Function at 0x140020b30
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
xor r15d, r15d
call fcn.140020790
mov r13d, eax
test eax, eax
jns 0x140020b9a
cmp eax, 0xc0000510
jne 0x1400211f4
mov rax, qword [0x140398f48]
cmp word [rax], 2
jne 0x140020d9b
movzx edx, word [rax + 2]
test dx, dx
jns 0x140020d9b
mov ecx, 0x8001
cmp dx, cx
jne 0x140020d9b
mov eax, r15d
jmp 0x1400211f4
mov rax, qword [0x140398f48]
mov word [rax], 2
mov rax, qword [0x140398f48]
mov word [rax + 2], 0x8001
mov rax, qword [0x140398f48]
mov qword [rax + 0x70], rax
mov rcx, qword [0x140398f48]
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov bl, 0xa
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0x77]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [rbp + 0x6f]
test eax, 0xf0000000
je 0x140020bf3
movzx eax, ax
mov dword [rbp + 0x6f], eax
mov ecx, dword [rbp + 0x77]
sub ecx, 5
je 0x140020d01
sub ecx, 1
je 0x140020c88
cmp ecx, 4
jne 0x140020d3a
cmp dword [rbp + 0x67], r15d
jne 0x140020d3a
cmp eax, 0x2800
jb 0x140020d3a
cmp eax, 0x3839
jb 0x140020c73
cmp eax, 0x3ad7
jb 0x140020c5e
cmp eax, 0x55f0
mov rax, qword [0x140398f48]
jb 0x140020c50
mov edx, pe_nt_image_headers64
mov byte [rax + 0x14], 9
jmp 0x140020d4c
mov edx, 0x120
mov byte [rax + 0x14], 8
jmp 0x140020d4c
mov edx, 0x120
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], 7
jmp 0x140020d4c
mov edx, 0x118
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], 6
jmp 0x140020d4c
mov ecx, dword [rbp + 0x67]
test ecx, ecx
je 0x140020ce7
sub ecx, 1
je 0x140020cd2
sub ecx, 1
je 0x140020cc2
cmp ecx, 1
jne 0x140020d3a
cmp eax, 0x2580
jne 0x140020d3a
mov edx, 0x118
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], 5
jmp 0x140020d4c
cmp eax, 0x23f0
jne 0x140020d3a
mov bl, 4
mov edx, 0x110
jmp 0x140020d3d
sub eax, 0x1db0
je 0x140020cde
cmp eax, 1
jne 0x140020d3a
mov bl, 3
mov edx, 0xe0
jmp 0x140020d3d
sub eax, 0x1770
je 0x140020cf8
sub eax, 1
je 0x140020cf8
cmp eax, 1
jne 0x140020d3a
mov bl, 2
mov edx, reloc.OLEAUT32.dll_SetErrorInfo
jmp 0x140020d3d
mov ecx, dword [rbp + 0x67]
cmp ecx, 1
jne 0x140020d1c
cmp eax, 0xa28
je 0x140020d28
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], bl
jmp 0x140020d7e
cmp ecx, 2
jne 0x140020d3a
cmp eax, 0xece
jne 0x140020d3a
mov edx, 0x98
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], 1
jmp 0x140020d4c
mov edx, dword [rbp + 0x67]
mov rax, qword [0x140398f48]
mov byte [rax + 0x14], bl
cmp bl, 0xa
je 0x140020d7e
mov ecx, dword [rbp + 0x77]
mov rax, qword [0x140398f48]
mov dword [rax + 8], ecx
mov ecx, dword [rbp + 0x67]
mov rax, qword [0x140398f48]
mov dword [rax + 0xc], ecx
mov ecx, dword [rbp + 0x6f]
mov rax, qword [0x140398f48]
mov dword [rax + 0x10], ecx
mov rax, qword [0x140398f48]
mov word [rax + 0x16], dx
mov rax, qword [0x140398f48]
cmp byte [rax + 0x14], 0xa
jne 0x140020da5
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0xc00000bb
jmp 0x1400211f4
lea rcx, [rax + 0x88]
mov qword [rax + 0x48], rcx
add rcx, 0x20
mov rax, qword [0x140398f48]
mov qword [rax + 0x50], rcx
add rcx, 8
mov rax, qword [0x140398f48]
mov qword [rax + 0x58], rcx
add rcx, 8
mov rax, qword [0x140398f48]
mov qword [rax + 0x60], rcx
add rcx, 0x90
mov rax, qword [0x140398f48]
mov qword [rax + 0x68], rcx
add rcx, 0xa8
mov rax, qword [0x140398f48]
mov qword [rax + 0x78], rcx
add rcx, 0x18
mov rax, qword [0x140398f48]
mov qword [rax + 0x80], rcx
mov edx, 0xeb
lea rcx, [rbp - 0x21]
call fcn.1400111e0
mov rbx, rax
mov rdi, qword [rax + 0x10]
mov rcx, rax
call fcn.140042b10
test al, al
je 0x140020e39
mov rcx, r15
jmp 0x140020e4b
mov rax, qword [rbx + 8]
lea rcx, [0x14025ad40]
test rax, rax
cmovne rcx, rax
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rcx
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.14008d7e0
nop
mov r14, 0xffffffffffffffff
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x140020e87
mov eax, r14d
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140020e87
mov rcx, qword [rbp - 0x21]
call fcn.1402275a0
nop
lea rcx, [rbp - 0x39]
call fcn.140094620
mov r12, rax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rsi, qword [rdx + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140020eef
mov rbx, rdi
mov rdi, qword [rdi]
movzx r8d, word [rbx + 0x58]
shr r8, 1
sub r8, 4
mov rdx, qword [rbx + 0x60]
mov rcx, r12
call fcn.14022ff20
test eax, eax
je 0x140020ef2
movzx r8d, word [rbx + 0x58]
shr r8, 1
mov rdx, qword [rbx + 0x60]
mov rcx, r12
call fcn.14022ff20
test eax, eax
je 0x140020ef2
cmp rdi, rsi
jne 0x140020eb0
mov rbx, r15
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140020f10
mov eax, r14d
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140020f10
mov rcx, qword [rbp - 0x39]
call fcn.1402275a0
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x48]
mov qword [rcx + 8], rbx
call fcn.140020210
mov rcx, qword [0x140398f48]
mov rdx, qword [rcx + 0x48]
mov qword [rdx], rax
mov edx, 0x20b
lea rcx, [rbp - 9]
call fcn.1400111e0
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140020f52
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140020f64
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rdi
call fcn.14003f690
mov rdx, qword [rdi + 8]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140398f48]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x10], rax
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140020f9f
mov eax, r14d
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140020f9f
mov rcx, qword [rbp - 9]
call fcn.1402275a0
mov edx, 0x20c
lea rcx, [rbp + 0xf]
call fcn.1400111e0
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140020fbf
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140020fd1
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rdi
call fcn.14003f690
mov rdx, qword [rdi + 8]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140398f48]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x18], rax
mov rax, qword [rbp + 0xf]
test rax, rax
je 0x14002100b
lock xadd dword [rax], r14d
cmp r14d, 1
jne 0x14002100b
mov rcx, qword [rbp + 0xf]
call fcn.1402275a0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x30
mov rcx, qword [rdx]
cmp rdx, rcx
je 0x140021073
nop dword [rax + rax]
lea rax, [rcx + 0x50]
mov rdi, qword [rax]
cmp rdi, rax
je 0x140021041
cmp qword [rdi], rax
je 0x14002104b
mov rcx, qword [rcx]
cmp rdx, rcx
jne 0x140021030
jmp 0x140021073
add rcx, 0x38
mov edx, 1
call fcn.140021c20
neg eax
movsxd rbx, eax
shl rbx, 4
add rbx, rdi
mov rcx, rbx
call fcn.140020710
test eax, eax
cmovne r15, rbx
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x58]
mov qword [rcx], r15
call fcn.140020380
mov rcx, qword [0x140398f48]
mov rdx, qword [rcx + 0x50]
mov qword [rdx], rax
mov rax, qword [0x140398f48]
mov dword [rax + 4], reloc.WS2_32.dll_WSAAsyncSelect
mov rcx, qword [0x140398f48]
mov rax, qword [rcx + 0x48]
cmp qword [rax], 0
je 0x1400210be
or dword [rcx + 4], 2
mov rcx, qword [0x140398f48]
mov rax, qword [rcx + 0x58]
cmp qword [rax], 0
je 0x1400210d3
or dword [rcx + 4], 8
mov rcx, qword [0x140398f48]
mov rax, qword [rcx + 0x50]
cmp qword [rax], 0
je 0x1400210e8
or dword [rcx + 4], 0x10
mov rcx, qword [0x140398f48]
mov rax, qword [rcx + 0x78]
lea rcx, [fcn.140021f70]
mov qword [rax], rcx
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.140022bb0]
mov qword [rcx + 8], rax
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x78]
lea rax, [0x140022f60]
mov qword [rcx + 0x10], rax
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
add rcx, 0x38
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rcx + 0x48], rax
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rcx + 0x50], rax
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x80]
mov dword [rcx + 0x58], 1
mov rax, qword [0x140398f48]
mov rdx, qword [rax + 0x80]
lea rcx, [rdx + 0x38]
mov rax, qword [rdx + 8]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov qword [rdx + 8], rcx
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x40], 0
mov rax, qword [0x140398f48]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x41], 0
mov eax, r13d
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret