Function at 0x1400062b0
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address
Get system information on windows

Disassembly:
push rsi
push r12
sub rsp, 0x68
mov rax, qword [0x140088040]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.140006070
mov r12d, eax
test eax, eax
jns 0x140006311
cmp eax, 0xc0000510
jne 0x1400069b1
mov rax, qword [0x14008ac28]
cmp word [rax], 2
jne 0x140006307
movzx edx, word [rax + 2]
test dx, dx
jns 0x140006307
mov ecx, 0x8001
cmp dx, cx
jne 0x140006307
xor esi, esi
mov eax, esi
jmp 0x1400069b1
mov eax, 0xc00000bb
jmp 0x1400069b1
mov rax, qword [0x14008ac28]
mov qword [rsp + 0x80], rbx
mov word [rax], 2
mov rax, qword [0x14008ac28]
mov word [rax + 2], 0x8001
mov rax, qword [0x14008ac28]
mov qword [rax + 0x70], rax
mov rcx, qword [0x14008ac28]
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r8, [rsp + 0x4c]
mov bl, 0xa
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
mov eax, dword [rsp + 0x4c]
test eax, 0xf0000000
je 0x140006377
movzx eax, ax
mov dword [rsp + 0x4c], eax
mov ecx, dword [rsp + 0x40]
sub ecx, 5
je 0x140006488
sub ecx, 1
je 0x14000640e
cmp ecx, 4
jne 0x1400064c2
cmp dword [rsp + 0x48], 0
jne 0x1400064c2
cmp eax, 0x2800
jb 0x1400064c2
cmp eax, 0x3839
jb 0x1400063f9
cmp eax, 0x3ad7
jb 0x1400063e4
cmp eax, 0x55f0
mov rax, qword [0x14008ac28]
jb 0x1400063d6
mov edx, 0x138
mov byte [rax + 0x14], 9
jmp 0x1400064d5
mov edx, 0x120
mov byte [rax + 0x14], 8
jmp 0x1400064d5
mov rax, qword [0x14008ac28]
mov edx, 0x120
mov byte [rax + 0x14], 7
jmp 0x1400064d5
mov rax, qword [0x14008ac28]
mov edx, pe_nt_image_headers64
mov byte [rax + 0x14], 6
jmp 0x1400064d5
mov ecx, dword [rsp + 0x48]
test ecx, ecx
je 0x14000646e
sub ecx, 1
je 0x140006459
sub ecx, 1
je 0x140006449
cmp ecx, 1
jne 0x1400064c2
cmp eax, 0x2580
jne 0x1400064c2
mov rax, qword [0x14008ac28]
mov edx, pe_nt_image_headers64
mov byte [rax + 0x14], 5
jmp 0x1400064d5
cmp eax, 0x23f0
jne 0x1400064c2
mov bl, 4
mov edx, 0x110
jmp 0x1400064c6
sub eax, 0x1db0
je 0x140006465
cmp eax, 1
jne 0x1400064c2
mov bl, 3
mov edx, 0xe0
jmp 0x1400064c6
sub eax, 0x1770
je 0x14000647f
sub eax, 1
je 0x14000647f
cmp eax, 1
jne 0x1400064c2
mov bl, 2
mov edx, 0xc8
jmp 0x1400064c6
mov ecx, dword [rsp + 0x48]
cmp ecx, 1
jne 0x1400064a4
cmp eax, 0xa28
je 0x1400064b0
mov rax, qword [0x14008ac28]
mov byte [rax + 0x14], bl
jmp 0x14000650a
cmp ecx, 2
jne 0x1400064c2
cmp eax, 0xece
jne 0x1400064c2
mov rax, qword [0x14008ac28]
mov edx, 0x98
mov byte [rax + 0x14], 1
jmp 0x1400064d5
mov edx, dword [rsp + 0x40]
mov rax, qword [0x14008ac28]
mov byte [rax + 0x14], bl
cmp bl, 0xa
je 0x14000650a
mov rax, qword [0x14008ac28]
mov ecx, dword [rsp + 0x40]
mov dword [rax + 8], ecx
mov rax, qword [0x14008ac28]
mov ecx, dword [rsp + 0x48]
mov dword [rax + 0xc], ecx
mov rax, qword [0x14008ac28]
mov ecx, dword [rsp + 0x4c]
mov dword [rax + 0x10], ecx
mov rax, qword [0x14008ac28]
mov word [rax + 0x16], dx
mov rax, qword [0x14008ac28]
cmp byte [rax + 0x14], 0xa
jne 0x140006531
mov rdx, rax
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov eax, 0xc00000bb
jmp 0x1400069a9
lea rcx, [rax + 0x88]
mov qword [rsp + 0x90], rdi
mov qword [rax + 0x48], rcx
xor esi, esi
mov rax, qword [0x14008ac28]
add rcx, 0x20
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x60], r15
mov qword [rax + 0x50], rcx
add rcx, 8
mov rax, qword [0x14008ac28]
mov qword [rax + 0x58], rcx
add rcx, 8
mov rax, qword [0x14008ac28]
mov qword [rax + 0x60], rcx
add rcx, 0x90
mov rax, qword [0x14008ac28]
mov qword [rax + 0x68], rcx
add rcx, 0xa8
mov rax, qword [0x14008ac28]
mov qword [rax + 0x78], rcx
add rcx, 0x28
mov rax, qword [0x14008ac28]
mov qword [rax + 0x80], rcx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r14, qword [rcx + 0x18]
add r14, 0x10
mov rdi, qword [r14]
cmp rdi, r14
je 0x14000661a
mov rbx, rdi
lea rcx, [0x140079420]
mov rdi, qword [rdi]
movzx r8d, word [rbx + 0x58]
mov rdx, qword [rbx + 0x60]
shr r8, 1
sub r8, 4
call fcn.14004f6b0
test eax, eax
je 0x14000661d
movzx r8d, word [rbx + 0x58]
lea rcx, [0x140079420]
mov rdx, qword [rbx + 0x60]
shr r8, 1
call fcn.14004f6b0
test eax, eax
je 0x14000661d
cmp rdi, r14
jne 0x1400065d3
mov rbx, rsi
mov rax, qword [0x14008ac28]
mov r15, rsi
mov qword [rsp + 0x88], rbp
mov rcx, qword [rax + 0x48]
mov qword [rcx + 8], rbx
mov rdx, qword [0x14008ac28]
mov rax, qword [rdx + 0x48]
mov r14, qword [rax + 8]
mov qword [rsp + 0x40], rsi
test r14, r14
je 0x140006728
cmp dword [rdx + 8], 6
jne 0x140006660
cmp dword [rdx + 0xc], 2
je 0x14000666d
mov eax, esi
seta al
test eax, eax
je 0x140006728
lea rcx, [r14 + 0xc8]
mov qword [rsp + 0x40], rcx
mov rax, qword [rcx + 0x10]
and rax, 0xfffffffffffffff8
je 0x1400066a2
nop dword [rax]
nop word [rax + rax]
mov rcx, rax
mov qword [rsp + 0x40], rax
mov rax, qword [rax + 0x10]
and rax, 0xfffffffffffffff8
jne 0x140006690
test byte [rcx + 0x10], 1
jne 0x140006728
mov rcx, qword [r14 + 0x30]
lea rax, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x28], 8
lea rdx, [0x140079414]
xor dil, dil
movdqu xmmword [rsp + 0x30], xmm0
call fcn.1400047f0
test eax, eax
js 0x140006721
movzx eax, dil
inc dil
test al, al
jne 0x140006721
mov rcx, qword [r14 + 0x30]
lea r8, [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
lea rdx, [0x140079414]
call fcn.1400047f0
test eax, eax
jns 0x1400066e4
test rbp, rbp
je 0x140006721
cmp qword [rbp], rsi
je 0x140006721
cmp qword [rbp + 8], rsi
je 0x140006721
mov r15, rbp
mov rdx, qword [0x14008ac28]
mov rax, qword [rdx + 0x48]
lea rdx, str.RtlRbInsertNodeEx
mov qword [rax], r15
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008ac28]
mov rdx, qword [rcx + 0x48]
mov qword [rdx + 0x10], rax
lea rdx, str.RtlRbRemoveNode
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14008ac28]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rcx + 0x48]
mov rbp, qword [rsp + 0x88]
mov qword [rdx + 0x18], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x30]
add rdx, 0x30
cmp rdx, rcx
je 0x1400067f7
nop word [rax + rax]
mov rax, qword [rcx + 0x50]
lea rbx, [rcx + 0x50]
cmp rax, rbx
je 0x1400067c2
cmp qword [rax], rbx
je 0x1400067cc
mov rcx, qword [rcx]
cmp rdx, rcx
jne 0x1400067b0
jmp 0x1400067f7
add rcx, 0x38
mov edx, 1
call fcn.140004260
mov rbx, qword [rbx]
neg eax
movsxd rcx, eax
shl rcx, 4
add rbx, rcx
mov rcx, rbx
call fcn.140005ff0
test eax, eax
cmovne rsi, rbx
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x58]
mov qword [rcx], rsi
call fcn.140005d90
mov rcx, qword [0x14008ac28]
mov rdx, qword [rcx + 0x50]
mov qword [rdx], rax
mov rax, qword [0x14008ac28]
mov dword [rax + 4], 0x65
mov rcx, qword [0x14008ac28]
mov rax, qword [rcx + 0x48]
cmp qword [rax], 0
je 0x140006842
or dword [rcx + 4], 2
mov rcx, qword [0x14008ac28]
mov rax, qword [rcx + 0x58]
cmp qword [rax], 0
je 0x140006857
or dword [rcx + 4], 8
mov rcx, qword [0x14008ac28]
mov rax, qword [rcx + 0x50]
cmp qword [rax], 0
je 0x14000686c
or dword [rcx + 4], 0x10
mov rcx, qword [0x14008ac28]
mov rax, qword [rcx + 0x78]
lea rcx, [fcn.140002740]
mov qword [rax], rcx
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.140003180]
mov qword [rcx + 8], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x78]
lea rax, [0x140003530]
mov qword [rcx + 0x10], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x78]
lea rax, [0x140008fd0]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x78]
lea rax, [fcn.140008f20]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
add rcx, 0x38
mov qword [rcx + 8], rcx
mov qword [rcx], rcx
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rcx + 0x48], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rcx + 0x50], rax
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x80]
mov dword [rcx + 0x58], 1
mov rax, qword [0x14008ac28]
mov rdx, qword [rax + 0x80]
mov rax, qword [rdx + 8]
lea rcx, [rdx + 0x38]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
mov qword [rax], rcx
mov qword [rdx + 8], rcx
call fcn.140009250
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
mov byte [rcx + 0x40], 0
mov rax, qword [0x14008ac28]
mov rcx, qword [rax + 0x68]
mov eax, r12d
mov byte [rcx + 0x41], 0
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140042de0
add rsp, 0x68
pop r12
pop rsi
ret