Function at 0x140002107
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call
Terminate process

Disassembly:
push rbp
push rbx
sub rsp, 0x358
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2f0], rcx
lea rax, [rbp + 0x2d0]
sub rax, 0x330
add rax, 0x1f
shr rax, 5
shl rax, 5
mov rbx, rax
mov dword [rbp + 0xfc], 0
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x14000218d
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2c0], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2c0]
mov qword [str.BABUBE], rax
jmp 0x1400021d8
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov eax, dword [rbp + 0xfc]
mov eax, eax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x2b8], rax
mov eax, dword [rbp + 0xfc]
mov edx, eax
mov rax, qword [rbp + 0x2b8]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, dword [rbp + 0xfc]
lea rcx, [rbp + 0xfc]
mov rax, qword [rbp + 0x2b8]
mov r9, rcx
mov r8d, edx
mov rdx, rax
mov ecx, 0xb
call sym.NtQuerySystemInformation
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0xc0000004
je 0x1400021e2
cmp dword [rbp + 0x2b4], 0xc0000023
je 0x1400021e2
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x1400022c2
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x2a8], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x2a8]
mov qword [str.BABUBE], rax
jmp 0x14000230d
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
cmp dword [rbp + 0x2b4], 0
je 0x140002635
movabs rax, 0x38c9c641f5bb82f0
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov qword [rbx], rax
movabs rax, 0x8e3d875b79d01054
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov qword [rbx + 8], rax
movabs rax, 0x92baac61c1535ba4
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp + 0x1d8], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbx + 0x10], rax
movabs rax, 0xf2a7066bf11b6eb6
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
mov qword [rbp + 0x1d0], rax
mov rax, qword [rbp + 0x1d0]
mov qword [rbx + 0x18], rax
movabs rax, 0x6b923a993b29ce52
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
mov qword [rbx + 0x20], rax
movabs rcx, 0x9a95cbe389a78694
mov qword [rbp + 0x1c0], rcx
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x1c0], rax
mov rax, qword [rbp + 0x1c0]
mov qword [rbx + 0x28], rax
nop
movabs rax, 0x54bca902d5e6afab
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbx + 0x40], rax
movabs rax, 0xfa73a72f16be3030
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
mov qword [rbx + 0x48], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov qword [rbx + 0x50], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
mov qword [rbx + 0x58], rax
movabs rax, 0x61bc54f6525daf3f
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
mov qword [rbp + 0x268], rax
mov rax, qword [rbp + 0x268]
mov qword [rbx + 0x60], rax
mov qword [rbp + 0x260], rcx
mov rax, qword [rbp + 0x260]
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x260]
mov qword [rbx + 0x68], rax
lea rax, [rbx + 0x40]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x258]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
mov rax, rbx
mov qword [rbp + 0x250], rax
mov rax, qword [rbp + 0x250]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x120], ymm0
vmovdqa ymmword [rbx + 0x100], ymm1
vmovdqa ymm1, ymmword [rbx + 0x120]
vmovdqa ymm0, ymmword [rbx + 0x100]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
mov rax, rbx
mov qword [rbp + 0x248], rax
vmovdqa ymmword [rbx + 0xe0], ymm0
mov rax, qword [rbp + 0x248]
vmovdqa ymm0, ymmword [rbx + 0xe0]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
vmovdqa xmm0, xmmword [rax]
mov rax, rbx
add rax, 0x20
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
vmovdqa xmm1, xmmword [rax]
vmovdqa xmmword [rbp + 0x220], xmm1
vmovdqa xmmword [rbp + 0x210], xmm0
vmovdqa xmm1, xmmword [rbp + 0x220]
vmovdqa xmm0, xmmword [rbp + 0x210]
vpxor xmm0, xmm1, xmm0
mov rax, rbx
add rax, 0x20
mov qword [rbp + 0x208], rax
vmovdqa xmmword [rbp + 0x1f0], xmm0
mov rax, qword [rbp + 0x208]
vmovdqa xmm0, xmmword [rbp + 0x1f0]
vmovdqa xmmword [rax], xmm0
nop
mov rax, rbx
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2a0], rax
mov dword [rbp + 0x2cc], 0
jmp 0x140002713
mov edx, dword [rbp + 0x2cc]
mov rax, rdx
shl rax, 3
add rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
lea rdx, [rax + 0x20]
mov rax, qword [rbp + 0x2a0]
add rax, rdx
lea r8, [rax + 0x10]
mov rcx, qword [rbp + 0x2a0]
mov edx, dword [rbp + 0x2cc]
mov rax, rdx
shl rax, 3
add rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x2e
movzx eax, word [rax]
movzx eax, ax
add rax, r8
mov qword [rbp + 0x290], rax
mov rdx, qword [rbp + 0x2f0]
mov rax, qword [rbp + 0x290]
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__stricmp]
call rax
test eax, eax
sete al
test al, al
je 0x14000270c
mov rcx, qword [rbp + 0x2a0]
mov edx, dword [rbp + 0x2cc]
mov rax, rdx
shl rax, 3
add rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov rax, qword [rax]
jmp 0x1400029b6
add dword [rbp + 0x2cc], 1
mov rax, qword [rbp + 0x2a0]
mov eax, dword [rax]
cmp dword [rbp + 0x2cc], eax
jb 0x140002652
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140002770
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x298], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x298]
mov qword [str.BABUBE], rax
jmp 0x1400027bb
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x140]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x140]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x140]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
movabs rax, 0x38c9c641f5bb82f0
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x180], rax
mov rax, qword [rbp + 0x180]
mov qword [rbx + 0x40], rax
movabs rax, 0x9315875b79d01054
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x178]
mov qword [rbx + 0x48], rax
movabs rax, 0x8ab0906cdd164a9b
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
mov qword [rbx + 0x50], rax
movabs rax, 0x80c8600f961a65b0
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x168]
mov qword [rbx + 0x58], rax
nop
movabs rax, 0x54bca902d5e6afab
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbx], rax
movabs rax, 0xfa73a72f16be3030
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
mov qword [rbx + 8], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x1a8]
mov qword [rbx + 0x10], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbx + 0x18], rax
mov qword [rbp + 0x198], rbx
mov rax, qword [rbp + 0x198]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x40]
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x190]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0xc0], ymm0
vmovdqa ymmword [rbx + 0xa0], ymm1
vmovdqa ymm1, ymmword [rbx + 0xc0]
vmovdqa ymm0, ymmword [rbx + 0xa0]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x40]
mov qword [rbp + 0x188], rax
vmovdqa ymmword [rbx + 0x80], ymm0
mov rax, qword [rbp + 0x188]
vmovdqa ymm0, ymmword [rbx + 0x80]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x40]
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
add rsp, 0x358
pop rbx
pop rbp
ret