Function at 0x14004a220
Capabilities:
Access peb ldr_data
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rax, qword gs:[0x58]
xor r15d, r15d
mov ecx, 0x154
mov r14, rdx
mov dword [rsp + 0x60], 0x104
mov r9d, 0x5a0
mov rsi, qword [rax]
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a2d5
movups xmm0, xmmword [0x1400b0fc0]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b0fd0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a2c2
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a342
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop dword [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a327
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a327
cmp edx, eax
je 0x14004a32f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a320
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a2f0
add eax, 5
cmp edx, eax
jne 0x14004a335
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a2f0
lea eax, [r9 - 0x77]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a2f0
mov ebx, dword [r8 + 0x10]
mov byte [r8 + 0xc], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x60]
mov edx, ebx
mov rcx, rax
lea r8, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
mov ecx, __WSAFDIsSet
mov r9d, 0x2d8
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a3d3
movups xmm0, xmmword [0x1400b0db0]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b0dc0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop word [rax + rax]
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a3c0
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a442
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a427
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a427
cmp edx, eax
je 0x14004a42f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a420
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a3f0
add eax, 5
cmp edx, eax
jne 0x14004a435
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a3f0
lea eax, [r9 - 0x76]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a3f0
mov edi, dword [r8 + 0x10]
mov ecx, 0x238
mov byte [r8 + 0xc], 1
mov r9d, 0x688
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a4b3
movups xmm0, xmmword [0x1400b0fc0]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b0fd0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a4a0
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a522
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a507
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a507
cmp edx, eax
je 0x14004a50f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a500
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a4d0
add eax, 5
cmp edx, eax
jne 0x14004a515
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a4d0
lea eax, [r9 - 0x76]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a4d0
mov ebx, dword [r8 + 0x10]
mov ecx, reloc.WS2_32.dll_sendto
mov byte [r8 + 0xc], 1
mov r9d, 0x338
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a593
movups xmm0, xmmword [0x1400b1338]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b1348]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a580
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a602
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a5e7
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a5e7
cmp edx, eax
je 0x14004a5ef
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a5e0
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a5b0
add eax, 5
cmp edx, eax
jne 0x14004a5f5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a5b0
lea eax, [r9 - 0x77]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a5b0
mov r11d, dword [r8 + 0x10]
mov ecx, 0x664
mov byte [r8 + 0xc], 1
mov r9d, 0xf8
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a673
movups xmm0, xmmword [0x1400b11f8]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b1208]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a660
mov r10d, r9d
add r10, rsi
cmp byte [r10 + 0xc], r15b
jne 0x14004a6e2
lea rcx, [r10 + 0x10]
mov r8d, r15d
nop word [rax + rax]
mov eax, dword [r10 + 4]
mov edx, dword [r10]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x14004a6c7
lea r9d, [rax + 2]
cmp edx, r9d
je 0x14004a6c7
cmp edx, eax
je 0x14004a6cf
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x14004a6c0
add eax, 3
xor dword [rcx], eax
inc dword [r10]
jmp 0x14004a690
add eax, 5
cmp edx, eax
jne 0x14004a6d5
xor dword [rcx], r9d
inc dword [r10]
jmp 0x14004a690
lea eax, [r8 - 0x77]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x14004a690
mov edx, dword [r10 + 0x10]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], edi
mov r8d, r11d
mov dword [rsp + 0x20], ebx
mov byte [r10 + 0xc], 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14004a9e0
mov eax, 0x1d8
mov r9d, 0x160
mov ecx, dword [rax + rsi]
test cl, 1
jne 0x14004a783
movups xmm0, xmmword [0x1400b0e78]
or ecx, 1
lea rdx, [rsp + 0x50]
mov dword [rax + rsi], ecx
mov r8d, r15d
mov eax, dword [0x1400b0e88]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a770
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a7f2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a7d7
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a7d7
cmp edx, eax
je 0x14004a7df
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a7d0
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a7a0
add eax, 5
cmp edx, eax
jne 0x14004a7e5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a7a0
lea eax, [r9 - 0x75]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a7a0
mov ebx, dword [r8 + 0x10]
mov ecx, 0x184
mov byte [r8 + 0xc], 1
mov r9d, 0x2b0
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a863
movups xmm0, xmmword [0x1400b0e78]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b0e88]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a850
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a8d2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a8b7
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a8b7
cmp edx, eax
je 0x14004a8bf
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a8b0
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a880
add eax, 5
cmp edx, eax
jne 0x14004a8c5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a880
lea eax, [r9 - 0x75]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a880
mov r11d, dword [r8 + 0x10]
mov ecx, 0x6ec
mov byte [r8 + 0xc], 1
mov r9d, 0x5e0
mov eax, dword [rcx + rsi]
test al, 1
jne 0x14004a943
movups xmm0, xmmword [0x1400b0fc0]
or eax, 1
lea rdx, [rsp + 0x50]
mov dword [rcx + rsi], eax
mov r8d, r15d
mov eax, dword [0x1400b0fd0]
mov dword [rsp + 0x50], eax
xor eax, eax
mov ecx, r9d
add rcx, rsi
movaps xmmword [rsp + 0x40], xmm0
mov qword [rcx], r15
mov dword [rcx + 8], r15d
mov byte [rcx + 0xc], r15b
mov dword [rcx + 0x10], eax
lea rax, [rsp + 0x50]
sub rcx, rax
nop
mov eax, dword [rdx]
inc r8d
mov dword [rcx + rdx + 0x10], eax
lea rdx, [rdx + 4]
cmp r8d, 1
jb 0x14004a930
mov r8d, r9d
add r8, rsi
cmp byte [r8 + 0xc], r15b
jne 0x14004a9b2
lea rcx, [r8 + 0x10]
mov r9d, r15d
nop word [rax + rax]
mov eax, dword [r8 + 4]
mov edx, dword [r8]
lea r10d, [rax + 1]
cmp edx, r10d
je 0x14004a997
lea r10d, [rax + 2]
cmp edx, r10d
je 0x14004a997
cmp edx, eax
je 0x14004a99f
lea r10d, [rax + 4]
cmp edx, r10d
jne 0x14004a990
add eax, 3
xor dword [rcx], eax
inc dword [r8]
jmp 0x14004a960
add eax, 5
cmp edx, eax
jne 0x14004a9a5
xor dword [rcx], r10d
inc dword [r8]
jmp 0x14004a960
lea eax, [r9 - 0x75]
xor dword [rcx], eax
inc r9d
add rcx, 4
cmp r9d, 1
jb 0x14004a960
mov byte [r8 + 0xc], 1
mov r9d, r11d
mov r8d, dword [r8 + 0x10]
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
jne 0x14004aa16
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r14 + 8], r15
mov qword [r14], r15
mov rax, r14
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140092b30
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [r14 + 8], rax
mov qword [r14], rdi
jmp 0x14004a9e7