Function at 0x14000d168
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov edx, 0x11c
lea rdi, [rbp - 0x10]
mov ecx, edx
xor eax, eax
rep stosb byte [rdi], al
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], edx
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov ecx, dword [rbp - 0xc]
movzx eax, word [rbp + 0x104]
shl ecx, 4
or ecx, dword [rbp - 8]
shl ecx, 4
or ecx, eax
cmp ecx, 0x611
jb 0x14000dbce
mov ebx, 1
cmp byte [rbp + 0x10a], bl
jne 0x14000dbce
xor edi, edi
mov dword [rsp + 0x28], 0x60
lea rax, [rsp + 0x50]
mov qword [rbp + 0x150], rdi
mov qword [rbp - 0x60], rax
lea r9, [rbp - 0x28]
lea rax, [rbp - 0x68]
mov qword [rbp + 0x148], rdi
xorps xmm0, xmm0
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x58]
mov qword [rbp + 0x158], rdi
mov edx, 0x100001
mov qword [rbp + 0x140], rdi
lea rcx, [rbp + 0x150]
mov dword [rsp + 0x50], 0x53005c
mov dword [rsp + 0x54], 0x730079
mov dword [rsp + 0x58], 0x650074
mov dword [rsp + 0x5c], 0x52006d
mov dword [rsp + 0x60], 0x6f006f
mov dword [rsp + 0x64], 0x5c0074
mov dword [rsp + 0x68], 0x790053
mov dword [rsp + 0x6c], 0x740073
mov dword [rsp + 0x70], 0x6d0065
mov dword [rsp + 0x74], 0x320033
mov dword [rsp + 0x78], 0x6e005c
mov dword [rsp + 0x7c], 0x640074
mov dword [rbp - 0x80], 0x6c006c
mov dword [rbp - 0x7c], 0x64002e
mov dword [rbp - 0x78], 0x6c006c
mov word [rbp - 0x74], di
mov dword [rbp - 0x68], 0x3e003c
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], rdi
mov dword [rbp - 0x40], 0x40
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
js 0x14000dbd0
mov rax, qword [rbp + 0x150]
lea esi, [rbx + 1]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x148]
mov dword [rsp + 0x28], 0x11000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
mov edx, 0xf001f
call qword [sym.imp.ntdll.dll_ZwCreateSection]
test eax, eax
js 0x14000d35c
mov rcx, qword [rbp + 0x148]
lea rax, [rbp + 0x158]
mov dword [rsp + 0x48], esi
lea r8, [rbp + 0x140]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], esi
or rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [0x1400736e8]
mov rcx, qword [rbp + 0x140]
test eax, eax
cmovs rcx, rdi
mov qword [rbp + 0x140], rcx
mov rcx, qword [rbp + 0x148]
call qword [0x140073728]
mov rcx, qword [rbp + 0x150]
call qword [0x140073728]
mov r14, qword [rbp + 0x140]
test r14, r14
je 0x14000dbd0
mov rax, qword gs:[0x60]
mov edx, 8
mov r8d, 0x2000
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x14000d3a4
lea ecx, [rax + 7]
int 0x29
mov byte [rsp + 0x28], bl
lea r9, [rbp - 0x70]
mov edx, 0xe529ae25
mov qword [rsp + 0x20], rdi
mov rcx, r14
call fcn.140007d70
test eax, eax
mov eax, edi
js 0x14000d3d9
mov rcx, qword [rbp - 0x70]
inc eax
cmp byte [rcx], 0xb8
je 0x14000d3d9
add rcx, rbx
cmp eax, 0x20
jbe 0x14000d3c8
mov eax, edi
mov dword [rsi + 0x1ffc], eax
test eax, eax
jne 0x14000d3e8
lea ecx, [rax + 7]
int 0x29
lea r9, [0x14000d0f8]
mov r8, rsi
mov rcx, r14
call fcn.140007f1c
mov edx, 0xc9597cb6
mov rcx, rsi
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071904], eax
mov edx, 0x740a82b1
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071874], eax
mov edx, 0x7ce38f6b
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071834], eax
mov edx, 0x620bffbb
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xd285de1
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718a0], eax
mov edx, 0x6080cb66
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718f4], eax
mov edx, 0x84e400db
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x6914534e
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718c4], eax
mov edx, 0xb3e3763a
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007191c], eax
mov edx, 0x36084350
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071838], eax
mov edx, 0xa642a5c4
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007189c], eax
mov edx, 0x167853dd
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071854], eax
mov edx, 0x5ec96e41
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x48e5eb76
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb0789a99
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718f0], eax
mov edx, 0xff28e007
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xd897a4aa
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x235474cc
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718a8], eax
mov edx, 0x686f7524
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071858], eax
mov edx, 0xb3771995
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x320e3d63
call fcn.14000d0c8
mov dword [0x1400718b0], eax
mov edx, 0x990598c
mov rcx, rsi
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071888], eax
mov edx, 0x96e06421
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x21f7a67b
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007187c], eax
mov edx, 0xbb231560
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071804], eax
mov edx, 0x60571f08
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071908], eax
mov edx, 0xa579fa87
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718c0], eax
mov edx, 0xbd2696d0
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718cc], eax
mov edx, 0x7781eb9
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x61830146
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x6ae7e078
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xd8ba38fa
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071850], eax
mov edx, 0x3c46af44
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007184c], eax
mov edx, 0x183d9940
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071894], eax
mov edx, 0xbcf14c0d
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071810], eax
mov edx, 0x29957893
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007190c], eax
mov edx, 0x7aa531cc
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718bc], eax
mov edx, 0xef074467
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718c8], eax
mov edx, 0x68ac234e
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718d4], eax
mov edx, 0x27654ac7
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718e4], eax
mov edx, 0xe97256d6
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071868], eax
mov edx, 0xbdab1266
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xaf948374
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071918], eax
mov edx, 0x5ee40b49
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071840], eax
mov edx, 0x9f6b065f
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007182c], eax
mov edx, 0xd68720bc
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071830], eax
mov edx, 0x2028b919
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x506a2cd
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x19629ee6
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718d8], eax
mov edx, 0xe21c3853
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb03e0dae
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718ec], eax
mov edx, 0x655ed983
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071848], eax
mov edx, 0xf0b56e35
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x8333964b
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x850572
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071898], eax
mov edx, 0xf473d4f2
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x16d2f65c
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007188c], eax
mov edx, 0xba697f0e
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718fc], eax
mov edx, 0x822fbb45
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718f8], eax
mov edx, 0xae2ad080
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071814], eax
mov edx, 0xa8476cdd
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071828], eax
mov edx, 0xff4af625
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb54818d5
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718b4], eax
mov edx, 0x90bcdd94
call fcn.14000d0c8
mov dword [0x140071870], eax
mov rcx, rsi
mov edx, 0xde7d9e31
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb9bb22b7
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x974f7cc3
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071800], eax
mov edx, 0x8d95af7e
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007183c], eax
mov edx, 0x55c2a1de
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718e8], eax
mov edx, 0xfac2df78
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x67303469
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007181c], eax
mov edx, 0x72d7075c
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071914], eax
mov edx, 0x6b671df2
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718dc], eax
mov edx, 0x937a6dc4
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071878], eax
mov edx, 0xad58979a
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718d0], eax
mov edx, 0x236f9de7
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x8fb148ea
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xbadf28a1
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007180c], eax
mov edx, 0xd7976426
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x8407a379
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071824], eax
mov edx, 0x2ee6d5de
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718ac], eax
mov edx, 0x58dc28f0
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x10512452
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071884], eax
mov edx, 0x46662abb
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x843b86b3
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xcd5732e9
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718a4], eax
mov edx, 0xcaf95c04
call fcn.14000d0c8
mov dword [0x1400718e0], eax
mov edx, 0x3f2dbb51
mov rcx, rsi
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x34d40bb8
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071860], eax
mov edx, 0x7a4d3423
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x66bff3b7
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x914c1ff2
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071890], eax
mov edx, 0x6e8ab0cc
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x10d01c62
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xe41784f3
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x71bfb34a
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071808], eax
mov edx, 0x621ba3fa
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071880], eax
mov edx, 0xafc62e11
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071820], eax
mov edx, 0x85bbbc78
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x1480d52f
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007185c], eax
mov edx, 0x3070e196
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071864], eax
mov edx, 0x6accbe70
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071910], eax
mov edx, 0x91f29827
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x1400718b8], eax
mov edx, 0xc5a2c522
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xa6019211
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071900], eax
mov edx, 0xb9071833
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x14007186c], eax
mov edx, 0xbfdc5fc7
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071844], eax
mov edx, 0x9528c6d7
call fcn.14000d0c8
mov rcx, rsi
mov dword [0x140071818], eax
mov edx, 0xd63d538
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x27ad4ecb
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x9a4f5904
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb3557c16
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb46cebe
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x8ff65c64
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x405a8114
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0x4d704ed0
call fcn.14000d0c8
mov rcx, rsi
mov edx, 0xb7b57595
call fcn.14000d0c8
or rcx, 0xffffffffffffffff
mov rdx, r14
call qword [0x140073710]
xor eax, eax
mov ecx, 0x2000
mov rdi, rsi
mov r8, rsi
rep stosb byte [rdi], al
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x14000dbd3
xor edi, edi
mov bl, dil
mov al, bl
add rsp, 0x210
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret