Function at 0x140021f70
Capabilities:
Access pe header
Access peb ldr_data
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov esi, r8d
mov rax, rcx
mov r14d, r8d
mov dword [rsp + 0x34], r8d
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rcx
xor ebx, ebx
mov edi, ebx
mov qword [r11 - 0x50], rbx
cmp qword [r11 + 0x28], rbx
je 0x140021fdd
mov eax, 0xc00000f3
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rax], rbx
test rdx, rdx
je 0x140021fe8
mov qword [rdx], rbx
lea rdx, [rsp + 0xc0]
mov rcx, r9
call fcn.140023f50
mov r13d, 0xc000007b
test al, al
jne 0x14002200e
bt esi, 0x1e
cmovae edi, r13d
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
jmp 0x140022044
test edi, edi
jns 0x14002205a
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
and esi, 0x10000000
mov r15d, esi
cmove r15d, r14d
mov dword [rsp + 0x34], r15d
mov r12, rbx
test esi, esi
cmove r12, rax
mov rax, rbx
cmove rax, rcx
mov qword [rsp + 0x38], rax
test r15b, 4
je 0x140022099
test r12, r12
je 0x14002234e
test rax, rax
je 0x14002234e
test r12, r12
je 0x1400221da
mov r15, 0xffffffffffffffff
nop dword [rax]
inc r15
cmp word [r12 + r15*2], 0
jne 0x1400220b0
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rsi, qword [rdx + 0x18]
add rsi, 0x10
mov qword [rsp + 0x40], rsi
mov r14, qword [rsi]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140022103
mov eax, r13d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp r14, rsi
je 0x1400221d5
mov rax, rsi
nop
mov rsi, r14
mov r14, qword [r14]
cmp qword [rsi + 0x10], 0
je 0x1400221cc
movsxd r8, r15d
movzx eax, word [rsi + 0x58]
shr rax, 1
sub rax, r8
test rax, 0xfffffffffffffffb
jne 0x1400221c7
mov rdx, qword [rsi + 0x60]
mov rcx, r12
call fcn.14022ff20
test eax, eax
jne 0x1400221c7
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r13, rax
test rax, rax
je 0x1400221c7
mov rdi, qword [rsi + 0x30]
test rdi, rdi
je 0x1400221a4
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400221a4
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
add rcx, 0x108
add rcx, rdi
movabs rax, 0xaabbcc11ffee00
cmp qword [rcx], rax
jne 0x1400221a4
cmp qword [rcx + 0x10], rdi
je 0x1400221a7
mov rcx, rbx
test rcx, rcx
je 0x1400221c7
mov eax, dword [r13 + 0x1c]
mov rdx, qword [rsp + 0x50]
cmp dword [rdx + 0x1c], eax
jne 0x1400221c7
mov eax, dword [r13 + 0x54]
cmp dword [rdx + 0x54], eax
je 0x1400222e6
mov rax, qword [rsp + 0x40]
cmp r14, rax
jne 0x140022110
mov r15d, dword [rsp + 0x34]
movabs rsi, 0xaabbcc11ffee00
mov r8d, dword [rsp + 0xc0]
mov rdx, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xa0]
mov rcx, r13
call fcn.140023070
test eax, eax
js 0x1400223fd
cmp eax, 0x4000000e
je 0x1400223fd
mov rdi, qword [r13]
test rdi, rdi
je 0x140022b73
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140022b73
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd r14, ecx
add r14, 0x108
add r14, rdi
cmp qword [r14], rsi
jne 0x140022b73
cmp qword [r14 + 0x10], rdi
jne 0x140022b73
or byte [r14 + 0xc], 2
mov rcx, qword [r13]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
mov eax, 0x400
test word [rdi + 0x5e], ax
je 0x140022286
or r15d, 1
mov rcx, qword [r13]
bt r15d, 0x1c
jae 0x14002240d
mov r8, r14
mov rdx, rdi
call fcn.14001ff90
mov esi, eax
test eax, eax
js 0x140022363
mov rdx, rdi
mov rcx, qword [r13]
call fcn.140022f80
mov esi, eax
test eax, eax
js 0x140022363
mov rcx, r14
call fcn.140023c10
test eax, eax
je 0x1400222dc
mov rcx, r14
call fcn.140023c80
test eax, eax
jne 0x140022363
mov esi, 0xc0000142
jmp 0x14002236b
test byte [rcx + 0xe], 8
je 0x14002234e
test byte [rsp + 0x34], 2
jne 0x14002234e
mov r8d, dword [rcx + 0x2c]
cmp r8d, 0xffffffff
je 0x14002231c
mov rax, qword [rcx + 0x38]
mov edx, 0xffff
cmp word [rax + 0x6c], dx
jne 0x140022315
mov dword [rcx + 0x2c], 0xffffffff
jmp 0x14002231c
lea eax, [r8 + 1]
mov dword [rcx + 0x2c], eax
mov rax, qword [rsi + 0x30]
mov r12, qword [rsp + 0xa0]
mov qword [r12], rax
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x14002233c
mov qword [rax], rsi
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xc00000f1
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test esi, esi
jns 0x1400223fb
mov rdi, qword [r13]
test rdi, rdi
je 0x1400223bc
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400223bc
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
movabs rax, 0xaabbcc11ffee00
cmp qword [rcx + rdi + 0x108], rax
jne 0x1400223bc
cmp qword [rcx + rdi + 0x118], rdi
jne 0x1400223bc
lea rbx, [rdi + 0x108]
add rbx, rcx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rbx, rbx
je 0x1400223fb
movzx eax, byte [rbx + 0xc]
and al, 6
cmp al, 2
je 0x1400223fb
cmp qword [rbx + 0x20], 0
je 0x1400223e3
mov rcx, rbx
call fcn.14001fed0
cmp qword [rbx + 0x10], 0
je 0x1400223fb
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, esi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x38]
mov r8, r12
mov edx, r15d
call fcn.140021d80
mov esi, eax
mov dword [rsp + 0x30], eax
mov r12, qword [rsp + 0x48]
test eax, eax
js 0x14002275e
or word [r14 + 0xe], 1
mov qword [r14 + 0x38], r12
mov r8, r14
mov rdx, rdi
mov rcx, qword [r13]
call fcn.14001ff90
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x14002275e
mov rdx, rdi
mov rcx, qword [r13]
call fcn.140022f80
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x14002275e
test r15b, 2
jne 0x140022487
or word [r14 + 0xe], 8
test r15b, 1
jne 0x1400224ad
mov edx, dword [rdi + 0x50]
mov rcx, qword [r14 + 0x10]
call fcn.140021350
mov esi, eax
mov dword [rsp + 0x30], eax
test eax, eax
js 0x14002275e
or word [r14 + 0xe], 2
mov r13, qword [r13]
test r13, r13
je 0x1400225df
cmp byte [0x1403990b0], 0
jne 0x1400225df
movsxd r12, dword [r13 + 0x3c]
add r12, r13
movzx eax, word [r12 + 0x14]
lea rdi, [r12 + 0x18]
add rdi, rax
mov r15d, ebx
cmp bx, word [r12 + 6]
jae 0x1400225df
nop dword [rax + rax]
mov eax, dword [rdi + 0xc]
add rax, r13
mov qword [rsp + 0x40], rax
mov rcx, rdi
call fcn.14001fdb0
test al, al
je 0x1400225c9
mov edx, dword [r12 + 0x38]
mov eax, dword [rdi + 8]
lea rcx, [rdx + 1]
add rcx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
mov qword [rsp + 0x50], rcx
mov edx, dword [rdi + 0x24]
mov ecx, edx
shr rcx, 0x1d
and ecx, 1
mov eax, edx
shr rax, 0x1e
and eax, 1
lea rcx, [rax + rcx*2]
mov eax, edx
shr rax, 0x1f
lea rdx, [rax + rcx*2]
lea rax, [0x140000000]
mov eax, dword [rax + rdx*4 + 0x34e680]
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x20], rcx
mov r9d, 4
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x1400225df
mov edx, dword [rdi + 8]
mov rcx, qword [rsp + 0x40]
call fcn.14001fb50
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x34]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
mov byte [0x1403990b0], 1
inc r15d
add rdi, 0x28
movzx eax, word [r12 + 6]
cmp r15d, eax
jb 0x1400224f0
mov rcx, r14
call fcn.140023c10
test eax, eax
je 0x14002277b
mov rcx, r14
call fcn.140023c80
test eax, eax
je 0x14002277b
mov r12, qword [rsp + 0xa0]
mov r12, qword [r12]
test r12, r12
je 0x140022759
cmp byte [0x1403990b0], 0
je 0x140022759
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd r15, dword [r12 + 0x3c]
add r15, r12
movzx eax, word [r15 + 0x14]
lea rdi, [r15 + 0x18]
add rdi, rax
mov r14d, ebx
cmp bx, word [r15 + 6]
jae 0x140022752
nop
mov eax, dword [rdi + 0xc]
add rax, r12
mov qword [rsp + 0x40], rax
mov rcx, rdi
call fcn.14001fdb0
test al, al
je 0x14002273d
mov edx, dword [r15 + 0x38]
mov eax, dword [rdi + 8]
lea rcx, [rdx + 1]
add rcx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
mov qword [rsp + 0x50], rcx
mov r13d, dword [rdi + 0x24]
mov ecx, r13d
shr rcx, 0x1d
and ecx, 1
mov eax, r13d
shr rax, 0x1e
and eax, 1
lea rcx, [rax + rcx*2]
mov eax, r13d
shr rax, 0x1f
lea rdx, [rax + rcx*2]
lea rax, [0x140000000]
mov eax, dword [rax + rdx*4 + 0x34e680]
mov dword [rsp + 0xc0], eax
and r13d, 0x4000000
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x140022759
mov edx, dword [rdi + 8]
mov rcx, qword [rsp + 0x40]
call fcn.14001fb50
mov r9d, dword [rsp + 0xc0]
bts r9d, 9
test r13d, r13d
cmove r9d, dword [rsp + 0xc0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
inc r14d
add rdi, 0x28
movzx eax, word [r15 + 6]
cmp r14d, eax
jb 0x140022650
mov byte [0x1403990b0], 0
mov r12, qword [rsp + 0x48]
test esi, esi
js 0x140022784
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x1400223fb
mov qword [rax], r12
jmp 0x1400223fb
mov esi, 0xc0000142
mov dword [rsp + 0x30], esi
mov r12, qword [rsp + 0xa0]
mov rdi, qword [r12]
mov r13d, ebx
test rdi, rdi
jne 0x1400227a4
movabs r15, 0xaabbcc11ffee00
jmp 0x1400227e3
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
movabs r15, 0xaabbcc11ffee00
test rax, rax
je 0x1400227e3
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd r14, ecx
add r14, 0x108
add r14, rdi
cmp qword [r14], r15
jne 0x1400227e3
cmp qword [r14 + 0x10], rdi
je 0x1400227e6
mov r14, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9, rax
test r14, r14
je 0x140022b6a
movzx edx, byte [r14 + 0xc]
test dl, 2
je 0x140022b6a
movzx r8d, word [r14 + 0xe]
test r8b, 1
jne 0x1400228b1
or dl, 4
mov byte [r14 + 0xc], dl
test rdi, rdi
je 0x140022859
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140022859
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd r14, ecx
add r14, 0x108
add r14, rdi
cmp qword [r14], r15
jne 0x140022859
cmp qword [r14 + 0x10], rdi
je 0x14002285c
mov r14, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test r14, r14
je 0x140022b6a
movzx eax, byte [r14 + 0xc]
and al, 6
cmp al, 2
je 0x140022b6a
cmp qword [r14 + 0x20], 0
je 0x14002288c
mov rcx, r14
call fcn.14001fed0
cmp qword [r14 + 0x10], 0
je 0x140022b6a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [r12], rbx
jmp 0x1400223fb
mov r15, qword [r14 + 0x38]
mov eax, dword [r15 + 0x40]
cmp dword [r9 + 0x50], eax
je 0x1400228c6
mov ecx, 7
int 0x29
test r8b, 8
je 0x1400228d0
mov r13d, dword [r14 + 0x2c]
test r13d, 0xfffffffe
je 0x14002291a
mov eax, dword [r14 + 0x2c]
cmp eax, 0xffffffff
je 0x140022b6a
mov edx, 0xffff
cmp word [r15 + 0x6c], dx
jne 0x140022903
mov dword [r14 + 0x2c], 0xffffffff
mov qword [r12], rbx
jmp 0x1400223fb
test eax, eax
je 0x140022b6a
dec eax
mov dword [r14 + 0x2c], eax
mov qword [r12], rbx
jmp 0x1400223fb
or dl, 4
mov byte [r14 + 0xc], dl
test dl, 1
je 0x140022938
mov rcx, qword [r14 + 0x10]
mov eax, dword [r9 + 0x28]
add rax, rcx
xor r8d, r8d
xor edx, edx
call rax
movzx eax, word [r14 + 0xe]
test al, 1
je 0x140022ac7
test al, 2
je 0x14002295c
mov rcx, rdi
call fcn.1400214f0
test eax, eax
jns 0x14002295c
mov ecx, 3
int 0x29
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x30]
mov rdx, qword [0x140398f48]
movzx eax, byte [rdx + 0x14]
dec eax
cmp eax, 8
ja case.default.0x140022997
cdqe
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x22b8c]
add rcx, r8
jmp rcx
mov rcx, r15
call fcn.140021610
mov r8, qword [r15 + 0x98]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdx, qword [0x140398f48]
mov rcx, qword [rdx + 0x48]
mov rax, qword [rcx + 0x18]
test rax, rax
je case.0x140022997.2
lea rdx, [r15 + 0xc8]
mov rcx, qword [rcx]
call rax
mov rdx, qword [0x140398f48]
movzx eax, word [rdx + 0x16]
mov ecx, reloc.OLEAUT32.dll_SetErrorInfo
cmp ax, cx
je 0x1400229f2
mov ecx, 0xe0
cmp ax, cx
jne case.0x140022997.1
lea r12, [r15 + 0x98]
mov rsi, qword [r12]
cmp r12, rsi
je 0x140022a27
mov rcx, qword [rsi + 0x10]
mov rcx, qword [rcx + 0x30]
call qword [0x140398ff0]
mov rsi, qword [rsi]
mov r8, qword [rsi + 8]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp r12, rsi
jne 0x140022a02
mov r12, qword [rsp + 0xa0]
mov r8, qword [r15 + 0x60]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8, qword [r15 + 0x50]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword [0x140398f48]
cmp byte [rax + 0x14], 3
jne 0x140022a95
mov rcx, qword [r15]
mov rax, qword [r15 + 8]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x18]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rdx, qword [r15 + 0x20]
mov rax, qword [r15 + 0x28]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov rdx, qword [r15 + 0x70]
mov rax, qword [r15 + 0x78]
mov qword [rax], rdx
mov qword [rdx + 8], rax
mov r8, r15
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r15d, 1
mov eax, r15d
jmp 0x140022ab6
mov eax, ebx
mov r15d, 1
test eax, eax
jne 0x140022ac1
mov ecx, 7
int 0x29
mov esi, dword [rsp + 0x30]
jmp 0x140022acd
mov r15d, 1
test rdi, rdi
je 0x140022b11
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x140022b11
movsxd rdx, dword [rdi + 0x3c]
movzx ecx, word [rdx + rdi + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd r14, ecx
add r14, 0x108
add r14, rdi
movabs rax, 0xaabbcc11ffee00
cmp qword [r14], rax
jne 0x140022b11
cmp qword [r14 + 0x10], rdi
je 0x140022b14
mov r14, rbx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test r14, r14
jne 0x140022b27
mov r15d, ebx
jmp 0x140022b5e
movzx eax, byte [r14 + 0xc]
and al, 6
cmp al, 2
jne 0x140022b37
mov r15d, ebx
jmp 0x140022b5e
cmp qword [r14 + 0x20], 0
je 0x140022b46
mov rcx, r14
call fcn.14001fed0
cmp qword [r14 + 0x10], 0
je 0x140022b5e
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15d, r15d
jne 0x140022b6a
mov ecx, 7
int 0x29
mov qword [r12], rbx
jmp 0x1400223fb
mov ecx, 7
int 0x29
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ecx, 0xc0000141
call qword [sym.imp.KERNEL32.dll_ExitProcess]