Function at 0x140070cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Get system information on windows
Make suspicious ntquerysysteminformation call
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14067e680]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r15, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rsi + 3]
lea rcx, str..EtdSupport_18.0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14067f428], rax
cmp rax, 0xffffffffffffffff
je 0x1400716d7
call fcn.140070060
mov ecx, esi
test al, al
je 0x1400715e9
mov r14, qword [r15]
mov dword [rbp - 0x80], 0xa39e89bf
mov dword [rbp - 0x7c], 0xc6c79e80
mov dword [rbp - 0x78], 0x858c87dd
mov word [rbp - 0x74], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x15]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0xc
jb 0x140070d80
mov byte [rbp - 0x73], 0
mov eax, 0x5a4d
cmp word [r14], ax
je 0x140070da4
mov r13, rsi
jmp 0x140070db7
movsxd r13, dword [r14 + 0x3c]
add r13, r14
cmp dword [r13], 0x4550
cmovne r13, rsi
cmp dword [r13], 0x4550
je 0x140070dfe
test r14, r14
je 0x140071575
mov rdx, qword [r15 + 0x10]
sub rdx, r14
cmp rdx, 0x1000
jb 0x140070df6
add rdx, 0x27
mov rcx, qword [r14 - 8]
sub r14, rcx
lea rax, [r14 - 8]
cmp rax, 0x1f
ja 0x1400716cb
mov r14, rcx
mov rcx, r14
jmp 0x140070e95
mov ebx, dword [r13 + 0x50]
mov dword [rsp + 0x40], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140070e23
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.14005c8f0
mov r9d, ebx
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x20]
call fcn.14006eaa0
nop
cmp dword [rbp + 0x28], 0
jne 0x140070eac
lea rcx, [rbp - 0x20]
call fcn.14006f420
nop
mov rcx, qword [r15]
test rcx, rcx
je 0x140071575
mov rdx, qword [r15 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140070e95
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400716cb
mov rcx, r8
call fcn.14025f000
mov qword [r15], rsi
mov qword [r15 + 8], rsi
mov qword [r15 + 0x10], rsi
xor al, al
jmp 0x14007169e
lea r12, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r12, qword [rbp]
mov rdi, rsi
mov dword [rsp + 0x78], esi
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140070f29
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x78]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rsp + 0x78]
mov r8d, dword [rsp + 0x78]
mov rdx, rax
mov ecx, ntohs
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140070ee0
test eax, eax
js 0x140070fea
mov ebx, esi
cmp dword [rdi], esi
jbe 0x140070fea
nop dword [rax + rax]
mov eax, ebx
imul rcx, rax, 0x128
lea rsi, [rcx + rdi]
movzx edx, word [rsi + 0x2e]
add rdx, 0x30
add rdx, rcx
add rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], al
jne 0x140070f73
lea rcx, [rbp - 0x48]
call fcn.14005c8f0
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rcx, qword [rbp - 0x48]
mov rdx, r12
call fcn.14026e708
test eax, eax
je 0x140071343
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140070fde
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070fd9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071732
call fcn.14025f000
inc ebx
cmp ebx, dword [rdi]
jb 0x140070f40
xor esi, esi
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbx, rsi
mov edi, 4
mov rax, qword gs:[0x58]
add rdi, qword [rax]
lea r12, [0x140688640]
mov eax, dword [rdi]
cmp dword [0x140688624], eax
jle 0x140071087
lea rcx, [0x140688624]
call fcn.14025f360
cmp dword [0x140688624], 0xffffffff
jne 0x140071087
call fcn.14025e564
mov dword [0x1406899c4], 0xffffffff
mov dword [0x140688644], eax
mov r8d, 1
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [r12 + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x140071050
mov dword [0x140688640], 0x270
lea rcx, [0x140688624]
call fcn.14025f2f4
mov rcx, r12
call fcn.1400beac0
mov ecx, eax
imul rax, rcx, 0x1001
cmp eax, 0xff
ja 0x1400710b8
nop
mov rcx, r12
call fcn.1400beac0
mov ecx, eax
imul rax, rcx, 0x1001
cmp eax, 0x100
jb 0x1400710a0
shr rax, 0x20
mov ecx, dword [rbp + 0x20]
add rax, rbx
add rcx, rax
mov qword [rbp - 0x80], rcx
mov eax, dword [rdi]
cmp dword [0x1406899d0], eax
jle 0x140071238
lea rcx, [0x1406899d0]
call fcn.14025f360
cmp dword [0x1406899d0], 0xffffffff
jne 0x140071238
mov rdi, rsi
mov dword [rsp + 0x7c], esi
lea r9, [rsp + 0x7c]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14007115a
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x7c]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rsp + 0x7c]
mov r8d, dword [rsp + 0x7c]
mov rdx, rax
mov ecx, ntohs
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140071111
test eax, eax
js 0x14007121a
mov ebx, esi
cmp dword [rdi], 0
jbe 0x14007121a
nop dword [rax]
mov eax, ebx
imul rcx, rax, 0x128
movzx edx, word [rcx + rdi + 0x2e]
add rdx, 0x30
add rdx, rcx
add rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400711a0
lea rcx, [rbp - 0x68]
call fcn.14005c8f0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
lea rdx, str.ntoskrnl.exe
call fcn.14026e708
test eax, eax
je 0x1400713aa
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140071210
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007120b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071738
call fcn.14025f000
inc ebx
cmp ebx, dword [rdi]
jb 0x140071170
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [0x1406899d0]
call fcn.14025f2f4
mov r12d, dword [rsp + 0x40]
mov r9d, 4
mov r8d, 0x3000
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8d, dword [r13 + 0x54]
mov rdx, r14
mov rcx, rax
call fcn.1402a0a80
movzx ebx, word [r13 + 0x14]
add rbx, 0x28
xor edx, edx
mov edi, edx
cmp dx, word [r13 + 6]
jae 0x1400712a5
add rbx, r13
nop dword [rax]
mov ecx, dword [rbx - 4]
add rcx, rsi
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r14
call fcn.1402a0a80
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x140071280
xor edx, edx
mov r14, qword [rbp - 0x80]
mov rdi, r14
sub rdi, qword [r13 + 0x30]
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140071439
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x140071439
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov rcx, rdx
mov qword [rbp - 0x70], rdx
mov ebx, dword [rax + rsi + 0xb0]
add rbx, rsi
mov eax, dword [rbx]
test eax, eax
je 0x140071429
mov rdx, qword [rbp - 0x78]
nop word [rax + rax]
add rax, rsi
mov qword [rbp - 0x68], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x60], rax
mov eax, dword [rbx + 4]
sub rax, 8
shr rax, 1
mov dword [rbp - 0x58], eax
cmp rdx, rcx
je 0x1400713ff
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x58]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x78], rdx
jmp 0x140071414
mov rbx, qword [rsi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140071393
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007138e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071732
call fcn.14025f000
xor esi, esi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x48], sil
jmp 0x140070ffe
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14007122c
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400713f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071738
call fcn.14025f000
jmp 0x14007122c
lea r8, [rbp - 0x68]
lea rcx, [rbp - 0x80]
call fcn.14005d360
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x78]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x140071300
movdqu xmm1, xmmword [rbp - 0x80]
movsd xmm0, qword [rbp - 0x70]
movsd qword [rbp - 0x58], xmm0
mov rbx, qword [rbp - 0x58]
jmp 0x14007143f
xorps xmm1, xmm1
mov rbx, rdx
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x1400714b5
lea r8, [r10 + 0x10]
xor r12d, r12d
nop word [rax + rax]
mov edx, r12d
cmp dword [r8], 0
jbe 0x1400714a3
mov r12d, 0xfff
nop
mov ecx, edx
mov rax, qword [r8 - 8]
movzx r9d, word [rax + rcx*2]
movzx eax, r9w
shr ax, 0xc
and r9w, r12w
cmp ax, 0xa
jne 0x140071499
movzx ecx, r9w
mov rax, qword [r8 - 0x10]
add qword [rax + rcx], rdi
inc edx
cmp edx, dword [r8]
jb 0x140071470
xor r12d, r12d
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r11
jne 0x140071460
mov r12d, dword [rsp + 0x40]
test r10, r10
je 0x14007150d
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x140071505
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007173e
mov rcx, r10
call fcn.14025f000
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.14005bee0
mov rcx, rax
call fcn.14005bc50
test al, al
jne 0x14007157c
lea rcx, [rbp - 0x20]
call fcn.14006f420
nop
mov rcx, qword [r15]
test rcx, rcx
je 0x140071575
mov rdx, qword [r15 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140071563
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400716cb
mov rcx, r8
call fcn.14025f000
xor eax, eax
mov qword [r15], rax
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
xor al, al
jmp 0x14007169e
mov r8d, dword [r13 + 0x54]
xor edx, edx
mov rcx, rsi
call fcn.1402a1120
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r12
xor esi, esi
mov qword [rbp - 0x80], rsi
lea r9, [rbp - 0x80]
lea rdx, [rbp - 0x68]
call fcn.140070b70
mov ecx, dword [r13 + 0x28]
add rcx, r14
mov eax, 0xc0d3b1cd
mov qword [rbp - 0x28], rax
mov qword [rsp + 0x68], rsi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], rsi
lea r9, [rbp - 0x80]
lea r8d, [rsi + 2]
lea rdx, [rsp + 0x68]
call fcn.1400706f0
nop
lea rcx, [rbp - 0x20]
call fcn.14006f420
jmp 0x14007165e
mov dword [rsp + 0x40], 0xa1bfbeae
mov word [rsp + 0x44], 0xbd
mov byte [rsp + 0x46], 1
nop dword [rax]
lea eax, [rcx - 0x15]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 5
jb 0x140071600
mov byte [rsp + 0x46], 0
mov dword [rsp + 0x68], 0xa1bfbeae
mov dword [rsp + 0x6c], 0xdcc2d0bd
mov word [rsp + 0x70], 0x100
mov rcx, rsi
nop
lea eax, [rcx - 0x15]
xor byte [rsp + rcx + 0x68], al
inc rcx
cmp rcx, 8
jb 0x140071630
mov byte [rsp + 0x71], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rcx, qword [r15]
test rcx, rcx
je 0x14007169e
mov rdx, qword [r15 + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14007168e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400716d1
mov rcx, r8
call fcn.14025f000
mov qword [r15], rsi
mov qword [r15 + 8], rsi
mov qword [r15 + 0x10], rsi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14025efe0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14026ebe4
int3
call fcn.14026ebe4
nop
mov dword [rsp + 0x40], 0xa1bfbeae
mov word [rsp + 0x44], 0xbd
mov byte [rsp + 0x46], 1
lea rcx, [rsp + 0x40]
call fcn.1400633c0
mov r8, rax
mov dword [rsp + 0x68], 0xa1bfbeae
mov dword [rsp + 0x6c], 0xdcc3d0bd
mov word [rsp + 0x70], 0x100
lea rcx, [rsp + 0x68]
call fcn.1400633f0
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14027e0e8
nop
call fcn.14026ebe4
nop
call fcn.14026ebe4
nop
call fcn.14026ebe4
int3