Function at 0x1400047d0
Capabilities:
Compress data via winapi
Get system information on windows

Disassembly:
sub rsp, 0x28
lea rdx, str.NtDuplicateObject
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x1400180b8], rax
lea rdx, str.NtQueryObject
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x1400180c0], rax
lea rdx, str.NtQuerySystemInformation
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x1400180b0], rax
lea rdx, str.RtlInitUnicodeString
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140017fb8], rax
lea rdx, str.NtLoadDriver
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140017fb0], rax
lea rdx, str.vsprintf
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x1400180a0], rax
lea rdx, str.vswprintf
lea rcx, str.msvcrt
call fcn.140004d10
mov qword [0x1400180a8], rax
lea rdx, str.RtlDecompressBuffer
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018098], rax
lea rdx, str.NtSuspendProcess
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018090], rax
lea rdx, str.NtTerminateProcess
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018088], rax
lea rdx, str.NtUnmapViewOfSection
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018080], rax
lea rdx, str.NtUnloadDriver
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018078], rax
lea rdx, str.NtSetInformationThread
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018070], rax
lea rdx, str.NtQueryInformationProcess
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018068], rax
lea rdx, str.RtlCreateUserThread
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018060], rax
lea rdx, str.RtlExitUserProcess
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018058], rax
lea rdx, str.NtFreeVirtualMemory
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018048], rax
lea rdx, str.NtQueryVirtualMemory
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018050], rax
lea rdx, str.NtProtectVirtualMemory
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018040], rax
lea rdx, str.LdrUnloadDll
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018038], rax
lea rdx, str.NtCreateDebugObject
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018030], rax
lea rdx, str.NtDebugActiveProcess
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018028], rax
lea rdx, str.NtClose
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018020], rax
lea rdx, str.RtlSubAuthoritySid
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018018], rax
lea rdx, str.RtlInitializeSid
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018010], rax
lea rdx, str.RtlSetDaclSecurityDescriptor
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018008], rax
lea rdx, str.RtlAddAccessAllowedAce
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140018000], rax
lea rdx, str.RtlCreateAcl
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140017ff8], rax
lea rdx, str.RtlCreateSecurityDescriptor
lea rcx, str.ntdll
call fcn.140004d10
mov qword [0x140017ff0], rax
lea rcx, [0x140017fc0]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp qword [0x140017ff0], 0
je 0x140004c19
cmp qword [0x140017ff8], 0
je 0x140004c19
cmp qword [0x140018000], 0
je 0x140004c19
cmp qword [0x140018008], 0
je 0x140004c19
cmp qword [0x140018010], 0
je 0x140004c19
cmp qword [0x140018018], 0
je 0x140004c19
cmp qword [0x140018030], 0
je 0x140004c19
cmp qword [0x140018028], 0
je 0x140004c19
cmp qword [0x140018020], 0
je 0x140004c19
cmp qword [0x140018038], 0
je 0x140004c19
cmp qword [0x140018048], 0
je 0x140004c19
cmp qword [0x140018050], 0
je 0x140004c19
cmp qword [0x140018040], 0
je 0x140004c19
cmp qword [0x140018058], 0
je 0x140004c19
cmp qword [0x140018060], 0
je 0x140004c19
cmp qword [0x140018068], 0
je 0x140004c19
cmp qword [0x140018070], 0
je 0x140004c19
cmp qword [0x140018078], 0
je 0x140004c19
cmp qword [0x140018080], 0
je 0x140004c19
cmp qword [0x140018088], 0
je 0x140004c19
cmp qword [0x140018090], 0
je 0x140004c19
cmp qword [0x140018098], 0
je 0x140004c19
cmp qword [0x1400180a0], 0
je 0x140004c19
cmp qword [0x1400180c0], 0
je 0x140004c19
cmp qword [0x1400180b8], 0
je 0x140004c19
cmp qword [0x1400180b0], 0
je 0x140004c19
cmp qword [0x140017fb0], 0
jne 0x140004c33
lea rcx, str._________NOT_GET_FUNCTION____________
call fcn.140002fc0
lea rcx, [0x14000975e]
call fcn.140006ab0
jmp 0x140004c38
mov eax, 1
add rsp, 0x28
ret