Function at 0x140097950
Capabilities:
Encode data using base64
Get system information on windows
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
cmp byte [0x14013bc30], 0
jne 0x140098685
xor eax, eax
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
mov ebp, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xb0], 0
mov byte [rsp + 0x40], 2
mov byte [rsp + 0x42], 1
mov dword [rsp + 0x58], 1
mov qword [rsp + 0xc0], 0x80
cmp r8d, 0x746e6542
jg 0x140097a15
cmp r8d, 0x414956
je 0x140097a3e
cmp r8d, 0x68747541
jne 0x140097a6a
cmp edx, 0x69746e65
jne 0x140097a6a
cmp ecx, 0x444d4163
jne 0x140097a6a
xor eax, eax
jmp 0x140097a6f
cmp r8d, 0x746e6543
je 0x140097a55
cmp r8d, 0x756e6547
jne 0x140097a6a
cmp edx, 0x49656e69
jne 0x140097a6a
mov eax, 1
cmp ecx, 0x6c65746e
je 0x140097a6f
jmp 0x140097a6a
cmp edx, 0x414956
jne 0x140097a6a
mov eax, 3
cmp ecx, 0x414956
je 0x140097a6f
jmp 0x140097a6a
cmp edx, 0x48727561
jne 0x140097a6a
mov eax, 2
cmp ecx, 0x736c7561
je 0x140097a6f
mov eax, 4
lea rax, [rax + rax*4]
lea rcx, [0x140101d90]
mov rax, qword [rcx + rax*4]
mov qword [rsp + 0x64], rax
test ebp, ebp
je 0x14009832d
xor ecx, ecx
mov eax, 1
xchg rbx, r8
cpuid
xchg rbx, r8
mov r11d, ecx
mov r10d, edx
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov edx, eax
shr edx, 8
and edx, 0xf
cmp edx, 6
je 0x140097aba
cmp edx, 0xf
jne 0x140097ace
mov r9d, eax
shr r9d, 0xc
mov esi, r9d
and esi, 0xf0
or ecx, esi
jmp 0x140097ad5
mov r9d, eax
shr r9d, 0xc
mov esi, eax
shr esi, 0x14
movzx esi, sil
add esi, 0xf
cmp edx, 0xf
cmovne esi, edx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x44], esi
movzx ecx, r8b
mov dword [rsp + 0x4c], ecx
and r9d, 3
mov dword [rsp + 0x54], r9d
mov ecx, r8d
shr ecx, 0x10
movzx ecx, cl
mov dword [rsp + 0x58], ecx
and eax, 0xf
mov dword [rsp + 0x50], eax
shr r8d, 5
and r8d, 0x7f8
mov dword [rsp + 0x5c], r8d
mov r8d, r11d
and r8d, 2
shl r8d, 0x1a
mov ecx, r11d
and ecx, 0x20
mov esi, r11d
shr esi, 0xd
mov eax, esi
mov r9d, r11d
shr r9d, 0x13
mov edx, r9d
and edx, 1
shl rdx, 0x3c
mov edi, r11d
shr edi, 0x14
and edi, 1
shl rdi, 0x3d
or rdi, rdx
mov ebx, r11d
shr ebx, 4
and ebx, 0x40000
or rbx, rdi
mov edx, r11d
shl edx, 6
and edx, 0x20000000
or rdx, rbx
and r9d, 0x40
and esi, 0x2000
lea edi, [rsi + rcx*4]
mov ecx, r11d
shr ecx, 2
and ecx, 0x2000000
or ecx, r8d
mov r8d, r10d
and r8d, 1
shl r8, 0x3b
or r8, r9
mov esi, r10d
shr esi, 4
and esi, 1
shl rsi, 0x28
mov r9d, r10d
and r9d, 0x20
shl r9d, 0x11
or r9, rsi
mov esi, r10d
shr esi, 9
and esi, 0x4000
mov ebx, r10d
shr ebx, 0x18
and ebx, 1
or ebx, esi
mov esi, r10d
shr esi, 0x19
and esi, 1
mov r14, rsi
shl r14, 0x39
or r14, rbx
shl rsi, 0xf
or rsi, r14
mov ebx, r10d
shr ebx, 0x1a
and ebx, 1
mov r14, rbx
shl r14, 0x3a
or r14, rsi
or r14, r9
or r14, rdx
mov edx, r11d
and edx, 1
shl rdx, 0x3b
or rcx, rdx
mov edx, r11d
and edx, 8
shl edx, 0xd
or rcx, rdx
mov edx, r11d
shr edx, 0x1e
and edx, 1
shl rdx, 0x26
or rcx, rdx
mov edx, r11d
shr edx, 9
shl rdx, 0x3f
or rcx, rdx
mov edx, r11d
shr edx, 6
and edx, 1
shl rdx, 0x38
or rcx, rdx
mov edx, r10d
shl rbx, 0x39
or rcx, rbx
mov r9d, r10d
or rcx, r14
mov esi, r10d
shr r10d, 0x1b
and r10d, 2
or r10, r8
shr r9d, 0xf
and r9d, 1
shl r9, 0x31
or r10, r9
shr edx, 8
and edx, 1
shl rdx, 0x34
or r10, rdx
and eax, 1
shl rax, 0x33
mov qword [rsp + 0xc8], rdi
shr esi, 0x13
and esi, 1
shl rsi, 0x2d
or r10, rsi
mov rsi, rcx
or rsi, 0x80
mov qword [rsp + 0xc0], rsi
or r10, rax
mov qword [rsp + 0xb8], r10
xor eax, eax
cmp edi, 0x2000
jb 0x140097d1f
and ecx, 0x2000000
je 0x140097d1f
xor ecx, ecx
xgetbv
test r11d, 0x10000000
je 0x140097d1f
mov ecx, eax
and ecx, 6
cmp ecx, 6
jne 0x140097d1f
mov ecx, r11d
shr ecx, 0xc
and ecx, 1
shl rcx, 0x39
shr r11d, 0x1d
and r11d, 1
shl r11, 0x38
or r11, rcx
or r11, r10
or r11, 0x4000
mov qword [rsp + 0xb8], r11
mov r10, r11
cmp ebp, 7
jb 0x14009832d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ebp
mov eax, 7
xor ecx, ecx
xchg rbx, r11
cpuid
xchg rbx, r11
mov dword [rsp + 0x24], eax
mov ebx, ecx
mov r12d, edx
mov eax, r11d
and eax, 1
shl rax, 0x3c
mov ecx, r11d
shr ecx, 3
and ecx, 1
shl rcx, 0x27
or rcx, rax
lea eax, [r11 + r11]
mov dword [rsp + 0x2c], eax
mov r14d, eax
and r14d, 0x20
mov eax, r11d
shr eax, 7
mov dword [rsp + 0x28], eax
and eax, 1
shl rax, 0x37
mov r9d, r11d
shr r9d, 8
and r9d, 1
shl r9, 0x28
mov r8d, r11d
shr r8d, 9
and r8d, 1
shl r8, 0x37
or r8, r9
or r8, rcx
mov ecx, r11d
shr ecx, 0xb
and ecx, 1
shl rcx, 0x2a
mov r9d, r11d
shr r9d, 0x12
and r9d, 1
shl r9, 0x27
or r9, rcx
mov ecx, r11d
shr ecx, 0xe
and ecx, 0x20
or rcx, r8
mov r8d, r11d
shr r8d, 0x14
and r8d, 1
shl r8, 0x35
or r8, rax
or r8, r9
mov eax, r11d
shr eax, 0x17
and eax, 1
shl rax, 0x2e
mov r13d, r11d
shr r13d, 0x18
and r13d, 1
shl r13, 0x2f
or r13, rax
or r13, rcx
mov eax, r11d
shr eax, 0x1d
and eax, 1
shl rax, 0x30
mov r9d, ebx
and r9d, 1
shl r9, 0x20
or r9, rax
mov ecx, ebx
and ecx, 0x10
shl ecx, 0x16
or rcx, r9
or rcx, r8
or rcx, r14
or rcx, rsi
mov esi, ebx
and esi, 0x20
shl esi, 4
mov eax, ebx
shr eax, 7
mov r9d, eax
and r9d, 1
shl r9, 0x2a
mov r8d, ebx
shr r8d, 4
and r8d, 0x10
mov r15d, ebx
shr r15d, 3
and r15d, 0x40
mov r14d, ebx
shr r14d, 2
and r14d, 0x100
or r14d, r15d
mov r15d, ebx
shr r15d, 0x16
and r15d, 1
shl r15, 0x24
or r15, r8
mov r8d, ebx
shr r8d, 0x19
and r8d, 1
shl r8, 0x2c
or r8, r9
and eax, 0x100000
mov r9d, ebx
shr r9d, 9
and r9d, 0x80000
or r9d, eax
or r9, r15
mov r15d, ebx
shr r15d, 0x1d
and r15d, 1
shl r15, 0x36
mov eax, edx
shr eax, 4
and eax, 1
shl rax, 0x3d
or rax, r15
and edx, 0x20
or edx, esi
mov ebp, r12d
shr ebp, 0xe
mov r15d, ebp
and r15d, 1
shl r15, 0x2c
or r15, r9
mov r9d, r12d
shr r9d, 0xc
mov esi, r9d
and esi, 0x10
or esi, edx
or esi, r14d
or esi, edi
mov r14d, r12d
shl r14d, 0xa
and r14d, 0x10000000
or r14, r15
mov edi, r12d
shr edi, 0x14
and edi, 1
shl rdi, 0x29
or rdi, r8
or rdi, rax
mov qword [rsp + 0xc8], rsi
or r14, rcx
mov qword [rsp + 0xc0], r14
or rdi, r10
or rdi, r13
mov qword [rsp + 0xb8], rdi
movabs rax, 0x40000000020
test rcx, rax
je 0x140097f5f
or rsi, 8
mov qword [rsp + 0xc8], rsi
mov r15, qword [rsp + 0x30]
mov eax, r15d
and eax, 0xe6
test r11b, 0x20
je 0x140097f8a
and r10d, 0x4000
je 0x140097f8a
or rdi, 0x8000
mov qword [rsp + 0xb8], rdi
mov edx, r15d
and edx, 0x60000
cmp eax, 0xe6
jne 0x1400980a0
mov eax, r11d
and eax, 0x10000
je 0x1400980a0
mov ecx, r11d
shl ecx, 5
and dword [rsp + 0x2c], 0x8000000
mov r8d, r11d
shr r8d, 4
and r8d, 0x800000
and dword [rsp + 0x28], 0x200000
mov dword [rsp + 0x3c], edx
mov r13d, r11d
shr r13d, 0xa
and r13d, 0x100000
mov eax, r11d
shr eax, 1
and eax, 0x40000000
mov dword [rsp + 0x38], r9d
mov r9d, ebx
and r9d, 2
shl r9d, 0x1b
mov edx, ebx
and edx, 0x40
shl edx, 0x17
mov r10d, ebx
shl r10d, 0x14
and r10d, 0x80000000
or r10d, edx
mov edx, ebx
shl edx, 7
and edx, 0x80000
or edx, r10d
shr ebx, 0xe
and ebx, 1
shl rbx, 0x21
mov r10d, r12d
and r10d, 4
shl r10d, 0xf
or r10d, edx
mov edx, r12d
and edx, 8
shl edx, 0xd
or edx, r10d
mov r10d, r12d
shr r10d, 8
and r10d, 1
shl r10, 0x20
shl r12d, 2
and r12d, 0x2000000
or r12d, edx
and ecx, 0x4400000
add ecx, dword [rsp + 0x2c]
or ecx, r8d
add ecx, dword [rsp + 0x28]
or ecx, r13d
mov edx, dword [rsp + 0x3c]
or ecx, eax
or ecx, r9d
mov r9d, dword [rsp + 0x38]
or ecx, r12d
or ecx, 0x1000000
or rcx, rbx
or rcx, r10
or rdi, rcx
mov qword [rsp + 0xb8], rdi
mov eax, dword [rsp + 0x24]
cmp edx, 0x60000
jne 0x1400980c7
and r9d, 0x1000
and ebp, 0x900
or ebp, r9d
or rdi, rbp
mov qword [rsp + 0xb8], rdi
test eax, eax
je 0x140098280
mov ebp, edx
mov eax, 7
mov ecx, 1
xchg rbx, r8
cpuid
xchg rbx, r8
mov ecx, eax
and ecx, 1
shl rcx, 0x31
mov r10d, eax
shr r10d, 7
and r10d, 1
shl r10, 0x32
mov ebx, eax
shr ebx, 8
mov r9d, ebx
and r9d, 4
or r9, rcx
mov ecx, eax
shr ecx, 0xb
mov r15, rcx
shl r15, 0x3f
mov r12d, eax
shr r12d, 0xc
and r12d, 1
shl r12, 0x3e
or r12, r15
or r12, r10
mov r10d, eax
shr r10d, 0x10
and r10d, 0x440
mov r15d, eax
shr r15d, 4
mov r13d, r15d
and r13d, 0x800000
or r13d, r10d
and ebx, 0x800
and r8d, 2
lea r8d, [rbx + r8*2]
or rsi, r8
mov ebx, edx
shl ebx, 0x10
and ebx, 0x40000000
or rbx, r9
mov r8d, eax
shr r8d, 1
and r8d, 1
shl r8, 0x33
or rbx, r8
mov r8d, eax
shr r8d, 2
and r8d, 1
shl r8, 0x34
or rbx, r8
mov r8d, eax
shr r8d, 3
and r8d, 1
shl r8, 0x22
or rbx, r8
or rbx, r13
or rbx, r14
mov r9d, edx
shr r9d, 0x12
and r9d, 1
shl r9, 0x2b
mov r8d, edx
shr r8d, 8
and r8d, 0x2000
or r8, r9
or r8, r12
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xc0], rbx
or r8, rdi
test di, di
jns 0x140098235
and r15d, 1
shl r15, 0x24
mov r9d, eax
shr r9d, 0x17
and r9d, 1
shl r9, 0x22
or r9, r15
mov r10d, edx
shr r10d, 4
and r10d, 1
shl r10, 0x26
or r10, r9
mov r9d, edx
shr r9d, 5
and r9d, 1
shl r9, 0x23
or r9, r10
mov r10d, edx
shr r10d, 0xa
and r10d, 1
shl r10, 0x25
or r10, r9
or r8, r10
mov r10d, dword [rsp + 0x20]
mov r15, qword [rsp + 0x30]
mov r9d, r8d
shr r9d, 6
shl eax, 0xd
and eax, r9d
and eax, 0x40000
or rax, r8
mov qword [rsp + 0xb8], rax
cmp ebp, 0x60000
jne 0x140098288
and ecx, 0x400
and edx, 0x100
lea ecx, [rcx + rdx*2]
or rax, rcx
mov qword [rsp + 0xb8], rax
jmp 0x140098288
mov rbx, r14
mov r10d, dword [rsp + 0x20]
cmp r10d, 0xd
jb 0x14009832d
xor ecx, ecx
mov eax, reloc.WS2_32.dll_listen
xchg rbx, r8
cpuid
xchg rbx, r8
test r11d, 0x4000
je 0x1400982c6
and r15d, eax
and r15d, 0x18
cmp r15d, 0x18
jne 0x1400982c6
or rbx, 0x200000
mov qword [rsp + 0xc0], rbx
mov ecx, 1
mov eax, reloc.WS2_32.dll_listen
xchg rbx, r8
cpuid
xchg rbx, r8
mov ecx, eax
shl ecx, 0xf
movzx ecx, cx
or rsi, rcx
shl eax, 0xd
mov ecx, eax
and ecx, 0x4000
or rcx, rsi
and eax, 0x10000
or rax, rcx
mov qword [rsp + 0xc8], rax
cmp r10d, 0xe
jb 0x14009832d
xor ecx, ecx
mov eax, select
xchg rbx, r8
cpuid
xchg rbx, r8
shr r8d, 4
and r8d, 1
shl r8, 0x21
or r8, rbx
mov qword [rsp + 0xc0], r8
mov edi, 0x80000000
lea r9, [rsp + 0x74]
lea r10, [0x1400986a0]
mov esi, 0x80000007
mov r8d, 0x80000000
mov rbx, r9
jmp 0x1400983ac
mov ecx, eax
and ecx, 1
shl rcx, 0x36
mov edx, eax
shr edx, 1
and edx, 1
shl rdx, 0x2d
or rdx, rcx
mov ecx, eax
shr ecx, 3
and ecx, 1
shl rcx, 0x2e
or rcx, rdx
mov edx, eax
shr edx, 4
and edx, 1
shl rdx, 0x2f
or rdx, rcx
shr eax, 6
and eax, 1
shl rax, 0x23
or rax, rdx
or qword [rsp + 0xc0], rax
mov r8d, 0x8000001f
nop
inc r8d
cmp r8d, edi
ja 0x1400985e8
mov eax, r8d
xor ecx, ecx
xchg rbx, r14
cpuid
xchg rbx, r14
lea r11d, [r8 - 0x80000000]
cmp r11d, 0x1f
ja case.0x1400983d0.2147483643
mov r13d, edx
movsxd r11, dword [r10 + r11*4]
add r11, r10
jmp r11
mov dword [rbx], eax
mov dword [rbx + 4], r14d
mov dword [rbx + 8], ecx
mov dword [rbx + 0xc], r13d
add rbx, 0x10
cmp r8d, 0x80000004
cmove r8d, esi
jmp case.0x1400983d0.2147483643
cmp eax, 0x8000001f
mov ecx, 0x8000001f
cmovae eax, ecx
mov r8d, 0x80000000
mov edi, eax
jmp case.0x1400983d0.2147483643
mov eax, ecx
and eax, 1
shl eax, 9
mov r14d, ecx
shr r14d, 2
and r14d, 1
mov r8d, ecx
and r8d, 0x20
shl r8d, 7
mov r11d, ecx
shr r11d, 6
and r11d, 1
shl r11, 0x3e
or r11, r8
mov r8d, ecx
shl r8d, 0x11
and r8d, 0x1000000
or r8, r11
mov r11d, ecx
shl r11d, 0x17
and r11d, 0x80000000
or r11, r8
mov ebp, ecx
shr ebp, 0xc
mov r8d, ebp
and r8d, 1
shl r8, 0x32
or r8, r11
mov r12d, ecx
shr r12d, 4
and r12d, 0x800
or r12, r8
mov r8d, ecx
shr r8d, 0x14
and r8d, 2
or r8d, r14d
or r8, qword [rsp + 0xc8]
mov qword [rsp + 0xc8], r8
and ebp, 0x20000
mov esi, r13d
shr esi, 0x12
and esi, 4
mov r15, qword [rsp + 0xb8]
mov r11d, r13d
shr r11d, 0x14
and r11d, 2
mov r14d, r13d
shr r14d, 7
and r14d, 0x8000
or r14d, r11d
mov edx, r13d
shr edx, 0x1b
and edx, 1
shl rdx, 0x29
or rdx, r14
lea r11d, [r13*4]
and r11d, 0x80000000
or r11, rdx
or r11, r12
mov edx, r13d
shr edx, 0x1e
and edx, 1
mov r14, rdx
shl r14, 4
or r14, rsi
or r14, r15
mov qword [rsp + 0xb8], r14
shl rdx, 0xf
and r13d, 0x80000000
or r13d, eax
or r13d, ebp
or r11, qword [rsp + 0xc0]
or r13, rdx
or r11, r13
mov qword [rsp + 0xc0], r11
test r15d, 0x4000
je 0x14009856c
lea eax, [rcx + rcx]
and eax, 0x1000
or r8, rax
mov qword [rsp + 0xc8], r8
mov eax, ecx
shr eax, 0x10
and eax, 1
shl rax, 0x3a
or r14, rax
mov qword [rsp + 0xb8], r14
mov esi, 0x80000007
mov r8d, 0x80000001
cmp dword [rsp + 0x64], 0x444d41
jne case.0x1400983d0.2147483643
and ecx, 0x10
shl ecx, 3
or r14, rcx
mov qword [rsp + 0xb8], r14
jmp case.0x1400983d0.2147483643
mov eax, r14d
and eax, 1
mov rcx, rax
shl rcx, 0x30
or qword [rsp + 0xb8], rcx
shl rax, 0x25
mov ecx, r14d
shl ecx, 5
and ecx, 0x2000
or rcx, rax
or qword [rsp + 0xc0], rcx
add r14d, r14d
and r14d, 0x400
or qword [rsp + 0xc8], r14
mov r8d, 0x8000001e
jmp case.0x1400983d0.2147483643
xor ecx, ecx
mov rax, r9
jmp 0x140098606
mov r8d, ecx
nop word cs:[rax + rax]
inc r9
mov ecx, r8d
movzx edx, byte [r9]
mov byte [r9], 0
cmp edx, 0x20
je 0x140098630
test edx, edx
je 0x14009864b
mov byte [rax], dl
inc rax
mov r8d, edx
jmp 0x140098600
mov r8b, 0x40
cmp cl, 0x40
je 0x140098600
movzx r8d, byte [r9 + 1]
cmp r8d, 0x20
je 0x1400985ef
cmp r8d, 0x40
je 0x1400985ef
jmp 0x140098617
mov byte [rax], 0
lea rcx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x60], eax
lea rcx, [0x14013bb98]
lea rdx, [rsp + 0x40]
mov r8d, 0x98
call sub.VCRUNTIME140.dll_memcpy
mov byte [0x14013bc30], 1
lea rax, [0x14013bb98]
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret