Function at 0x7ff65ee33e80
Capabilities:
Allocate or change rwx memory
Check for time delay via queryperformancecounter
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x278]
sub rsp, 0x350
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
mov rax, qword [str.e41k2]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rcx, qword [0x7ff65f42f368]
test rcx, rcx
jne 0x7ff65ee33f12
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rbp - 0x78], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rcx, rax
mov qword [0x7ff65f42f368], rax
mov rax, qword [rcx]
call qword [rax + 0x88]
xor r12d, r12d
mov edi, r12d
mov r14d, 2
cmp rax, r14
cmova edi, r14d
mov rax, qword [0x7ff65f42f368]
test rax, rax
jne 0x7ff65ee33f58
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rbp - 0x78], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
nop
mov qword [0x7ff65f42f368], rax
mov rsi, qword [rax + 0xb0]
mov rbx, r12
mov edx, 3
mov rcx, rsi
call fcn.7ff65efcbc10
lea ecx, [rax + 2]
cmp ecx, 1
jbe 0x7ff65ee33fa3
test rbx, rbx
jne 0x7ff65ee33f8e
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.7ff65efcb9e0
mov rbx, rax
jmp 0x7ff65ee33f97
cmp dword [rbx + 0x30], eax
jne 0x7ff65ee33fa3
mov rbx, qword [rbx + 0x38]
test rbx, rbx
je 0x7ff65ee33fa3
cmp dword [rbx + 0x10], edi
jne 0x7ff65ee33f62
jmp 0x7ff65ee33fa6
mov rbx, r12
mov r9d, 1
lea r8, [rbp - 0x68]
mov rdx, rbx
mov rcx, rsi
call fcn.7ff65efcb880
mov rax, qword [rbp - 0x68]
test rax, rax
je 0x7ff65ee33fd7
mov ebx, dword [rax + 0x10]
mov dword [rsp + 0x34], ebx
cmp ebx, edi
jae 0x7ff65ee33fdb
mov dword [rsp + 0x34], edi
mov edi, ebx
jmp 0x7ff65ee33fdb
mov dword [rsp + 0x34], edi
mov ecx, edi
call fcn.7ff65ed5c900
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, 0x200000
xor ecx, ecx
call fcn.7ff65ee00a20
mov ecx, 0x28
call fcn.7ff65efe06d0
mov rsi, rax
mov qword [rbp - 0x78], rax
mov qword [rax], 0x1000000
mov dword [rax + 8], r12d
mov qword [rax + 0x10], 0x1000000
xor eax, eax
mov dword [rsi + 0x18], eax
mov qword [rsi + 0x20], r12
mov rcx, rsi
call fcn.7ff65ed5cae0
test al, al
jne 0x7ff65ee3404c
mov edx, 0x40
mov rcx, qword [rsi]
call fcn.7ff65efefe20
mov qword [rsi + 0x20], rax
mov rbx, qword [0x7ff65f42f368]
test rbx, rbx
jne 0x7ff65ee34079
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rbx, rax
mov qword [0x7ff65f42f368], rax
mov rdi, rbx
test rbx, rbx
jne 0x7ff65ee340a2
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rdi, rax
mov qword [0x7ff65f42f368], rax
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0xb8]
mov rbx, rax
shr rbx, 0x16
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0xa8]
cmp rbx, rax
jbe 0x7ff65ee340d0
mov ecx, 0x800000
jmp 0x7ff65ee34155
mov rbx, qword [0x7ff65f42f368]
test rbx, rbx
jne 0x7ff65ee340fd
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rbx, rax
mov qword [0x7ff65f42f368], rax
mov rdi, rbx
test rbx, rbx
jne 0x7ff65ee34126
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rdi, rax
mov qword [0x7ff65f42f368], rax
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0xb8]
mov rbx, rax
shr rbx, 0x16
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0xa8]
mov ecx, 0x200000
mov edx, 0x400000
cmp rbx, rax
cmovae ecx, edx
mov qword [rsp + 0x38], rcx
mov rsi, qword [rsi + 0x20]
mov rdi, r12
mov edx, 0x1000
mov ecx, 0x1c0
call fcn.7ff65efefe20
mov rbx, rax
mov qword [rax + 0xe0], rsi
mov edx, 0x4000
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x118], rax
mov dword [rbx + 0x120], r12d
mov qword [rbx + 0x128], 0xffffffffffffffff
mov qword [rbp + rdi*8 + 0x30], rbx
inc rdi
add rsi, 0x200000
cmp rdi, 8
jb 0x7ff65ee34161
mov rcx, qword [0x7ff65f42f368]
test rcx, rcx
jne 0x7ff65ee341ec
mov ecx, 0x110
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
mov rcx, rax
call fcn.7ff65ecfd8d0
mov rcx, rax
mov qword [0x7ff65f42f368], rax
mov rax, qword [rcx]
call qword [rax + 0x20]
lea rcx, [0x7ff65f108c28]
lea rdx, [0x7ff65f108b98]
test al, al
cmovne rdx, rcx
mov qword [rsp + 0x58], rdx
lea rax, [0x7ff65f108c70]
mov qword [rbp - 0x80], rax
mov rcx, rax
mov qword [rsp + 0x50], rax
lea rax, [0x7ff65f108c40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x48], rax
mov rsi, r12
mov qword [rsp + 0x60], r12
mov r8d, 6
mov qword [rbp - 0x70], r8
mov qword [rsp + 0x68], r8
movsd xmm8, qword [0x7ff65f153830]
movsd xmm13, qword [0x7ff65f153858]
movsd xmm10, qword [0x7ff65f153808]
mov dword [rbp + 0x10], 1
mov dword [rbp + 0x14], r14d
mov dword [rbp + 0x18], 4
lea r15, [rbp + 0x10]
mov rdi, qword [rsp + 0x38]
nop dword [rax]
movsxd r13, dword [r15]
mov rbx, r13
mov r14, r13
imul r14, qword [rax]
cmp r14, rdi
ja 0x7ff65ee3443c
mov eax, dword [rcx]
mov dword [rsp + 0x78], eax
mov r8d, 1
mov edx, dword [rdx + r13*4]
lea rcx, [rsp + 0x78]
call fcn.7ff65ed672f0
mov r12, rax
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm7, xmm7
cvtsi2sd xmm7, qword [rbp - 0x60]
mulsd xmm7, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp - 0x58]
divsd xmm7, xmm0
movaps xmm9, xmm13
xor esi, esi
mov edi, esi
nop word [rax + rax]
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rbp - 0x50]
mulsd xmm6, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp - 0x48]
divsd xmm6, xmm0
cmp edi, 0xa
jb 0x7ff65ee34332
movaps xmm0, xmm6
subsd xmm0, xmm7
comisd xmm0, xmm10
jae 0x7ff65ee34391
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x30]
lea r8, [rbp + 0xc0]
mov edx, 0x50
lea rcx, [rbp + 0x70]
call r12
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rbp - 0x40]
mulsd xmm1, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp - 0x38]
divsd xmm1, xmm0
subsd xmm1, xmm6
minsd xmm1, xmm9
movaps xmm9, xmm1
inc edi
jmp 0x7ff65ee342f0
xorps xmm0, xmm0
test r13d, r13d
js 0x7ff65ee343a0
cvtsi2sd xmm0, rbx
jmp 0x7ff65ee343b5
mov rax, rbx
shr rax, 1
and ebx, 1
or rax, rbx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mulsd xmm0, xmm8
divsd xmm0, xmm9
mov rsi, qword [rsp + 0x60]
lea r9, [0x7ff65ec80000]
comisd xmm0, xmmword [rsi + r9 + 0x5173e0]
jbe 0x7ff65ee343f5
movsd qword [rsi + r9 + 0x5173e0], xmm0
mov dword [rsi + r9 + 0x5173e8], r13d
mov dword [rsi + r9 + 0x5173ec], 1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x58]
cmp r14, 0x800000
jae 0x7ff65ee3443c
comisd xmm0, xmmword [rsi + r9 + 0x517440]
jbe 0x7ff65ee3443c
movsd qword [rsi + r9 + 0x517440], xmm0
mov dword [rsi + r9 + 0x517448], r13d
mov dword [rsi + r9 + 0x51744c], 1
add r15, 4
lea r8, [rbp + 0x1c]
cmp r15, r8
jne 0x7ff65ee34280
add rax, 8
mov qword [rsp + 0x48], rax
add rcx, 4
mov qword [rsp + 0x50], rcx
add rsi, 0x10
mov qword [rsp + 0x60], rsi
sub qword [rsp + 0x68], 1
mov r14d, 2
jne 0x7ff65ee34261
call fcn.7ff65efcd220
mov rbx, rax
mov edx, dword [rsp + 0x34]
mov rcx, rax
call fcn.7ff65efceac0
mov ecx, 0x290
call fcn.7ff65efe06d0
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea r8d, [r14 + 1]
mov rdx, rbx
mov rcx, rax
call fcn.7ff65ee33c00
mov rbx, rax
xor r12d, r12d
mov esi, r12d
movsd xmm10, qword [0x7ff65f153810]
movsd xmm11, qword [0x7ff65f153838]
movsd xmm12, qword [0x7ff65f1537e0]
lea rax, [0x7ff65f108c40]
mov r13, qword [rsp + 0x58]
nop
mov dword [rbp + 0x20], 1
mov dword [rbp + 0x24], 2
mov dword [rbp + 0x28], 4
lea r15, [rbp + 0x20]
nop dword [rax]
movsxd rcx, dword [r15]
mov qword [rsp + 0x60], rcx
mov r14, rcx
imul r14, qword [rax]
add r14, r14
cmp r14, rdi
ja 0x7ff65ee34767
mov rax, qword [rbp - 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x34], eax
mov r8d, 1
mov edx, dword [r13 + rcx*4]
lea rcx, [rsp + 0x34]
call fcn.7ff65ed672f0
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm7, xmm7
cvtsi2sd xmm7, qword [rsp + 0x50]
mulsd xmm7, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
divsd xmm7, xmm0
movaps xmm9, xmm13
mov edi, r12d
lea r13, vtable.xmrig::ghostrider::HelperThread::Task_class__lambda_880844f7a1f117218369259700e9280e__.0
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rbp - 0x30]
mulsd xmm6, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rbp - 0x28]
divsd xmm6, xmm0
cmp edi, 0xa
jb 0x7ff65ee345c6
movaps xmm0, xmm6
subsd xmm0, xmm7
comisd xmm0, xmm10
jae 0x7ff65ee346c4
lea rax, [rsp + 0x68]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x70]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0xc0]
mov qword [rbp - 8], rax
lea rax, [rbp + 0x30]
mov qword [rbp], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 8], rax
mov rcx, rbx
call sub.KERNEL32.dll_EnterCriticalSection
mov ecx, dword [rbx + 0x270]
shl rcx, 7
mov eax, dword [rbx + 0x270]
inc eax
mov dword [rbx + 0x270], eax
mov qword [rcx + rbx + 0x70], r13
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rcx + rbx + 0x78], xmm0
movups xmm1, xmmword [rbp - 8]
movups xmmword [rcx + rbx + 0x88], xmm1
movsd xmm0, qword [rbp + 8]
movsd qword [rcx + rbx + 0x98], xmm0
lea rcx, [rbx + 0x28]
call sub.KERNEL32.dll_WakeConditionVariable
mov rcx, rbx
call sub.KERNEL32.dll_LeaveCriticalSection
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x30]
lea r8, [rbp + 0xc0]
mov edx, 0x50
lea rcx, [rbp + 0x70]
call qword [rsp + 0x68]
mov eax, dword [rbx + 0x270]
test eax, eax
je 0x7ff65ee3467f
pause
mov eax, dword [rbx + 0x270]
test eax, eax
jne 0x7ff65ee34673
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rbp - 0x20]
mulsd xmm1, xmm8
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x40]
divsd xmm1, xmm0
subsd xmm1, xmm6
minsd xmm1, xmm9
movaps xmm9, xmm1
inc edi
jmp 0x7ff65ee34580
mov rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
test rdx, rdx
js 0x7ff65ee346d8
cvtsi2sd xmm0, rdx
jmp 0x7ff65ee346f0
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
mulsd xmm0, xmm11
divsd xmm0, xmm9
mulsd xmm0, xmm12
lea rax, [0x7ff65ec80000]
comisd xmm0, xmmword [rsi + rax + 0x5173e0]
mov r13, qword [rsp + 0x58]
mov ecx, 2
jbe 0x7ff65ee34732
movsd qword [rsi + rax + 0x5173e0], xmm0
mov dword [rsi + rax + 0x5173e8], edx
mov dword [rsi + rax + 0x5173ec], ecx
mov rdi, qword [rsp + 0x38]
cmp r14, 0x800000
jae 0x7ff65ee34762
comisd xmm0, xmmword [rsi + rax + 0x517440]
jbe 0x7ff65ee34762
movsd qword [rsi + rax + 0x517440], xmm0
mov dword [rsi + rax + 0x517448], edx
mov dword [rsi + rax + 0x51744c], ecx
mov rax, qword [rsp + 0x70]
add r15, 4
lea rcx, [rbp + 0x2c]
cmp r15, rcx
jne 0x7ff65ee34500
add rax, 8
mov qword [rsp + 0x70], rax
add qword [rbp - 0x80], 4
add rsi, 0x10
sub qword [rbp - 0x70], 1
jne 0x7ff65ee344e0
test rbx, rbx
je 0x7ff65ee347a2
mov rcx, rbx
call fcn.7ff65ee348b0
cmp qword [rbp + 0x30], r12
je 0x7ff65ee347c3
nop dword [rax + rax]
mov rcx, qword [rbp + r12*8 + 0x30]
call fcn.7ff65efefe04
inc r12
cmp r12, 8
jb 0x7ff65ee347b0
mov rbx, qword [rbp - 0x78]
mov r9, qword [rbx + 0x20]
test r9, r9
je 0x7ff65ee34838
mov ecx, dword [rbx + 0x18]
mov eax, ecx
shr eax, 3
and al, 1
je 0x7ff65ee3480e
lea rcx, [0x7ff65f42e3b0]
call fcn.7ff65efdef50
test eax, eax
jne 0x7ff65ee3489d
mov rcx, qword [0x7ff65f42f618]
mov rax, qword [rcx]
mov edx, dword [rbx + 8]
call qword [rax + 0x18]
lea rcx, [0x7ff65f42e3b0]
call fcn.7ff65efdef74
jmp 0x7ff65ee34838
movzx eax, cl
and al, 1
jne 0x7ff65ee34826
shr ecx, 1
and cl, 1
jne 0x7ff65ee34826
mov rcx, r9
call fcn.7ff65efefe04
jmp 0x7ff65ee34838
xor edx, edx
mov r8d, 0x8000
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov edx, 0x28
mov rcx, rbx
call fcn.7ff65efe070c
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.7ff65efe06b0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.7ff65efdec44
int3