Function at 0x14008bca0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
movzx r15d, r9b
mov r14, rdx
mov r12, rcx
mov rsi, qword [rbp + 0x240]
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x14008bd51
mov rax, qword [0x140103488]
cmp rax, 0xc
jb 0x14008bd34
lea rdi, [0x140103470]
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0xc
mov r8d, 0xc
lea rdx, str.Invalid_file
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0xc], 0
jmp 0x14008d22e
lea r9, str.Invalid_file
mov edx, 0xc
lea rcx, [0x140103470]
call fcn.14007d2f0
jmp 0x14008d22e
movsxd r13, dword [rdx + 0x3c]
add r13, r14
mov eax, 0x8664
cmp word [r13 + 4], ax
mov rax, qword [0x140103488]
je 0x14008bdca
cmp rax, 0x10
jb 0x14008bdad
lea rdi, [0x140103470]
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x10
mov r8d, 0x10
lea rdx, str.Invalid_platform
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x10], 0
jmp 0x14008d22e
lea r9, str.Invalid_platform
mov edx, 0x10
lea rcx, [0x140103470]
call fcn.14007d2f0
jmp 0x14008d22e
lea rdi, [0x140103470]
cmp rax, 7
jb 0x14008be0c
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 7
mov r8d, 7
lea rdx, str.File_ok
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x14008be20
lea r9, str.File_ok
mov edx, 7
mov rcx, rdi
call fcn.14007d2f0
mov r8d, dword [r13 + 0x50]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rbp + 0x1a8], rax
test rax, rax
jne 0x14008bf52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x68]
call fcn.14008e590
nop
mov r8, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
sub rax, r8
lea r15d, [rbx + 0x2d]
lea r14, str.Target_process_memory_allocation_failed__ex_
cmp rax, r15
jb 0x14008bef7
lea rax, [r8 + 0x2d]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x68]
lea rax, [0x1400ed1b5]
cmp rax, rbx
jbe 0x14008bebb
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008bebb
cmp rbx, r14
ja 0x14008beb3
xor esi, esi
jmp 0x14008bebe
mov rsi, rbx
sub rsi, r14
jmp 0x14008bebe
mov rsi, r15
inc r8
lea rcx, [rbx + 0x2d]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x2d]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x68]
jmp 0x14008bf0d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp - 0x68]
jmp 0x14008d229
mov dword [rbp + 0x1b0], 0
mov r8d, dword [r13 + 0x50]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
mov qword [rbp + 0x140], rcx
mov dword [rbp + 0x14c], ecx
mov dword [rbp + 0x15c], ecx
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x120], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
mov rax, qword [sym.imp.KERNEL32.dll_RtlAddFunctionTable]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rbx
mov eax, dword [rbp + 0x238]
mov dword [rbp + 0x148], eax
mov qword [rbp + 0x150], rsi
movzx eax, byte [rbp + 0x230]
mov dword [rbp + 0x158], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0x1000
mov r8, r14
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c132
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x48]
call fcn.14008e590
nop
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
mov r14d, 0x18
lea r15, str.Cant_write_file_header
cmp rax, r14
jb 0x14008c0bd
lea rax, [r8 + 0x18]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x48]
lea rax, [0x1400ed1d0]
cmp rax, rbx
jbe 0x14008c077
lea rax, [rbx + r8]
cmp r15, rax
ja 0x14008c077
cmp rbx, r15
ja 0x14008c06f
xor esi, esi
jmp 0x14008c07a
mov rsi, rbx
sub rsi, r15
jmp 0x14008c07a
mov rsi, r14
inc r8
lea rcx, [rbx + 0x18]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r14, rsi
lea rdx, [0x1400ed1d0]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x48]
mov rbx, qword [rbp + 0x1a8]
jmp 0x14008c0d3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp - 0x48]
call fcn.1400664c0
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x14008d22e
movzx ebx, word [r13 + 0x14]
add rbx, 0x2c
xor esi, esi
cmp word [r13 + 6], si
je 0x14008c18a
add rbx, r13
mov eax, dword [rbx - 4]
test eax, eax
je 0x14008c17b
mov r9d, eax
mov r8d, dword [rbx]
add r8, r14
mov edx, dword [rbx - 8]
add rdx, qword [rbp + 0x1a8]
mov qword [rsp + 0x20], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14008c22e
inc esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008c147
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x14008c3e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 8]
call fcn.14008e590
nop
mov r8, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
sub rax, r8
lea r15d, [r14 + 0x2e]
lea r14, str.Target_process_mapping_allocation_failed__ex_
cmp rax, r15
jb 0x14008c382
lea rax, [r8 + 0x2e]
mov qword [rbp + 8], rax
lea rbx, [rbp - 8]
cmp rcx, 0xf
cmova rbx, qword [rbp - 8]
lea rax, [0x1400ed21e]
cmp rax, rbx
jbe 0x14008c346
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c346
cmp rbx, r14
ja 0x14008c33e
xor esi, esi
jmp 0x14008c349
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp - 0x28]
call fcn.14008e590
nop
mov r8, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
sub rax, r8
mov r15d, 0x14
lea r14, str.Cant_map_sections:
cmp rax, r15
jb 0x14008c2d7
lea rax, [r8 + 0x14]
mov qword [rbp - 0x18], rax
lea rbx, [rbp - 0x28]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x28]
lea rax, [0x1400ed1ec]
cmp rax, rbx
jbe 0x14008c29b
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c29b
cmp rbx, r14
ja 0x14008c293
xor esi, esi
jmp 0x14008c29e
mov rsi, rbx
sub rsi, r14
jmp 0x14008c29e
mov rsi, r15
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x14]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x28]
jmp 0x14008c2ed
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp - 0x28]
call fcn.1400664c0
mov rdx, qword [rbp + 0x1a8]
jmp 0x14008c11b
mov rsi, rbx
sub rsi, r14
jmp 0x14008c349
mov rsi, r15
inc r8
lea rcx, [rbx + 0x2e]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x2e]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 8]
jmp 0x14008c398
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp - 8]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp - 8]
call fcn.1400664c0
mov rdx, qword [rbp + 0x1a8]
jmp 0x14008c11b
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x40]
lea r8, [rbp + 0x120]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c52e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.14008e590
nop
mov r8, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
sub rax, r8
lea r15d, [rsi + 0x14]
lea r14, str.Cant_write_mapping
cmp rax, r15
jb 0x14008c4b4
lea rax, [r8 + 0x14]
mov qword [rbp + 0x28], rax
lea rbx, [rbp + 0x18]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x18]
lea rax, [0x1400ed234]
cmp rax, rbx
jbe 0x14008c476
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c476
cmp rbx, r14
jbe 0x14008c479
mov rsi, rbx
sub rsi, r14
jmp 0x14008c479
mov rsi, r15
inc r8
lea rcx, [rbx + 0x14]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x14]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x18]
xor esi, esi
jmp 0x14008c4ca
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x18]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp + 0x18]
call fcn.1400664c0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x60]
jmp 0x14008c11b
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14008c65d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x38]
call fcn.14008e590
nop
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
sub rax, r8
lea r14d, [rbx + 0x27]
lea r15, str.Memory_shellcode_allocation_failed__ex_
cmp rax, r14
jb 0x14008c606
lea rax, [r8 + 0x27]
mov qword [rbp + 0x48], rax
lea rbx, [rbp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x38]
lea rax, [0x1400ed25f]
cmp rax, rbx
jbe 0x14008c5c5
lea rax, [rbx + r8]
cmp r15, rax
ja 0x14008c5c5
cmp rbx, r15
jbe 0x14008c5c8
mov rsi, rbx
sub rsi, r15
jmp 0x14008c5c8
mov rsi, r14
inc r8
lea rcx, [rbx + 0x27]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r14, rsi
lea rdx, [0x1400ed25f]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x38]
xor esi, esi
jmp 0x14008c61c
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r14
lea rcx, [rbp + 0x38]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp + 0x38]
jmp 0x14008c506
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
lea r8, [0x14008d260]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008c7bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x58]
call fcn.14008e590
nop
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
sub rax, r8
mov r15d, 0x16
lea r14, str.Cant_write_shellcode
cmp rax, r15
jb 0x14008c733
lea rax, [r8 + 0x16]
mov qword [rbp + 0x68], rax
lea rbx, [rbp + 0x58]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x58]
lea rax, [0x1400ed276]
cmp rax, rbx
jbe 0x14008c6f0
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c6f0
cmp rbx, r14
jbe 0x14008c6f3
mov rsi, rbx
sub rsi, r14
jmp 0x14008c6f3
mov rsi, r15
inc r8
lea rcx, [rbx + 0x16]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x16]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x58]
mov rbx, qword [rsp + 0x68]
xor esi, esi
jmp 0x14008c749
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x58]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp + 0x58]
call fcn.1400664c0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x14008c118
mov rax, qword [0x140103488]
cmp rax, 0xe
jb 0x14008c806
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0xe
mov r8d, 0xe
lea rdx, str.Data_allocated
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xe], sil
mov rbx, qword [rsp + 0x68]
jmp 0x14008c81a
lea r9, str.Data_allocated
mov edx, 0xe
mov rcx, rdi
call fcn.14007d2f0
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x14008c952
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0x78]
call fcn.14008e590
nop
mov r8, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
sub rax, r8
mov r15d, 0x17
lea r14, str.Thread_creation_failed
cmp rax, r15
jb 0x14008c8fb
lea rax, [r8 + 0x17]
mov qword [rbp + 0x88], rax
lea rbx, [rbp + 0x78]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x78]
lea rax, [0x1400ed29f]
cmp rax, rbx
jbe 0x14008c8b8
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14008c8b8
cmp rbx, r14
jbe 0x14008c8bb
mov rsi, rbx
sub rsi, r14
jmp 0x14008c8bb
mov rsi, r15
inc r8
lea rcx, [rbx + 0x17]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub r15, rsi
lea rdx, [r14 + 0x17]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x78]
mov rbx, qword [rsp + 0x68]
xor esi, esi
jmp 0x14008c911
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov rdx, r15
lea rcx, [rbp + 0x78]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp + 0x78]
jmp 0x14008c785
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140103488]
cmp rax, 0x25
jb 0x14008c99d
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x25
mov r8d, 0x25
lea rdx, str.Thread_created__waiting_for_return...
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x25], sil
jmp 0x14008c9c0
lea r9, str.Thread_created__waiting_for_return...
mov edx, 0x25
mov rcx, rdi
call fcn.14007d2f0
nop dword [rax]
nop word [rax + rax]
mov dword [rbp + 0x1a0], esi
lea rdx, [rbp + 0x1a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rbp + 0x1a0]
cmp edx, 0x103
jne 0x14008d113
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp + 0x180]
cmp rsi, 0x404040
je 0x14008d088
cmp rsi, 0x505050
jne 0x14008ca98
mov rax, qword [0x140103488]
cmp rax, 0x22
jb 0x14008ca84
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x22
mov r8d, 0x22
lea rdx, str.WARNING:_Exception_support_failed_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x22], 0
jmp 0x14008ca98
lea r9, str.WARNING:_Exception_support_failed_
mov edx, 0x22
mov rcx, rdi
call fcn.14007d2f0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rsi, rsi
mov esi, 0
je 0x14008c9c0
mov ecx, 0x1400000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x14008cb22
mov rax, qword [0x140103488]
cmp rax, 0x19
jb 0x14008cb09
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x19
lea r8d, [rsi + 0x19]
lea rdx, str.Unable_to_allocate_memory
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x19], sil
jmp 0x14008d22e
lea r9, str.Unable_to_allocate_memory
mov edx, 0x19
mov rcx, rdi
call fcn.14007d2f0
jmp 0x14008d22e
xor edx, edx
mov r8d, 0x1400000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r14, qword [rbp + 0x1a8]
test r15b, r15b
je 0x14008cbb0
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
mov r8, rbx
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008cbb0
mov rax, qword [0x140103488]
cmp rax, 0x1c
jb 0x14008cb9c
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov esi, 0x1c
mov qword [0x140103480], rsi
mov r8d, esi
lea rdx, str.WARNING_:_Cant_clear_HEADER
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1c], 0
jmp 0x14008cbb0
lea r9, str.WARNING_:_Cant_clear_HEADER
mov edx, 0x1c
mov rcx, rdi
call fcn.14007d2f0
cmp byte [rbp + 0x220], 0
je 0x14008ce68
movzx ebx, word [r13 + 0x14]
add rbx, 0x18
add rbx, r13
xor esi, esi
mov dword [rbp + 0x1a0], esi
cmp word [r13 + 6], si
je 0x14008ce68
lea r15d, [rsi + 0x14]
lea r8, [0x1400ed368]
lea r9, str..rsrc
lea r10, str..reloc
mov edx, dword [rbx + 8]
test edx, edx
je 0x14008ce4f
cmp byte [rbp + 0x230], 0
jne 0x14008cc26
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x14008cc26
cmp rcx, 7
jne 0x14008cc10
jmp 0x14008cc68
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x14008cc46
cmp rcx, 6
jne 0x14008cc30
jmp 0x14008cc68
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r10 + rcx - 1]
jne 0x14008ce4f
cmp rcx, 7
jne 0x14008cc50
mov r9, rdx
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008ce3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rbp + 0xd8]
call fcn.14008e590
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], al
jne 0x14008ccc0
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140065b50
nop
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
sub rax, r8
cmp rax, 0x14
jb 0x14008cd89
lea rax, [r8 + 0x14]
mov qword [rbp - 0x78], rax
lea rsi, [rsp + 0x78]
cmp rcx, 0xf
cmova rsi, qword [rsp + 0x78]
lea rax, [0x1400ed394]
cmp rax, rsi
jbe 0x14008cd34
lea rax, [rsi + r8]
lea rcx, str.Cant_clear_section
cmp rcx, rax
ja 0x14008cd34
cmp rsi, rcx
ja 0x14008cd2c
xor r14d, r14d
jmp 0x14008cd37
mov r14, rsi
sub r14, rcx
jmp 0x14008cd37
mov r14, r15
inc r8
lea rcx, [rsi + 0x14]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
lea rdx, str.Cant_clear_section
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
sub r8, r14
lea rdx, str.Cant_clear_section
add rdx, 0x14
add rdx, r14
lea rcx, [rsi + r14]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x78]
mov esi, dword [rbp + 0x1a0]
mov r14, qword [rbp + 0x1a8]
jmp 0x14008cda7
mov qword [rsp + 0x28], r15
lea rax, str.Cant_clear_section
mov qword [rsp + 0x20], rax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140085110
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xor ecx, ecx
mov qword [rbp + 0xc8], rcx
mov qword [rbp + 0xd0], rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0xf
mov byte [rax], cl
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xf8]
call fcn.14008e620
mov rdx, rax
mov rcx, rdi
call fcn.140075050
lea rcx, [rbp + 0xf8]
call fcn.1400664c0
nop
lea rcx, [rbp + 0xb8]
call fcn.1400664c0
nop
lea rcx, [rsp + 0x78]
call fcn.1400664c0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400664c0
lea r10, str..reloc
lea r9, str..rsrc
lea r8, [0x1400ed368]
inc esi
mov dword [rbp + 0x1a0], esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008cbf5
cmp byte [rbp + 0x228], 0
je 0x14008cf20
movzx ebx, word [r13 + 0x14]
add rbx, 0x3c
xor esi, esi
cmp word [r13 + 6], si
je 0x14008ceee
add rbx, r13
lea r15d, [rsi + 0x20]
nop
mov ecx, dword [rbx - 0x1c]
test ecx, ecx
je 0x14008cedf
mov dword [rbp + 0x1a0], 0
mov eax, dword [rbx]
test eax, 0x80000000
jbe 0x14008ceb2
mov r9d, 4
jmp 0x14008cec1
test eax, 0x20000000
mov r9d, 2
cmova r9d, r15d
mov r8, rcx
mov edx, dword [rbx - 0x18]
add rdx, r14
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc esi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp esi, eax
jne 0x14008ce90
mov dword [rbp + 0x1a8], 0
movzx eax, word [r13 + 0x14]
mov r8d, dword [rax + r13 + 0x24]
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14008cf9f
mov rax, qword [0x140103488]
cmp rax, 0x1e
jb 0x14008cf8b
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x1e
mov r8d, 0x1e
lea rdx, str.WARNING:_Cant_clear_shellcode
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x1e], 0
jmp 0x14008cf9f
lea r9, str.WARNING:_Cant_clear_shellcode
mov edx, 0x1e
mov rcx, rdi
call fcn.14007d2f0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x14008d00e
mov rax, qword [0x140103488]
cmp rax, 0x28
jb 0x14008cffa
mov rbx, rdi
cmp rax, 0xf
cmova rbx, qword [0x140103470]
mov qword [0x140103480], 0x28
mov r8d, 0x28
lea rdx, str.WARNING:_cant_release_shell_code_memory
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x28], 0
jmp 0x14008d00e
lea r9, str.WARNING:_cant_release_shell_code_memory
mov edx, 0x28
mov rcx, rdi
call fcn.14007d2f0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test eax, eax
jne 0x14008d081
mov rax, qword [0x140103488]
cmp rax, 0x2a
jb 0x14008d06d
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x2a
mov r8d, 0x2a
lea rdx, str.WARNING:_cant_release_mapping_data_memory
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x2a], 0
mov al, 1
jmp 0x14008d230
lea r9, str.WARNING:_cant_release_mapping_data_memory
mov edx, 0x2a
mov rcx, rdi
call fcn.14007d2f0
mov al, 1
jmp 0x14008d230
mov rax, qword [0x140103488]
cmp rax, 0x11
jb 0x14008d0c7
cmp rax, 0xf
cmova rdi, qword [0x140103470]
mov qword [0x140103480], 0x11
mov r8d, 0x11
lea rdx, str.Wrong_mapping_ptr
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + 0x11], 0
jmp 0x14008d0db
lea r9, str.Wrong_mapping_ptr
mov edx, 0x11
mov rcx, rdi
call fcn.14007d2f0
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rsp + 0x68]
jmp 0x14008c11b
lea rcx, [rbp + 0x98]
call fcn.14008e590
nop
mov r8, qword [rbp + 0xa8]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
sub rax, r8
mov esi, 0x1c
lea r15, str.Process_crashed__exit_code:
cmp rax, rsi
jb 0x14008d1cd
lea rax, [r8 + 0x1c]
mov qword [rbp + 0xa8], rax
lea rbx, [rbp + 0x98]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x98]
lea rax, [0x1400ed2e4]
cmp rax, rbx
jbe 0x14008d18e
lea rax, [rbx + r8]
cmp r15, rax
ja 0x14008d18e
cmp rbx, r15
ja 0x14008d186
xor r14d, r14d
jmp 0x14008d191
mov r14, rbx
sub r14, r15
jmp 0x14008d191
mov r14, rsi
inc r8
lea rcx, [rbx + 0x1c]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, r14
mov rdx, r15
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
sub rsi, r14
lea rdx, [r15 + 0x1c]
add rdx, r14
lea rcx, [rbx + r14]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x98]
jmp 0x14008d1e6
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rdx, rsi
lea rcx, [rbp + 0x98]
call fcn.140085110
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140075050
lea rcx, [rsp + 0x40]
call fcn.1400664c0
nop
lea rcx, [rbp + 0x98]
call fcn.1400664c0
xor al, al
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.1400af820
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret