Function at 0x140004010
Capabilities:
Allocate or change rwx memory
Link many functions at runtime
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1401d60c0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1401b7948]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x39], rax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1401b7960]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x31], rax
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RegOpenKeyA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x29], rax
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1401b79b8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x21], rax
lea rcx, [0x1401b79e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x19], rax
lea rcx, [0x1401b79e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x11], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetVolumeInformationA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 9], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1401b7a30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 1], rax
lea rcx, [0x1401b79e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 7], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], r15
mov ecx, 0x48
call fcn.1400f4f3c
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
lea rbx, [rax + 0x48]
mov qword [rbp + 0x2f], rbx
mov r8d, 0x48
lea rdx, [rbp - 0x39]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x27], rbx
mov r9, qword [rbp + 0x1f]
cmp r9, rbx
je 0x140004240
mov r8, qword [r9]
mov eax, dword [r8]
mov dword [rbp - 0x59], eax
movzx eax, word [r8 + 4]
mov word [rbp - 0x55], ax
movzx eax, byte [r8 + 6]
mov byte [rbp - 0x53], al
mov eax, dword [r8]
mov dword [rbp - 0x52], eax
movzx eax, word [r8 + 4]
mov word [rbp - 0x4e], ax
movzx eax, byte [r8 + 6]
mov byte [rbp - 0x4c], al
movsd xmm0, qword [rbp - 0x59]
movsd qword [rbp - 0x49], xmm0
mov eax, dword [rbp - 0x51]
mov dword [rbp - 0x41], eax
movzx eax, word [rbp - 0x4d]
mov word [rbp - 0x3d], ax
mov edx, r15d
lea rax, [rbp - 0x49]
lea rcx, [rbp - 0x49]
sub r8, rcx
nop word [rax + rax]
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x140004328
inc edx
inc rax
cmp edx, 7
jb 0x140004220
add r9, 8
cmp r9, rbx
jne 0x1400041c0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400042ae
lea rdx, str.DbgUiRemoteBreakin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x1400042ae
mov ebx, dword [rax]
movzx edi, word [rax + 4]
movzx esi, byte [rax + 6]
lea r9, [rbp + 0x17]
mov edx, 7
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [r14], ebx
mov word [r14 + 4], di
mov byte [r14 + 6], sil
lea r9, [rbp + 0x17]
mov r8d, dword [rbp + 0x17]
mov edx, 7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
call fcn.140003cd0
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
sub rcx, rdx
sar rcx, 3
cmp rcx, 1
jbe 0x140004356
mov qword [rdx + 8], rbx
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x140004041
mov rdx, qword [rbp + 0x2f]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000431e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000434f
call fcn.1400f4de8
jmp 0x140004041
lea rdx, str.Hooks_detected__Exiting.
lea rcx, [0x1401d9600]
call fcn.1400071a0
mov rcx, rax
call fcn.140005c30
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140006480
int3