Function at 0x140130f34
Capabilities:
Contain obfuscated stackstrings
Execute syscall

Disassembly:
add bh, al
and al, 0x68
js 0x14012feef
jae 0x14012fe47
and al, 0x5c
div dh
div dh
mov dword [rsp + 0x6c], 0x81596f78
mov dword [rsp + 0x60], 0xf6f6f6f6
jmp 0x14013027a
rol ecx, 0x7a
pushf
int3
mov dword [rbp - 0x24], 0x6b806b2a
mov dword [rbp - 0x64], 0xf6f6f6f6
mov dword [rbp - 0x20], 0x6c6b7673
mov dword [rbp - 0x60], 0xf6f6f6f6
mov dword [rbp - 0x1c], 0x792a6f76
mov dword [rbp - 0x5c], 0xf6f6f6f6
jmp 0x140130240
xchg r13, r12
mov dword [rbp - 0x44], 0x4b4f565a
mov dword [rsp + 0x7c], 0xf6f6f6f6
jmp 0x14013017f
add cl, al
mov byte [rsp + rdx + 0x68], cl
mov byte [rsp + rdx + 0x58], r13b
inc rdx
cmp rdx, 0xf
jb 0x1401302a1
jne 0x140130134
je 0x140130134
jns 0x14013049f
ror esi, 0x47
lea ebp, [rdi - 0xedd5]
test r8, rbp
xor edx, 0xae4d891d
ror r10d, 0xbc
movabs r11, 0x23078b00000177e9
lea r9d, [rbp + 0x2ba3]
cmp r9, rdi
jmp 0x140130c55
jmp 0x1401302b0
mov dword [rbp - 0x40], 0x582a4f5d
mov dword [rbp - 0x80], 0xf6f6f6f6
mov dword [rbp - 0x3c], 0x444f5e59
mov dword [rbp - 0x7c], 0xf6f6f6f6
mov dword [rbp - 0x38], 0x71784f2a
mov dword [rbp - 0x78], 0xf6f6f6f6
jmp 0x1401302c3
mov dword [rbp - 0x6c], 0xf6f6f6f6
mov dword [rbp - 0x28], 0x8179782a
mov dword [rbp - 0x68], 0xf6f6f6f6
jmp 0x14012ffad
and dword [rbx - 0x7e000005], 0xffffffc6
jle 0x140130260
push rsp
pop rbp
movabs r15, 0x67e0e2fffffe04e9
mov ebx, 0x3d86fd83
ret
mov dword [rbp - 0x18], 0x13141478
mov dword [rbp - 0x58], 0xf6f6f6f6
mov dword [rbp - 0x14], 0x38818181
jmp 0x14013007d
jne 0x14012ffa5
cmp edx, 0xee9bd3e0
je 0x140130301
inc r8d
jmp 0x140130078
mov dword [rsp + 0x70], 0x71787378
mov word [rsp + 0x64], 0xf6f6
mov dword [rsp + 0x74], 0x7f7d38
mov byte [rsp + 0x66], 0xf6
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x68]
movzx ecx, byte [rsp + rdx + 0x58]
jmp 0x1401300fa
mov dword [rsp + 0x78], 0xf6f6f6f6
xchg r13, r12
mov rdx, r12
jmp 0x140130004
mov dword [rbp - 0x34], 0x596f7873
mov dword [rbp - 0x74], 0xf6f6f6f6
mov dword [rbp - 0x30], 0x78737881
mov dword [rbp - 0x70], 0xf6f6f6f6
mov dword [rbp - 0x2c], 0x7d732a71
jmp 0x1401301d0
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
jne 0x140130319
je 0x140130319
jmp rax
jmp 0x1401305f0
lea rax, [rbp + 0xcc]
mov dword [rbp + 0xcc], r13d
mov rcx, 0xffffffffffffffff
xchg r15, rax
jmp 0x140130722
mov dword [rbp + 0x120], eax
mov ecx, dword [r15 + 0xa0]
mov qword [rbp + 0x1a8], rcx
jne 0x1401303a6
je 0x1401303a6
jmp 0x14012fae4
jmp 0x14013088f
cmp byte [rbx + 5], 0x61
jne 0x140130a89
mov dil, 1
jmp 0x140130a89
cmp dword [rbx], 0x54494e49
je 0x140131503
cmp dword [rbx + 0xc], 0xfffffffe
jne 0x140130798
nop
jne 0x14012f5db
jmp 0x1401307b7
cmp rcx, rdi
jae 0x1401304b0
lea rax, [rcx + rdi]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0xe0], rdi
lea r8, [rbp + 0xd8]
mov eax, dword [r15 + 0x54]
jmp 0x140130630
xor dword [rdi], ecx
movabs byte [0x26ffffff17e9bb48], al
mov bl, 0x70
syscall
jmp 0x14013056d
jae 0x14013049c
lea rax, [rdx + rdi]
xchg rsi, rax
mov qword [rbp + 0x1a0], rsi
xchg rsi, rax
jmp 0x14013049c
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
mov r12d, dword [rcx + rdx*4]
mov edx, dword [r15 + 0xd8]
jmp 0x1401308a4
lea rdx, [rbp + 0xe0]
mov qword [rbp + 0xd8], rax
mov r9d, 4
jmp 0x14013032e
invalid
lea rax, [rax + 0x21]
lea rax, [r15 + rax*8]
cmp rbx, rax
jae 0x1401317d5
nop word [rax + rax]
cmp dword [rbx + 0x10], r13d
je 0x140131503
jmp 0x1401307ef
sub dword [rdx - 9], 0xbf48ffff
jmp 0x14013086e
mov qword [rsp + 0x20], r15
xchg r15, rax
call r12
movzx eax, word [r15 + 6]
lea rbx, [r15 + 0x108]
lea rax, [rax + rax*4]
je 0x140130766
jne 0x140130766
lea r9d, [rdi - 0x5462]
rcl r8d, 0x5b
and ecx, 0xaefd1661
jnp 0x140131662
call rax
pop r14
lea r10d, [rbp + 0x4bf6]
jmp rax
jmp 0x14013069f
xor dil, dil
cmp byte [rbx], 0x2e
jne 0x140130a89
mov eax, dword [rbx + 1]
cmp eax, 0x74616469
jne 0x14013094d
jmp 0x140130468
ror ecx, 0xe7
jmp rcx
cmp dword [rbx + 0x14], r13d
je 0x140131503
cmp byte [rbx], 0x2e
jne 0x14013047a
cmp dword [rbx + 1], 0x63727372
je 0x140131503
jmp 0x14013047a
mul rdx
rcl r11d, 0xca
jb 0x14012f747
add r11d, 0x36808875
pushf
jg 0x14012f1d8
jmp 0x1401304f5
ror esi, 0x21
and r9d, 0x881a2ddf
jnp 0x140130bbf
add ebp, 0x68958339
test edx, 0x8bf04e89
jmp 0x1401308c0
mov eax, dword [r15 + 0xa4]
mov dword [rbp + 0x124], eax
cmp rdx, rdi
jmp 0x140130567
add r12, r9
xchg rdx, r13
mov qword [rbp + 0x1a0], r13
xchg r13, rdx
mov eax, dword [r15 + 0xdc]
jmp 0x14013034a
ja 0x140130aa1
dec r13
sub esi, 0xab8899c7
div rdx
test r9d, 0x830a6fac
je 0x140130918
jne 0x140130918
mov r14d, 0x21e93dba
call rcx
jo 0x1401318a4
ret
jmp 0x140130814
or bh, bh
dec dword [rcx - 9]
fiadd dword [rcx + 0x407047fe]
xor al, 0xf
mov dword [rdx], esi
idiv edi
invalid
cmp eax, 0x74616470
jne 0x140130a89
cmp byte [rbx + 5], 0x61
je 0x140131503
test byte [rcx - 0x16fffff5], ah
and al, byte [rcx]
add byte [rax], al
jmp 0x140130a89
rcr r11d, 0x16
ja 0x140130e29
jmp rcx
add byte [rbp + 0xf78ad], cl
add bh, bh
loopne 0x1401309c5
lea ebp, [rbp + 0xf78]
jmp rax
invalid
call rcx
jne 0x1401309e6
je 0x1401309e6
test r10, rcx
push rcx
lea edi, [rdi - 0x161b]
jmp rcx
jmp 0x140130d32
cmp ebx, 0x3e3742e2
lea r11d, [rbx - 0x38d6]
jno 0x14012f7d9
popfq
ror ecx, 0xbb
jmp 0x1401309ad
mov eax, dword [rbx + 8]
lea r8, [rsp + 0x30]
cmp eax, dword [rbx + 0x10]
lea rdx, [rsp + 0x48]
mov esi, dword [rbx + 0xc]
jmp 0x140130e62
sub r15d, 0xd035f4cc
jb 0x14012f7a9
jno 0x14012f5d0
nop
inc r11
lea esi, [rbp + 0x126b]
jmp 0x140130c23
xor r14d, 0xe3b70a89
add r13d, 0x97f24055
rcl ecx, 0x59
pop r9
jge 0x14012f35d
rol r8d, 0x75
jmp 0x140130967
lea r9, [rbp + 0x120]
mov dword [rsp + 0x20], 2
lea r8, [rbp + 0x1a0]
mov edx, r14d
jmp 0x140130d44
jmp 0x14013103e
cmp r10, rbp
jge 0x1401309ac
add r13d, 0x8d5681cb
ret
invalid
test edx, 0x9679caeb
jle 0x140130cf5
lea esi, [rbx - 0x1510]
jmp 0x140130e23
call rcx
sub ebx, 0xd958d70d
add ebp, 0x2cb49a8f
jmp rax
jle 0x14012f451
je 0x140130bed
jne 0x140130bed
xor edx, 0xf2ef976c
jne 0x1401310d1
ret
jmp 0x140130b96
add esi, 0xc8c83a2
nop
push r11
jmp 0x140130c91
call rax
test r14d, 0x12f52927
syscall
ja 0x140130b7c
push rsi
call rax
jne 0x140130c57
je 0x140130c57
div rsi
xor r8d, 0x67b4de28
test r15d, 0x1f171550
jl 0x140130f9c
bswap r12
movabs r11, 0x1c60d80c6f7f72eb
call int.14013123e
jmp 0x140130ccb
add rsi, rax
mov dword [rbp + 0x20], r13d
lea rax, [rbp + 0x20]
jmp 0x140130f8b
cmp ebp, 0x436f445c
jne 0x14012fe76
jmp rax
cmp r14d, 0x32c8c4b8
mov edx, 0x65c8eb9a
lea edx, [rcx + 0x9a1]
jne 0x140130cba
je 0x140130cba
lea ecx, [rbx - 0xbc2b]
sub r12d, 0x892257e2
jmp rax
jmp 0x140130a0a
jno 0x140130647
div rbp
jno 0x140130ea8
syscall
jbe 0x140131167
jmp 0x14012fa6f
dec dword [rax + 0xf]
iretd
rcl r13d, 0xd0
call rax
call rcx
rol r8d, 0x11
nop
jmp 0x140130ee8
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.140132730
test dil, dil
jne 0x140131503
je 0x140130d70
jne 0x140130d70
pause
cpuid
dec r12
sub edi, 0xe946f513
cpuid
movabs rsi, 0x74d736000001abe9
popf
call rcx
or edx, 0x16f2efa7
neg r8
rol esi, 0xaf
call 0x140130de3
call rcx
lea r8d, [rcx - 0x7cc3]
ret
jmp 0x140130f20
cmp ebx, ebx
lea esi, [rbp + 0x2b5b]
and esi, 0xbeb6d789
jne 0x140130936
jmp 0x140130c74
rcr r12d, 3
jb 0x1401312de
mov cl, 4
add byte [rax], al
pop rsi
jmp 0x140130f6b
mov r9d, 0x40
cmovae eax, dword [rbx + 0x10]
mov rcx, 0xffffffffffffffff
mov r14d, eax
lea rax, [0x140000000]
jmp 0x140130c64
neg rbp
popfq
jae 0x140130bad
jmp 0x140130c01
dec edi
inc r8
jo 0x1401310b6
jmp 0x140130e82
or eax, 0x20000020
mov dword [rbp + 0x20], r9d
mov dword [rbx + 0x24], eax
jmp 0x140130b1d
sub r12d, 0xab361de9
jmp rcx
mov eax, dword [rbx + 0x24]
test eax, eax
js 0x14013103a
test al, 0x40
je 0x14013103a
and eax, 0xffffffbf
mov r9d, 0x20
je 0x140130f62
jne 0x140130f62
lea edi, [rcx + 0xc04e]
ja 0x140131e78
int3
jmp 0x140130eb8
lea r11d, [rdi - 0x8ffe]
ja 0x140130225
and ebp, 0x67e674d6
lea ecx, [rdx - 0xefd4]
pushf
jmp 0x140130ada
xchg rcx, rsi
mov qword [rsp + 0x48], rcx
xchg rcx, rsi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x30], esi
call r12
jmp 0x140130fc4
cmp eax, 0xc000008c
jne 0x140130aff
nop
lea r11d, [rdx + 0x8b32]
je 0x140130ffb
jne 0x140130ffb
call rax
test rdx, rbx
ror r14d, 0xf7
jb 0x1401306f6
lea r13d, [rdx - 0x1c5a]
mul r9
mul r14
syscall
movabs rcx, 0x19b1f2fffffb22e9
div r13
xor edi, 0xfbf162de
add edi, 0x71895a7e
ret
jmp 0x140130b22
invalid
mov r9d, dword [rbp + 0x20]
lea rax, [rbp + 0x20]
mov rcx, 0xffffffffffffffff
lea r8, [rsp + 0x30]
xchg rcx, rax
mov qword [rsp + 0x20], rcx
jmp 0x1401315d9
cmp eax, 0xc0000096
jne 0x140131503
nop
jmp rax
shl dword [0x140172fa5], 1
add byte [rcx + 0x41], bl
test eax, 0x2be06623
or r10d, 0x84d037f
jp 0x1401312b9
add byte [rbp + 0x3e], dh
jne 0x140131112
je 0x140131112
rol r10d, 0x2e
lea ebx, [rbx - 0x2739]
lea ebx, [rdx + 0xaeb1]
add r12d, 0xfbffead4
mov r10d, 0x12954934
call rcx
pause
call rcx
rcr r8d, 0x4c
lea r15d, [rbx + 0x15c4]
or r10d, 0xfe5166aa
ror edi, 0x58
pushf
movabs rbx, 0x5a3bbf000002bce9
jo 0x140131d28
jmp 0x1401313d3
call rcx
ror r10d, 0x49
jge 0x14013100d
inc rdi
pushfq
call fcn.140131f69
jge 0x140131216
and r11d, 0xa01d6312
cmp r12, rbp
ror ebp, 0xf0
jmp 0x14013164e
cmp r9, rcx
bswap r15
mov ecx, 0x77d9f5de
add edi, 0x8749d16d
jae 0x140131295
jne 0x1401311db
je 0x1401311db
or r14d, 0x9e57c7d3
xor r11d, 0x9c410e30
jmp rcx
jmp 0x1401314f7
add byte [0x1375c18ee], al
test byte [rbp + rcx*4 - 0x5e], 0x68
loope 0x140131223
add bh, bh
rol dword [rcx + 0x59], 1
call 0x140130f34
rcl edx, 0x96
jbe 0x14013095d
idiv edi
inc dword [rcx + 0x5c]
pop r12
lea edx, [rcx - 0xd74e]
ja 0x140131233
and ebx, 0xc2272952
lea r14d, [rbp - 0x54ea]
div r13
cpuid
pop rcx
call fcn.140130a6d
neg r10
rcl r8d, 0xec
xor edi, 0x23810cd7
lea r9d, [rcx + 0x2f26]
jne 0x1401312ef
or al, 0x81
and eax, dword [rbp + rcx*4 - 0x77]
invalid
je 0x1401312ef
call rcx
rol r12d, 0xa7
test r9d, 0xb71c1197
mov r10d, 0x49e87967
cmp r12, rbx
popf
popfq
jg 0x140131b45
popfq
lea r9d, [rbp - 0xa65b]
movabs r12, 0x3222fb000003bde9
jae 0x140131c00
jmp 0x1401316b1
dec r11
call 0x1401312bb
lea rax, [0x1401329a0]
mov ecx, dword [rax]
test ecx, ecx
je 0x1401322c8
cmp dword [rax + 4], r13d
je 0x1401322c8
mov rax, qword gs:[0x60]
jmp 0x1401314a6
add edi, 0xc558e32f
sub rbx, 0x36801cd5
add rbx, 0x36801cfd
lea rax, [rax + rax*4]
lea rax, [rax + 0x21]
lea rax, [r15 + rax*8]
cmp rbx, rax
jb 0x1401306b6
jmp 0x1401317ce
lea r14, [rdi + rcx]
mov rax, qword [rax + 0x18]
and r15d, 0x9bd439dc
test r8, rbp
call rcx
movzx eax, word [r15 + 6]
nop
jmp 0x1401313f2
xchg rcx, rax
lea rdx, [rsp + 0x48]
call r12
jmp 0x14013107f
sub ebp, 0xffffffff
push rdi
ret 0x4652
lea r13d, [rdx - 0xfe40]
syscall
rcl ebx, 0xe
xor ecx, 0x84017016
xor r15d, 0x7bc077d0
pause
int1
invalid
not eax
ja 0x140131626
jnp 0x14013165b
nop
call fcn.14012fd95
jmp 0x1401311a1
cmp r10, rdx
cmp rcx, rbp
lea ebp, [rcx - 0xfa1a]
jmp rcx
lea rdi, [0x140000000]
mov r9d, dword [rbp + 0xcc]
lea rax, [rbp + 0xcc]
lea r8, [rbp + 0xd8]
jmp 0x1401317ef
xchg rbx, rax
mov qword [rsp + 0x20], rbx
xchg rbx, rax
lea rdx, [rbp + 0xe0]
mov rcx, 0xffffffffffffffff
call r12
jne 0x140131816
je 0x140131816
jge 0x1401320ab
pushfq
movabs r10, 0x6ce20cfffffb6ae9
jmp rcx
jmp 0x140131385
and ecx, dword [rbp + 0x8788bd]
add byte [rcx - 0x3f], al
invalid
xlatb