Function at 0x140158d30
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x60], xmm6
mov qword [rbp + 8], rcx
lea rsi, [rbp + 0x48]
mov dword [rsi], 0xffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
test eax, eax
je 0x140158da2
lea rcx, str.verifier.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dil, 1
test rax, rax
je 0x140158da6
mov eax, edi
movaps xmm6, xmmword [rbp + 0x60]
add rsp, 0xf8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor edi, edi
jmp 0x140158d88
mov ecx, 0xa8
call fcn.1400f045c
mov r12, rax
mov r8d, 0xa8
mov rcx, rax
xor edx, edx
call fcn.1400f5b50
xorps xmm6, xmm6
movaps xmmword [rbp - 0x20], xmm6
mov qword [rbp - 0x10], 0
mov al, 1
cmp dword [rbp + 0x48], 0
je 0x140159443
mov r14, r12
add r14, 0xa8
mov rax, qword [rbp + 8]
add rax, 8
mov qword [rbp - 0x30], rax
lea r13, str.NtQueryObject
mov r15, r14
mov dword [rbp + 0x4c], 0
xor esi, esi
add rsi, 4
mov r9d, r15d
sub r9d, r12d
mov dword [rbp + 0x5c], r9d
mov rbx, qword [0x140200a28]
test rbx, rbx
jne 0x140158e3b
mov rcx, r13
lea rdx, [0x140200a28]
call fcn.140014700
mov rbx, qword [0x140200a28]
mov r9d, dword [rbp + 0x5c]
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 2
mov r8, r12
call rbx
mov qword [rbp + 0x50], rsi
cmp eax, 0xc0000004
je 0x140158e67
cmp eax, 0x80000005
jne 0x140158fb0
mov ebx, dword [rbp + 0x5c]
add rbx, 2
mov rdi, r15
sub rdi, r12
mov rsi, rbx
sub rsi, rdi
jbe 0x140158ea6
mov rax, r14
sub rax, r15
cmp rax, rsi
jb 0x140158f12
test rsi, rsi
je 0x140158eb1
lea rdi, [r15 + rsi]
mov rcx, r15
xor edx, edx
mov r8, rsi
call fcn.1400f5b50
mov r15, rdi
jmp 0x140158eb1
lea rax, [r12 + rbx]
cmp rbx, rdi
cmovb r15, rax
mov rsi, qword [rbp + 0x50]
mov rbx, qword [0x140200a28]
test rbx, rbx
jne 0x140158ed7
mov rcx, r13
lea rdx, [0x140200a28]
call fcn.140014700
mov rbx, qword [0x140200a28]
mov r9d, dword [rbp + 0x5c]
lea rax, [rbp + 0x5c]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov edx, 2
mov r8, r12
call rbx
test eax, eax
js 0x140158e55
mov ecx, dword [rbp + 0x5c]
mov rdx, r15
sub rdx, r12
cmp rdx, rcx
mov ecx, 0xc0000004
cmove eax, ecx
jmp 0x140158e55
sub r14, r12
lea rax, [r14 + r14]
cmp rax, rbx
cmovb rax, rbx
movabs rcx, 0x3fffffffffffffff
cmp r14, rcx
mov rcx, rax
movabs rax, 0x7fffffffffffffff
cmovae rcx, rax
test rcx, rcx
je 0x14015948a
mov r13, rcx
call fcn.1400f045c
mov r14, rax
lea rcx, [r14 + rdi]
xor edx, edx
mov r8, rsi
call fcn.1400f5b50
test rdi, rdi
mov rsi, qword [rbp + 0x50]
jle 0x140158f78
cmp rdi, 2
jne 0x140158fa0
movzx eax, word [r12]
mov word [r14], ax
add r13, r14
add rbx, r14
test r12, r12
je 0x140158f8b
mov rcx, r12
call fcn.1400f0498
mov r15, rbx
mov r12, r14
mov r14, r13
lea r13, str.NtQueryObject
jmp 0x140158eb5
mov rcx, r14
mov rdx, r12
mov r8, rdi
call fcn.1400f5740
jmp 0x140158f78
test eax, eax
js 0x1401591b5
mov rax, qword [r12 + 8]
test rax, rax
je 0x1401591b5
mov qword [rbp + 0x10], r14
dec dword [rbp + 0x48]
movzx ecx, word [r12]
and ecx, 0xfffffffe
mov word [rax + rcx], 0
mov r14, qword [r12 + 8]
mov rcx, r14
call fcn.1400f080c
mov rdi, rax
movabs rax, 0x7ffffffffffffff0
cmp rdi, rax
lea rbx, [rbp - 0x20]
jae 0x140159495
cmp rdi, 0xb
lea r8, [rbp + 0x30]
jae 0x140159172
mov byte [rbp + 0x47], dil
mov rsi, r8
test rdi, rdi
je 0x140159038
cmp rdi, 3
jne 0x14015949e
movzx eax, word [r14 + 4]
mov word [rbp + 0x34], ax
mov eax, dword [r14]
mov dword [rbp + 0x30], eax
mov rsi, r8
mov word [rsi + rdi*2], 0
mov rcx, qword [rbp + 8]
lea rdx, [rbp + 0x28]
call fcn.14005ad90
mov rsi, qword [rbp + 0x28]
cmp byte [rbp + 0x47], 0
jns 0x14015905e
mov rcx, qword [rbp + 0x30]
call fcn.1400f0498
cmp rsi, qword [rbp - 0x30]
mov r14, qword [rbp + 0x10]
je 0x14015915f
cmp qword [rsi + 0x48], 0
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1401590a3
mov rcx, qword [rbp + 0x50]
mov rdx, rbx
call fcn.140175230
test al, al
je 0x140159437
lea rcx, [rsi + 0x38]
mov rdx, rbx
call fcn.1400052d0
test rax, rax
je 0x140159437
mov rbx, qword [rbp + 0x50]
mov rcx, rbx
mov edx, 2
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x140159447
mov rcx, rbx
call rdi
test eax, eax
je 0x140159447
lea rdi, [rsi + 0x20]
mov al, byte [rsi + 0x37]
test al, al
mov rcx, qword [rsi + 0x28]
movzx ebx, al
mov rdx, rbx
cmovs rdx, rcx
cmp rdx, 5
jne 0x140159119
mov qword [rsp + 0x20], 5
mov rcx, rdi
xor edx, edx
mov r8, 0xffffffffffffffff
lea r9, str.Event
call fcn.1400dd040
test eax, eax
je 0x14015914a
mov al, byte [rsi + 0x37]
mov rcx, qword [rsi + 0x28]
movzx ebx, al
test al, al
cmovs rbx, rcx
cmp rbx, 4
jne 0x14015915f
mov qword [rsp + 0x20], 4
mov rcx, rdi
xor edx, edx
mov r8, 0xffffffffffffffff
lea r9, str.File
call fcn.1400dd040
test eax, eax
jne 0x14015915f
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x18]
inc rax
cmp rax, 2
jae 0x1401591e4
cmp dword [rbp + 0x48], 0
mov rsi, qword [rbp + 0x50]
jne 0x140158e07
jmp 0x140159478
lea rbx, [rdi + 8]
and rbx, 0xfffffffffffffff8
lea rcx, [rbx + rbx]
call fcn.1400f045c
mov rsi, rax
mov qword [rbp + 0x30], rax
bts rbx, 0x3f
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x38], rdi
mov r8, rdi
add r8, rdi
mov rcx, rsi
mov rdx, r14
call fcn.1400f5740
lea r8, [rbp + 0x30]
lea rbx, [rbp - 0x20]
jmp 0x140159038
mov eax, dword [rbp + 0x4c]
inc eax
mov ecx, dword [rbp + 0x48]
test ecx, ecx
setne dil
cmp eax, 0x64
mov edx, eax
setl al
mov dword [rbp + 0x4c], edx
cmp edx, 0x63
jg 0x14015944c
test ecx, ecx
jne 0x140158e07
jmp 0x14015944c
movaps xmmword [rbp + 0x30], xmm6
mov qword [rbp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
mov edi, eax
mov esi, 1
mov ecx, edi
shl rsi, cl
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov qword [rbp], rax
mov dword [rbp + 0x1c], 0
mov dword [rbp + 0x24], edi
mov ecx, edi
xor edx, edx
mov qword [rbp - 0x28], r12
mov esi, 1
shl rsi, cl
mov rax, qword [rbp]
bt rax, rcx
mov qword [rbp - 0x38], rcx
jae 0x1401593bf
cmp ecx, dword [rbp + 0x24]
je 0x14015925b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov qword [rbp + 0x28], 0
mov r12, 0xfffffffffffffff0
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rbx
mov rsi, rax
mov rax, qword [rbp + 8]
mov rdi, qword [rax + 0x18]
call rbx
xor ecx, ecx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
lea r9, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov edx, eax
test eax, eax
je 0x1401593bb
mov rdi, qword [rbp + 0x28]
mov rax, qword [rbp + 0x50]
cmp rdi, rax
je 0x1401592e8
mov r14, qword [rbp + 0x38]
cmp r14, qword [rbp + 0x40]
je 0x1401592ef
mov qword [r14], rdi
add r14, 8
mov qword [rbp + 0x38], r14
mov r14, qword [rbp + 0x10]
test r12, r12
je 0x1401593bb
inc r12
cmp qword [rbp + 0x28], rax
jb 0x14015926a
jmp 0x1401593bb
mov cl, 1
mov dword [rbp + 0x1c], ecx
jmp 0x1401592d1
mov dword [rbp + 0x20], edx
mov rax, qword [rbp + 0x30]
mov qword [rbp - 0x40], rax
sub r14, rax
mov rbx, r14
sar rbx, 3
lea rax, [rbx + 1]
mov rcx, rax
shr rcx, 0x3d
jne 0x14015947c
mov r13, r14
sar r13, 2
cmp r13, rax
cmovb r13, rax
movabs rax, 0xfffffffffffffff
cmp rbx, rax
movabs rax, 0x1fffffffffffffff
cmovae r13, rax
test r13, r13
je 0x1401593b7
mov rax, r13
shr rax, 0x3d
jne 0x140159485
lea rcx, [r13*8]
call fcn.1400f045c
mov rsi, rax
mov qword [rsi + rbx*8], rdi
test r14, r14
mov rdi, qword [rbp - 0x40]
jle 0x14015937b
mov rcx, rsi
mov rdx, rdi
mov r8, r14
call fcn.1400f5740
lea rax, [rsi + r13*8]
lea rcx, [rsi + rbx*8]
add rcx, 8
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], rax
test rdi, rdi
je 0x1401593a0
mov rcx, rdi
call fcn.1400f0498
mov r14, qword [rbp + 0x10]
lea r13, str.NtQueryObject
mov rax, qword [rbp + 0x50]
mov edx, dword [rbp + 0x20]
jmp 0x1401592d1
xor esi, esi
jmp 0x140159360
mov r12, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x38]
inc ecx
cmp ecx, 0x40
mov eax, 0
cmove ecx, eax
cmp ecx, dword [rbp + 0x24]
je 0x1401593e4
test edx, edx
je 0x1401593e4
mov eax, dword [rbp + 0x1c]
and al, 1
je 0x14015922a
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov rsi, qword [rbp + 0x30]
mov rdi, qword [rbp + 0x38]
cmp rsi, rdi
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x14015941d
mov rcx, qword [rsi]
call rbx
add rsi, 8
cmp rdi, rsi
jne 0x14015940b
mov rsi, qword [rbp + 0x30]
test rsi, rsi
je 0x14015915f
mov qword [rbp + 0x38], rsi
mov rcx, rsi
call fcn.1400f0498
jmp 0x14015915f
mov eax, dword [rbp + 0x4c]
mov rsi, qword [rbp + 0x50]
jmp 0x1401591ba
xor edi, edi
jmp 0x14015944c
mov dil, 1
mov al, 1
and dil, al
cmp byte [rbp - 9], 0
jns 0x14015945e
mov rcx, qword [rbp - 0x20]
call fcn.1400f0498
xor dil, 1
test r12, r12
je 0x140158d88
mov rcx, r12
call fcn.1400f0498
jmp 0x140158d88
xor edi, edi
jmp 0x14015944a
lea rcx, [rbp + 0x30]
call fcn.1401261c0
call fcn.1400f1940
mov r13, rcx
xor r14d, r14d
jmp 0x140158f52
lea rcx, [rbp + 0x30]
call fcn.140126160
mov rsi, r8
jmp 0x140159197