Function at 0x140048dd0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140071040]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor r13d, r13d
mov byte [rbp - 0x40], 0
xor eax, eax
mov qword [rbp - 0x20], r13
lea rdi, [rbp + 0x30]
mov dword [rbp - 0x3c], r13d
mov ecx, 0x104
mov dword [rbp], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp + 4], 0xd18b4c00
mov word [rbp + 8], 0x50f
mov byte [rbp + 0xa], 0xc3
mov qword [rbp - 0x80], r13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x38], r13
mov dword [rbp - 0x74], r13d
mov dword [rbp - 0x5c], r13d
cmp word [rbp + 0x30], r13w
je 0x140048e6a
nop dword [rax]
add rax, 2
cmp word [rax], r13w
jne 0x140048e60
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140048e80
mov word [rax], r13w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048eaa
nop
add rax, 2
cmp word [rax], r13w
jne 0x140048ea0
lea rdx, [0x140065630]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140048ec0
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r13w
je 0x140048eee
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140048ee2
add cx, cx
mov dword [rbp - 0x78], 0x30
mov word [rbp - 0x30], cx
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
add cx, 2
mov word [rbp - 0x2e], cx
lea rax, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x30]
mov r14, r13
movdqa xmmword [rbp - 0x30], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x70], r13
mov dword [rbp - 0x60], 0x40
mov qword [rbp - 0x68], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140048f78
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140048f6a
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140048f74
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140048f50
jmp 0x140048f78
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov r15d, 0x5a4d
test r9, r9
je 0x140049022
cmp word [r9], r15w
jne 0x140049022
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049022
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049022
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049022
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140049016
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x14004900c
sub rax, rsi
nop dword [rax + rax]
test dl, dl
je 0x140049007
cmp byte [rcx], r13b
je 0x14004900c
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140048ff0
jmp 0x14004900c
cmp byte [rcx], r13b
je 0x140049065
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049065
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140048fd6
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004907a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004905b
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140049076
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049041
jmp 0x14004907a
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140049025
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x140049118
cmp word [r9], r15w
jne 0x140049118
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049118
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049118
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049118
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004910c
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049102
sub rcx, rsi
test al, al
je 0x1400490fd
cmp byte [rdx], r13b
je 0x140049102
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400490e6
jmp 0x140049102
cmp byte [rdx], r13b
je 0x14004915b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004915b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400490d2
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049170
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049151
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x14004916c
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049137
jmp 0x140049170
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x14004911b
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x1400492a3
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400492a3
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400492a3
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400492a3
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400492a3
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004921b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049211
sub rax, rsi
test dl, dl
je 0x14004920c
cmp byte [rcx], r13b
je 0x140049211
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400491f5
jmp 0x140049211
cmp byte [rcx], r13b
je 0x140049229
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049229
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400491e0
jmp 0x1400492a3
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400492a3
test r15, r15
je 0x1400492a3
test r12, r12
je 0x1400492a3
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x1400492a3
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x38]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x80]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x1400492a3
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400492a3
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400492e8
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400492da
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400492e4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400492c0
jmp 0x1400492e8
lea r14, [rdi - 0x10]
mov rsi, qword [rbp - 0x80]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x14004948e
test r14, r14
je 0x14004948e
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x1400493af
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400493af
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400493af
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x1400493af
lea rbx, str.NtSetInformationThread
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x1400493a3
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049395
sub rax, rbx
test dl, dl
je 0x14004938c
cmp byte [rcx], r13b
je 0x140049395
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049375
jmp 0x140049395
cmp byte [rcx], r13b
je 0x14004942b
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004942b
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140049360
mov r9, r13
cmp word [r14], r12w
jne 0x14004945a
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14004945a
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x14004945a
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x14004945a
nop
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x14004944e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049444
sub rcx, r15
test al, al
je 0x14004943f
cmp byte [rdx], r13b
je 0x140049444
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049414
jmp 0x140049444
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x1400493b2
cmp byte [rdx], r13b
je 0x140049470
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140049470
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049400
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140049480
call rax
jmp 0x140049494
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x14004945d
movzx r13d, word [r9 + 4]
mov dword [rsp + 0x64], r13d
call rax
jmp 0x140049499
mov r12d, 0x5a4d
mov dword [rsp + 0x64], r13d
xor r15d, r15d
mov word [rbp - 0x48], r13w
xor eax, eax
mov qword [rbp - 0x38], r15
lea rdi, [rbp + 0x30]
mov qword [rbp - 0x80], r15
mov ecx, 0x104
mov qword [rbp - 0x30], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x30]
mov dword [rbp - 0x74], r15d
mov dword [rbp - 0x5c], r15d
cmp word [rbp + 0x30], r15w
je 0x1400494da
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x1400494d0
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400494f0
mov word [rax], r15w
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x14004951a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140049510
lea rcx, [0x140065630]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rax + rcx]
test dx, dx
jne 0x140049530
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x30]
cmp word [rbp + 0x30], r15w
je 0x14004955e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x140049552
add cx, cx
mov dword [rbp - 0x78], 0x30
mov qword [rbp - 0x70], r15
lea rax, [rbp + 0x30]
mov qword [rsp + 0x78], rax
mov r14, r15
mov dword [rbp - 0x60], 0x40
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
mov word [rsp + 0x70], cx
add cx, 2
mov word [rsp + 0x72], cx
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400495e8
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400495da
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400495e4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400495c0
jmp 0x1400495e8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140049687
cmp word [r9], r12w
jne 0x140049687
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049687
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049687
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140049687
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x14004967b
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140049671
sub rax, rsi
test dl, dl
je 0x14004966c
cmp byte [rcx], r15b
je 0x140049671
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049655
jmp 0x140049671
cmp byte [rcx], r15b
je 0x1400496ca
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400496ca
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049640
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400496df
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400496c0
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400496db
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400496a6
jmp 0x1400496df
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x14004968a
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x14004979b
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14004979b
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x14004979b
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x14004979b
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x14004979b
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004977e
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049774
sub rcx, rsi
test al, al
je 0x14004976f
cmp byte [rdx], r15b
je 0x140049774
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049758
jmp 0x140049774
cmp byte [rdx], r15b
je 0x14004978c
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004978c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049744
jmp 0x14004979b
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400497e8
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400497da
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x1400497e4
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400497c0
jmp 0x1400497e8
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140049912
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140049912
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049912
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049912
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x140049912
lea r14, str.NtClose
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x14004988e
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049884
sub rax, r14
test dl, dl
je 0x14004987f
cmp byte [rcx], sil
je 0x140049884
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140049868
jmp 0x140049884
cmp byte [rcx], sil
je 0x14004989c
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004989c
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049853
jmp 0x140049912
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140049912
test r15, r15
je 0x140049912
test r12, r12
je 0x140049912
lea r8, [rbp - 0x78]
mov edx, 4
lea rcx, [rbp - 0x80]
call r12
test eax, eax
js 0x140049912
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x30]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x38]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x140049912
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140049912
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140049959
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004994b
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140049955
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140049931
jmp 0x140049959
lea r14, [rdi - 0x10]
mov r9, qword [rbp - 0x38]
mov r11, qword [r14 + 0x30]
test r9, r9
je 0x140049b06
test r11, r11
je 0x140049b06
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x140049a1f
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140049a1f
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140049a1f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r10d, dword [rax + 0x14]
add rsi, r9
test r10d, r10d
je 0x140049a1f
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x140049a13
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140049a05
sub rax, r14
test dl, dl
je 0x1400499fc
cmp byte [rcx], r15b
je 0x140049a05
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400499e5
jmp 0x140049a05
cmp byte [rcx], r15b
je 0x140049aa7
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140049aa7
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400499d0
mov rsi, r15
cmp word [r11], r12w
jne 0x140049ad4
mov eax, dword [r11 + 0x3c]
cmp dword [rax + r11], 0x4550
jne 0x140049ad4
mov eax, dword [rax + r11 + 0x88]
add rax, r11
je 0x140049ad4
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r11
mov r14d, dword [rax + 0x1c]
add rbx, r11
mov r10d, dword [rax + 0x14]
add r14, r11
test r10d, r10d
je 0x140049ad4
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r11
je 0x140049ac8
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140049abe
sub rcx, r12
nop dword [rax]
test al, al
je 0x140049ab9
cmp byte [rdx], r15b
je 0x140049abe
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140049a90
jmp 0x140049abe
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov esi, dword [rsi + rcx*4]
add rsi, r9
jmp 0x140049a22
cmp byte [rdx], r15b
je 0x140049aee
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140049aee
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140049a75
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test rsi, rsi
jne 0x140049afe
call rax
movzx esi, r15w
jmp 0x140049b09
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r11
jmp 0x140049ad7
movzx esi, word [rsi + 4]
call rax
jmp 0x140049b09
mov esi, r15d
mov word [rbp - 0x44], si
mov r12d, 0xb
test r13w, r13w
je 0x140049b1e
test si, si
jne 0x140049b7d
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140049b64
cmp al, 6
jne 0x140049b58
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140049b58
sub ecx, 1
je 0x140049b4d
cmp ecx, 1
jne 0x140049b64
lea r13d, [rcx + 0xb]
lea esi, [rcx + 0x23]
jmp 0x140049b6f
movzx r13d, r12w
mov esi, 0x23
jmp 0x140049b6f
mov r13d, 0xa
lea esi, [r13 + 0x18]
jmp 0x140049b6f
mov r13d, 0xd
mov esi, 0x25
mov word [rbp - 0x44], si
mov word [rbp - 0x48], r13w
mov dword [rsp + 0x64], r13d
mov rax, qword gs:[0x60]
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rdi, qword [r14]
cmp rdi, r14
je 0x140049bbe
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140049bb0
lea rcx, [0x140065630]
call fcn.1400475d0
test rax, rax
jne 0x140049bba
mov rdi, qword [rdi]
cmp rdi, r14
jne 0x140049b96
jmp 0x140049bbe
lea r15, [rdi - 0x10]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x140049c82
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140049c82
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140049c82
mov r14d, dword [rax + rbx + 0x88]
add r14, rbx
je 0x140049c82
mov edi, dword [r14 + 0x24]
mov r15d, dword [r14 + 0x1c]
add rdi, rbx
add r15, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [r14 + 0x14]
mov r9d, eax
mov eax, 0x88888889
mul r9d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r9d, ecx
mov ecx, eax
test r10d, r10d
je 0x140049c82
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rbx + r8], 0x4c
lea rax, [rbx + r8]
jne 0x140049c77
cmp byte [rax + 1], 0x8b
jne 0x140049c77
cmp byte [rax + 2], 0xd1
jne 0x140049c77
cmp byte [rax + 3], 0xb8
jne 0x140049c77
cmp byte [rax + 0x12], 0xf
jne 0x140049c77
cmp byte [rax + 0x13], 5
jne 0x140049c77
inc edx
cmp edx, r9d
je 0x140049cb4
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x140049c40
xor al, al
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14005b360
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdi, r8
add rdi, rbx
je 0x140049c82
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 1]
lea rax, [rbp - 0x48]
cmp rcx, rax
jbe 0x140049cf0
lea rcx, [rbp + 1]
lea rax, [rbp - 0x46]
nop dword [rax]
movzx ecx, byte [rbp - 0x47]
lea rax, [rbp + 0x10]
mov byte [rbp + 2], cl
mov byte [rbp + 1], r13b
cmp rax, rdi
jbe 0x140049dc0
lea rax, [rdi + 0x14]
lea rdx, [rbp + 0x10]
cmp rdx, rax
jae 0x140049dc0
movzx edx, byte [rax - 4]
movzx r14d, byte [rax - 1]
movzx r15d, byte [rax - 2]
movzx r13d, byte [rax - 3]
mov byte [rsp + 0x60], dl
movzx edx, byte [rax - 5]
mov byte [rsp + 0x5f], dl
movzx edx, byte [rax - 6]
mov byte [rsp + 0x5e], dl
movzx edx, byte [rax - 7]
mov byte [rsp + 0x5d], dl
movzx edx, byte [rax - 8]
mov byte [rsp + 0x5c], dl
movzx edx, byte [rax - 9]
mov byte [rsp + 0x5b], dl
movzx edx, byte [rax - 0xa]
mov byte [rsp + 0x5a], dl
movzx edx, byte [rax - 0xb]
mov byte [rsp + 0x59], dl
movzx edx, byte [rax - 0xc]
mov byte [rsp + 0x58], dl
movzx edx, byte [rax - 0xd]
mov byte [rsp + 0x57], dl
movzx edx, byte [rax - 0xe]
mov byte [rsp + 0x56], dl
movzx edx, byte [rax - 0xf]
mov byte [rsp + 0x55], dl
movzx edx, byte [rax - 0x10]
mov byte [rsp + 0x54], dl
movzx edx, byte [rax - 0x11]
mov byte [rsp + 0x53], dl
movzx edx, byte [rax - 0x12]
mov byte [rsp + 0x52], dl
movzx edx, byte [rax - 0x13]
mov byte [rsp + 0x51], dl
movzx edx, byte [rax - 0x14]
mov byte [rsp + 0x50], dl
jmp 0x140049e56
movzx eax, byte [rdi]
movzx r13d, byte [rdi + 0x11]
movzx r15d, byte [rdi + 0x12]
movzx r14d, byte [rdi + 0x13]
mov byte [rsp + 0x50], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x51], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x52], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x53], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x54], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x55], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x56], al
movzx eax, byte [rdi + 7]
mov byte [rsp + 0x57], al
movzx eax, byte [rdi + 8]
mov byte [rsp + 0x58], al
movzx eax, byte [rdi + 9]
mov byte [rsp + 0x59], al
movzx eax, byte [rdi + 0xa]
mov byte [rsp + 0x5a], al
movzx eax, byte [rdi + 0xb]
mov byte [rsp + 0x5b], al
movzx eax, byte [rdi + 0xc]
mov byte [rsp + 0x5c], al
movzx eax, byte [rdi + 0xd]
mov byte [rsp + 0x5d], al
movzx eax, byte [rdi + 0xe]
mov byte [rsp + 0x5e], al
movzx eax, byte [rdi + 0xf]
mov byte [rsp + 0x5f], al
movzx eax, byte [rdi + 0x10]
mov byte [rsp + 0x60], al
lea rax, [rbp]
cmp rdi, rax
jbe 0x140049e70
lea rax, [rbp + 0xb]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsp + 0x64]
lea r8, [rbp - 0x20]
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
mov dword [rdi + 3], 0x8b4c0000
mov edx, 0x11
mov byte [rdi + 2], cl
mov rcx, 0xfffffffffffffffe
mov byte [rdi + 1], al
mov byte [rdi], 0xb8
call rdi
test eax, eax
jns 0x14004a13e
lea r11, [rbp]
mov r9, r12
sub r11, rdi
mov rbx, rdi
nop dword [rax + rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140049ef6
inc rdi
sub r9, 1
jne 0x140049ec0
jmp 0x140049eff
cmp r8d, r10d
jne 0x14004a13e
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rbx
test eax, eax
js 0x140049c82
lea rcx, [rbp + 1]
lea rax, [rbp - 0x44]
cmp rcx, rax
jbe 0x140049f30
lea rcx, [rbp + 1]
lea rax, [rbp - 0x42]
nop dword [rax]
movzx eax, byte [rbp - 0x43]
lea rcx, [rbp]
mov byte [rbp + 2], al
mov byte [rbp + 1], sil
cmp rbx, rcx
jbe 0x140049f50
lea rcx, [rbp + 0xb]
nop dword [rax + rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rbp - 0x40]
mov dword [rbx + 3], 0x8b4c0000
mov byte [rbx + 2], al
xor eax, eax
mov byte [rbx + 1], sil
mov byte [rbx], 0xb8
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rbx
lea r10, [rbp]
mov esi, eax
sub r10, rbx
mov rdi, rbx
nop dword [rax]
movzx r9d, byte [rbx + r10]
movzx r8d, byte [rbx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r9d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x140049fc6
inc rbx
sub r12, 1
jne 0x140049f90
jmp 0x140049fcf
cmp r8d, r9d
jne 0x14004a13e
lea rax, [rbp + 0x10]
cmp rdi, rax
jbe 0x14004a081
lea rax, [rbp + 0x24]
cmp rdi, rax
jae 0x14004a081
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
mov byte [rdi + 0x13], r14b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x11], r13b
jmp 0x14004a114
movzx eax, byte [rsp + 0x50]
mov byte [rdi], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5f]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x60]
mov byte [rdi + 0x10], al
mov byte [rdi + 0x11], r13b
mov byte [rdi + 0x12], r15b
mov byte [rdi + 0x13], r14b
mov r8d, dword [rbp - 0x3c]
lea r9, [rbp - 0x3c]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x140049c82
cmp byte [rbp - 0x40], 0
sete al
jmp 0x140049c84
mov al, 1
jmp 0x140049c84