Function at 0x140004898
Capabilities:
Check processdebugport
Get common file path
Get system information on windows
Make suspicious ntquerysysteminformation call
Map section object

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5c8]
sub rsp, 0x688
mov r13, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp + 0x180]
mov r8d, 0x400
mov rdi, r9
call sub.ntdll.dll_memset
or r12d, 0xffffffff
xor eax, eax
cmp qword [0x14000e058], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x60], r12d
je 0x140004910
cmp qword [0x14000e068], rax
je 0x140004910
mov dword [rsp + 0x64], 1
jmp 0x140004914
and dword [rsp + 0x64], eax
bsf r15d, r12d
je 0x140004c17
add r13, rax
mov qword [rbp + 0x5d8], r13
mov rax, qword [r13 + 0x50]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140004ebb
xor ecx, ecx
mov eax, r15d
shl eax, 0x11
mov ebx, eax
add rbx, rdi
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x7c], ecx
cmp qword [r13 + 0x58], rcx
je 0x140004b7c
lea r9, [rbp - 0x50]
mov edx, 0x60a
lea rcx, [rsp + 0x58]
call fcn.140004448
mov edi, eax
test eax, eax
js 0x140004b2d
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14000453c
mov rcx, qword [rsp + 0x58]
lea r8, [rbp - 0x40]
xorps xmm0, xmm0
mov qword [r13 + 0x10], rax
xor eax, eax
mov qword [rbp - 0x40], 0x40
and qword [rsp + 0x20], rax
xor edx, edx
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 8], rax
lea r9d, [rax + 0x40]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov edi, eax
test eax, eax
js 0x140004b6c
mov rax, qword [rbp - 8]
mov dword [r13 + 8], eax
test al, 4
je 0x1400049db
mov edi, 0xc000010a
jmp 0x140004b6c
test al, 0x10
je 0x1400049ed
test al, 0x40
je 0x1400049ed
mov edi, 0xc0000184
jmp 0x140004b6c
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
and qword [rsp + 0x20], 0
mov r9d, 8
mov qword [rsp + 0x68], 7
lea edx, [r9 + 0x2c]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140004a2d
test byte [rsp + 0x6c], 1
je 0x140004a2d
test byte [rsp + 0x6c], 2
je 0x140004a2d
mov r14b, 1
jmp 0x140004a30
xor r14b, r14b
mov eax, r15d
lea rsi, [rbp + 0x180]
shl rax, 5
xor edx, edx
add rsi, rax
mov qword [rsi + 0x18], r13
cmp dword [rsp + 0x64], edx
je 0x140004a56
test byte [rbp - 8], 2
lea eax, [rdx + 1]
jne 0x140004a59
mov rax, rdx
and rax, 0xfffffffffffffffd
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], edx
lea r8, [rsp + 0x78]
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x78], rdx
movzx ecx, r14b
add rcx, rcx
or rcx, rax
mov rax, qword [rsp + 0x58]
and rax, 0xfffffffffffffffc
mov dword [rbx], edx
or rcx, rax
mov dword [rbx + 0x1fffc], edx
mov rdx, qword [rsp + 0x58]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsi], rcx
mov ecx, 0x20000
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov qword [rbp - 0x70], rcx
mov rcx, qword [rbp + 0x5e0]
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov edi, eax
test eax, eax
js 0x140004b22
mov rdx, qword [rsp + 0x78]
mov r9b, r14b
mov rcx, qword [rsp + 0x58]
mov r8d, 0x1fffc
mov qword [rsp + 0x28], rsi
and dword [rsp + 0x20], 0
call fcn.140004744
mov edi, eax
test eax, eax
js 0x140004b12
lea rax, [rsp + 0x60]
btr dword [rax], r15d
mov r12d, dword [rsp + 0x60]
jmp 0x140004ead
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
and qword [rsi], 0
and qword [rsi + 0x18], 0
jmp 0x140004b6c
cmp eax, 0xc0000022
jne 0x140004c0e
lea r9, [rbp - 0x50]
mov edx, 0x1000
lea r8, [0x14000e008]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtOpenProcess]
test eax, eax
js 0x140004c0e
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.14000453c
mov qword [r13 + 0x10], rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140004c0e
lea r9, [rsp + 0x50]
mov r8d, 0x20000
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
js 0x140004c0e
mov esi, dword [rbx]
mov r15d, dword [rsp + 0x50]
test esi, esi
je 0x140004bde
imul rcx, rsi, 0x128
add rcx, 8
cmp r15, rcx
jne 0x140004bdb
lea r14, [rbx + 0x30]
mov rcx, r14
call qword [sym.imp.ntdll.dll__strlwr]
add r14, 0x128
add esi, 0xffffffff
jne 0x140004bba
mov dword [rsp + 0x50], r15d
test r15d, r15d
je 0x140004c0e
jmp 0x140004be6
and dword [rbx], 0
mov dword [rsp + 0x50], 8
mov rcx, qword [rbp + 0x5d0]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rbx
call fcn.140004640
test rax, rax
je 0x140004c0e
mov ecx, dword [rsp + 0x50]
mov dword [r13 + 0x48], ecx
mov qword [r13 + 0x68], rax
mov dword [r13 + 0xc], edi
jmp 0x140004ead
or dword [rbp - 0x74], 0xffffffff
lea rdx, [rbp]
xor ecx, ecx
mov dword [rbp - 0x78], 0xff676980
lea r8, [rbp + 0x80]
xor eax, eax
lea r9, [rbp + 0x188]
lea r11d, [rcx + 0x20]
mov r10, qword [r9]
lea r9, [r9 + 0x20]
test r10, r10
je 0x140004c57
mov dword [rdx], eax
add rdx, 4
mov qword [r8], r10
add r8, 8
inc ecx
inc eax
add r11d, 0xffffffff
jne 0x140004c3c
lea rax, [rbp - 0x78]
mov r9b, 1
lea r8d, [r11 + 1]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_NtWaitForMultipleObjects]
cmp eax, 0x20
ja 0x140004ed1
mov eax, eax
lea r15, [rbp + 0x180]
mov r12d, dword [rbp + rax*4]
mov ebx, r12d
mov qword [rbp - 0x60], r12
mov eax, r12d
shl ebx, 0x11
add rbx, rdi
shl rax, 5
add r15, rax
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x68], r15
mov r14, rbx
mov qword [rsp + 0x70], rbx
mov rcx, qword [r15 + 8]
call qword [sym.imp.ntdll.dll_NtClose]
mov edi, dword [rbx + 0x1fffc]
mov rdx, qword [r15 + 0x10]
movzx eax, dx
add rbx, rax
mov dword [rsp + 0x50], edi
test byte [r15 + 8], 1
mov esi, dword [rbx]
je 0x140004d96
test esi, esi
je 0x140004dd1
imul rcx, rsi, 0x11c
add rcx, 4
cmp rdi, rcx
jne 0x140004dce
mov edx, 0x40
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rbp - 0x40]
mov r15d, eax
call qword [sym.imp.ntdll.dll__strlwr]
lea r13, [rbx + 0x20]
mov rcx, r13
call qword [sym.imp.ntdll.dll__strlwr]
mov r14, rax
cmp r15d, 0xb
jbe 0x140004d79
mov r8, r15
lea rdx, [rbp - 0x40]
mov rcx, rax
call sub.ntdll.dll_memcmp
test eax, eax
jne 0x140004d79
mov rax, qword [r14 + r15 - 9]
cmp rax, qword [str._system32_]
jne 0x140004d79
movzx eax, word [r14 + r15 - 1]
cmp ax, word [0x14000b3f8]
jne 0x140004d79
mov eax, dword [str.wow64]
mov dword [r14 + r15 - 5], eax
mov al, byte [0x14000b3e8]
mov byte [r14 + r15 - 1], al
add r13, 0x11c
add esi, 0xffffffff
jne 0x140004d21
mov r15, qword [rbp - 0x68]
mov r13, qword [rbp + 0x5d8]
mov r12, qword [rbp - 0x60]
jmp 0x140004dc3
test esi, esi
je 0x140004dd1
imul rcx, rsi, 0x128
add rcx, 8
cmp rdi, rcx
jne 0x140004dce
lea r14, [rbx + 0x30]
mov rcx, r14
call qword [sym.imp.ntdll.dll__strlwr]
add r14, 0x128
add esi, 0xffffffff
jne 0x140004dae
mov rdx, qword [r15 + 0x10]
mov r14, qword [rsp + 0x70]
jmp 0x140004dd6
and dword [rbx], 0
mov edi, 8
mov rcx, qword [r15]
xor esi, esi
mov dword [rsp + 0x50], edi
mov qword [r15 + 8], rsi
test cl, 1
je 0x140004e34
and rcx, 0xfffffffffffffffe
mov qword [r15], rcx
cmp edi, 0xfffc
ja 0x140004e34
mov r9b, cl
mov eax, edi
shr r9b, 1
mov r8d, 0x1fffc
add rdx, rax
mov qword [rsp + 0x28], r15
and r9b, 1
mov qword [r15 + 0x10], rdx
sub r8d, edi
mov dword [rsp + 0x20], 1
call fcn.140004744
mov rdi, qword [rbp + 0x5e8]
test eax, eax
jns 0x140004c17
mov rdx, qword [r15 + 0x10]
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rcx, qword [r15]
mov qword [r15 + 0x10], rsi
call qword [sym.imp.ntdll.dll_NtClose]
lea rax, [rsp + 0x60]
mov qword [r15], rsi
bts dword [rax], r12d
cmp dword [rsp + 0x50], esi
je 0x140004e9a
mov rdi, qword [r15 + 0x18]
mov dword [rdi + 0xc], esi
cmp qword [rbp - 0x58], rbx
jne 0x140004e73
mov r14, rbx
mov rbx, rsi
mov rcx, qword [rbp + 0x5d0]
lea r9, [rsp + 0x50]
mov r8, rbx
mov rdx, r14
call fcn.140004640
test rax, rax
je 0x140004e9a
mov ecx, dword [rsp + 0x50]
mov dword [rdi + 0x48], ecx
mov qword [rdi + 0x68], rax
mov r12d, dword [rsp + 0x60]
bsf eax, r12d
mov dword [rsp + 0x70], eax
je 0x140004f42
mov rdi, qword [rbp + 0x5e8]
mov rsi, qword [rbp + 0x5d0]
mov eax, dword [r13]
test eax, eax
jne 0x140004914
cmp r12d, 0xffffffff
jne 0x140004c17
mov esi, 0x20
lea rbx, [rbp + 0x190]
mov rdi, qword [rbx - 8]
test rdi, rdi
je 0x140004f25
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtTerminateThread]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, qword [rbx - 0x10]
mov dword [rax + 0xc], 0xc0000001
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov rcx, qword [rbx - 0x10]
and qword [rbx], 0
call qword [sym.imp.ntdll.dll_NtClose]
and qword [rbx - 0x10], 0
add rbx, 0x20
add esi, 0xffffffff
jne 0x140004edd
add rsp, 0x688
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rbp + 0x5e8]
jmp 0x140004c17