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140027325
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.kernel32.dll_VirtualFree]
test eax, eax
jne 0x140027320
mov rcx, r13
call qword [sym.imp.kernel32.dll_LocalFree]
mov rax, rdi
jmp 0x140027327
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140027750
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret