Function at 0x14007557c
Capabilities:
Access peb ldr_data
Check os version
Encode data using base64
Get kernel32 base address
Get number of processors

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x818
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x780], xmm6
and rsp, 0xffffffffffffffe0
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov al, byte [0x1400ea9e0]
mov ecx, 0x10
mov edx, 8
call fcn.140010eab
test rax, rax
je 0x140077c30
mov rsi, rax
mov eax, 1
mov qword [rsi], rax
mov qword [rsi + 8], rax
call fcn.140040b6e
xor ecx, ecx
mov byte [rsp + 0x65c], cl
mov r8d, 0x400
mov qword [rsp + 0x5e8], r8
mov word [rsp + 0x65f], 0
mov qword [rsp + 0x5a0], rcx
mov qword [rsp + 0x5f0], 0x200
mov qword [rsp + 0x5d8], rsi
lea r9, [0x1400bea90]
mov qword [rsp + 0x5e0], r9
mov qword [rsp + 0x5b0], rcx
mov qword [rsp + 0x5f8], rcx
mov qword [rsp + 0x608], rcx
mov qword [rsp + 0x618], rcx
mov qword [rsp + 0x628], rcx
mov dword [rsp + 0x5d0], 0x3b9aca00
mov dword [rsp + 0x5c0], 0
mov dword [rsp + 0x658], 0x3d
mov qword [rsp + 0x638], 0x100
mov qword [rsp + 0x640], rcx
mov byte [rsp + 0x648], cl
mov dword [rsp + 0x64c], eax
mov dword [rsp + 0x650], edx
mov byte [rsp + 0x661], cl
mov word [rsp + 0x65d], 0x101
lea rdx, [rsp + 0x490]
mov dword [rdx + 8], 0x10101
mov qword [rdx], r8
lea rsi, [rsp + 0x320]
mov rcx, rsi
call fcn.140044f88
mov r12, qword [rsi]
cmp r12, 2
jne 0x1400756e4
mov rax, qword [rsp + 0x328]
jmp 0x140075b99
mov qword [rsp + 0xf0], r14
mov qword [rsp + 0x2d8], rdi
lea rdx, [rsp + 0x330]
mov rdi, qword [rdx - 8]
jp 0x1400756f8
lea rsi, [rsp + 0x160]
mov r8d, 0xe8
mov eax, 0xe8
mov rcx, rsi
call fcn.140085b90
add dword [rax], eax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x510], xmm0
movaps xmmword [rsp + 0x520], xmm1
movaps xmmword [rsp + 0x530], xmm2
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x680]
mov r8d, 0xb8
call fcn.140085b90
lea rcx, [rsp + 0x5a0]
mov edx, 0x200
call fcn.140045572
mov qword [rsp + 0x2e8], rax
lock inc qword [rax]
jle 0x140077c2c
mov r14, rdx
lea r15, [rsp + 0x640]
mov rcx, r15
call fcn.14004264c
mov r13d, eax
mov dword [rsp + 0x50], edx
mov rcx, r15
call fcn.14004264c
mov rsi, qword [r15 - 0x28]
test rsi, rsi
mov qword [rsp + 0x140], rdi
je 0x1400757c6
mov rcx, qword [rsp + 0x620]
mov qword [rsp + 0x138], rcx
lock inc qword [rsi]
jg 0x1400757c6
jmp 0x140077c2c
mov rdi, qword [rsp + 0x628]
test rdi, rdi
mov qword [rsp + 0x2e0], rbx
pushfq
and al, 0xe0
add al, byte [rax]
add byte [rcx + rcx*4 - 0x4c], cl
and al, 0x88
add al, 0
add byte [rcx + rcx*4 + 0x6c], al
and al, 0x48
je 0x140075803
mov rcx, qword [rsp + 0x630]
mov qword [rsp + 0x130], rcx
lock inc qword [rdi]
jg 0x140075803
jmp 0x140077c2c
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x5c0]
mov dword [rsp + 0x58], eax
mov r15d, dword [rsp + 0x5c4]
mov eax, dword [rsp + 0x658]
mov dword [rsp + 0x78], eax
mov r14, qword [rsp + 0x638]
mov al, byte [rsp + 0x660]
mov byte [rsp + 0x68], al
mov r13b, byte [rsp + 0x661]
xorps xmm0, xmm0
movups xmmword [rsp + 0x327], xmm0
mov byte [rsp + 0x337], 0
movups xmm1, xmmword [rsp + 0x320]
movaps xmmword [rsp + 0x490], xmm1
mov rax, qword [rsp + 0x32f]
mov qword [rsp + 0x49f], rax
mov al, byte [rsp + 0x337]
mov byte [rsp + 0x4a7], al
mov eax, dword [rsp + 0x338]
mov dword [rsp + 0x4a8], eax
movzx eax, word [rsp + 0x33c]
mov word [rsp + 0x4ac], ax
mov al, byte [rsp + 0x33e]
mov byte [rsp + 0x4ae], al
movups xmmword [rsp + 0x327], xmm0
mov qword [rsp + 0x337], 0
movups xmm0, xmmword [rsp + 0x320]
movaps xmmword [rsp + 0x160], xmm0
mov rax, qword [rsp + 0x32f]
mov qword [rsp + 0x16f], rax
mov al, byte [rsp + 0x337]
mov byte [rsp + 0x177], al
mov eax, dword [rsp + 0x338]
mov dword [rsp + 0x178], eax
movzx eax, word [rsp + 0x33c]
mov word [rsp + 0x17c], ax
mov al, byte [rsp + 0x33e]
mov byte [rsp + 0x17e], al
mov ebx, 1
lock xadd qword [0x1400ea048], rbx
test rbx, rbx
je 0x140075922
movups xmm0, xmmword [rsp + 0x16f]
movups xmmword [rsp + 0x32f], xmm0
movaps xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x320], xmm0
movaps xmm0, xmmword [rsp + 0x490]
movaps xmmword [rsp + 0x160], xmm0
movups xmm0, xmmword [rsp + 0x49f]
movups xmmword [rsp + 0x16f], xmm0
mov al, byte [0x1400ea9e0]
mov ecx, 0x198
mov edx, 8
call fcn.140010eab
test rax, rax
je 0x140077c3c
mov ecx, 1
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov ecx, dword [rsp + 0x58]
mov dword [rax + 0x10], ecx
mov dword [rax + 0x14], r15d
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], rsi
mov rcx, qword [rsp + 0x138]
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rdi
mov rcx, qword [rsp + 0x130]
mov qword [rax + 0x38], rcx
xor esi, esi
mov qword [rax + 0x40], rsi
mov byte [rax + 0x48], sil
mov ecx, dword [rsp + 0x48]
mov dword [rax + 0x4c], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rax + 0x50], ecx
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x58], ecx
mov cl, byte [rsp + 0x68]
mov byte [rax + 0x5c], cl
mov byte [rax + 0x5d], r13b
mov qword [rax + 0x60], rbx
mov byte [rax + 0x68], sil
movaps xmm0, xmmword [rsp + 0x320]
movups xmmword [rax + 0x69], xmm0
movups xmm0, xmmword [rsp + 0x32f]
movups xmmword [rax + 0x78], xmm0
mov byte [rax + 0x88], sil
mov byte [rax + 0x90], sil
movups xmm0, xmmword [rsp + 0x16f]
movups xmmword [rax + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x160]
movups xmmword [rax + 0x91], xmm0
mov qword [rax + 0xb0], rsi
mov byte [rax + 0xb8], sil
mov rdi, rax
mov rcx, rax
add rcx, 0xc0
lea rdx, [rsp + 0x680]
mov r8d, 0xb8
call fcn.140085b90
mov rax, qword [rsp + 0x2e8]
mov qword [rdi + 0x178], rax
mov qword [rdi + 0x180], rsi
mov byte [rdi + 0x188], sil
mov eax, dword [rsp + 0x70]
mov dword [rdi + 0x18c], eax
mov qword [rsp + 0x138], rdi
mov eax, dword [rsp + 0x80]
mov dword [rdi + 0x190], eax
mov al, byte [0x1400ea9e0]
mov ecx, 0x200
mov edx, 8
call fcn.140010eab
test rax, rax
je 0x140077c48
mov rsi, rax
mov al, byte [0x1400ea9e0]
mov ecx, 0x70
mov edx, 8
call fcn.140010eab
test rax, rax
mov rbx, qword [rsp + 0x2e0]
and al, 0xe0
add al, byte [rax]
add byte [rdi], cl
test byte [rdi + 0x21], bl
add byte [rax], al
mov rdi, rax
cmp dword [rsp + 0x58], 0
mov eax, 0x1f
add byte [rax], al
cmove r15d, eax
xor eax, eax
mov qword [rdi], r12
mov rcx, qword [rsp + 0x140]
mov qword [rdi + 8], rcx
movaps xmm0, xmmword [rsp + 0x510]
movaps xmm1, xmmword [rsp + 0x520]
movaps xmm2, xmmword [rsp + 0x530]
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm1
movups xmmword [rdi + 0x30], xmm2
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x48], 0x40
xorps xmm0, xmm0
movups xmmword [rdi + 0x50], xmm0
mov dword [rdi + 0x60], 0
mov dword [rdi + 0x64], r15d
mov byte [rdi + 0x68], al
movups xmmword [rsp + 0x327], xmm0
movups xmm0, xmmword [rsp + 0x320]
movups xmmword [rsp + 0x789], xmm0
mov rcx, qword [rsp + 0x32f]
mov qword [rsp + 0x798], rcx
mov word [rax + rbx*4], fs
invalid
add byte [rax], al
mov byte [rsp + 0x788], al
add byte [rax], al
mov ecx, 8
mov edx, 0x10
jmp 0x140077c82
mov ecx, 8
mov edx, 0x198
jmp 0x140077c82
mov ecx, 8
mov edx, 0x200
jmp 0x140077c82
mov ecx, 8
mov edx, 0x70
jmp 0x140077c82