Function at 0x140072460
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x118], r15d
mov ebx, r15d
lea r9, [rbp + 0x118]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400724ff
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x118]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x118]
mov r8d, dword [rbp + 0x118]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400724b0
test eax, eax
js 0x140072fd3
test rbx, rbx
je 0x140072fe9
mov r14, r15
mov edi, r15d
cmp qword [rbx], rdi
jbe 0x140072576
mov rax, r15
nop
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp + 0xa0], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp + 0xa0]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140072563
cmp qword [rsp + 0x40], rsi
je 0x140072571
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140072520
jmp 0x140072fd8
movq r14, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x140072fe9
mov qword [rsp + 0x78], r15
add r14, 8
je 0x140072eab
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 8
mov dword [rbp + 0x120], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140072eab
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x140072eab
mov qword [rbp - 0x80], r15
add rax, 8
je 0x140072d80
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 8
mov dword [rbp + 0x120], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140072d80
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140072d80
mov qword [rbp + 0x128], r15
add rax, 0x28
je 0x140072c54
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 8
mov dword [rbp + 0x120], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140072c54
mov rax, qword [rbp + 0x128]
test rax, rax
je 0x140072c54
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
add rax, 0x58
je 0x140072b10
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], socket
mov dword [rbp + 0x120], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140072b10
movzx eax, word [rsp + 0x68]
test ax, ax
je 0x140072b10
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.1400ba344
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400f14e0
mov qword [rbp + 0xa0], rdi
movzx r9d, word [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rsi
call fcn.14006ff70
test al, al
jne 0x14007294d
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
cmp dword [rbp + rcx - 0x60], 0
jne 0x1400728e1
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x20
call fcn.1400ba130
mov rdx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x1f
mov qword [rsp + 0x58], 0x1f
movups xmm0, xmmword [str.____Failed_to_read_driver_name_n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14013bf90]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14013bf98]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14013bf9c]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14013bf9e]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400728e1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400728db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073008
call fcn.1400b9d58
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
jmp 0x140072afe
mov word [rsp + 0x68], r15w
mov rax, qword [rbp + 0x128]
add rax, 0x58
je 0x1400729f9
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], 0x33
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], socket
mov dword [rbp + 0x120], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x120]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x1400729f9
lea rdx, str.___MmUnloadedDrivers_Cleaned:
lea rcx, [0x140242640]
call fcn.140079cb0
mov rbx, rax
mov rdx, rdi
mov rcx, rax
call fcn.140079cb0
mov rcx, rbx
call fcn.140079f70
mov bl, 1
jmp 0x140072b00
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rcx, qword [rbp - 0x70]
movsxd rax, dword [rcx + 4]
cmp dword [rbp + rax - 0x60], 0
jne 0x140072a9b
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x30
call fcn.1400ba130
mov rdx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x27
mov qword [rsp + 0x58], 0x2f
movups xmm0, xmmword [str.____Failed_to_write_driver_name_length_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14013bfb0]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x14013bfc0]
mov dword [rax + 0x20], ecx
movzx eax, word [0x14013bfc4]
mov word [rdx + 0x24], ax
movzx eax, byte [0x14013bfc6]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
lea rcx, [rsp + 0x40]
call fcn.14005ed40
mov rcx, qword [rbp - 0x70]
movsxd rax, dword [rcx + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
xor bl, bl
mov rcx, rdi
call fcn.1400b9d58
movzx eax, bl
jmp 0x140072feb
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
cmp dword [rbp + rcx - 0x60], 0
jne 0x140072be8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x20
call fcn.1400ba130
mov rdx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x1f
mov qword [rsp + 0x58], 0x1f
movups xmm0, xmmword [str.____Failed_to_find_driver_name_n]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14013bf70]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x14013bf78]
mov dword [rax + 0x18], ecx
movzx eax, word [0x14013bf7c]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x14013bf7e]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140072be8
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072be2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007300e
call fcn.1400b9d58
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
jmp 0x140072fe9
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
cmp dword [rbp + rcx - 0x60], 0
jne 0x140072d14
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x30
call fcn.1400ba130
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x22
mov qword [rsp + 0x58], 0x2f
movups xmm0, xmmword [str.____Failed_to_find_driver_section_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14013bf48]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x14013bf58]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140072d14
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072d0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073014
call fcn.1400b9d58
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
jmp 0x140072fe9
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
cmp dword [rbp + rcx - 0x60], 0
jne 0x140072e3f
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x30
call fcn.1400ba130
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x21
mov qword [rsp + 0x58], 0x2f
movups xmm0, xmmword [str.____Failed_to_find_driver_object_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14013bf20]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14013bf30]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140072e3f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072e39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007301a
call fcn.1400b9d58
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
jmp 0x140072fe9
mov r8d, 1
lea rdx, str.C:_bKernellog.log
lea rcx, [rbp - 0x70]
call fcn.1400779b0
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
cmp dword [rbp + rcx - 0x60], 0
jne 0x140072f6a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0x30
call fcn.1400ba130
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x21
mov qword [rsp + 0x58], 0x2f
movups xmm0, xmmword [str.____Failed_to_find_device_object_n]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14013bef8]
movups xmmword [rax + 0x10], xmm1
movzx ecx, byte [0x14013bf08]
mov byte [rax + 0x20], cl
mov byte [rax + 0x21], 0
lea rcx, [rsp + 0x40]
call fcn.14006d5d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140072f6a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072f64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073002
call fcn.1400b9d58
nop
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rdx
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx - 0x74], edx
lea rcx, [rbp - 0x60]
call fcn.14005deb0
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x70], rax
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx - 0x74], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x40]
call fcn.1400bb848
nop
jmp 0x140072fe9
test rbx, rbx
je 0x140072fe9
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rbx, qword [rsp + 0x210]
add rsp, 0x1e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
int3