Function at 0x18000ee70
Capabilities:
Encode data using base64
Get system information on windows
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x108
cmp byte [0x18065bdb8], 0
jne 0x18000fb05
xor eax, eax
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
mov ebp, eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xd0], 0
mov byte [rsp + 0x40], 2
mov byte [rsp + 0x42], 1
mov dword [rsp + 0x58], 1
mov qword [rsp + 0xc0], reloc.WS2_32.dll_recv
cmp r8d, 0x746e6542
jg 0x18000ef36
cmp r8d, 0x414956
je 0x18000ef5f
cmp r8d, 0x68747541
jne 0x18000ef8b
cmp edx, 0x69746e65
jne 0x18000ef8b
cmp ecx, 0x444d4163
jne 0x18000ef8b
xor eax, eax
jmp 0x18000ef90
cmp r8d, 0x746e6543
je 0x18000ef76
cmp r8d, 0x756e6547
jne 0x18000ef8b
cmp edx, 0x49656e69
jne 0x18000ef8b
mov eax, 1
cmp ecx, 0x6c65746e
je 0x18000ef90
jmp 0x18000ef8b
cmp edx, 0x414956
jne 0x18000ef8b
mov eax, 3
cmp ecx, 0x414956
je 0x18000ef90
jmp 0x18000ef8b
cmp edx, 0x48727561
jne 0x18000ef8b
mov eax, 2
cmp ecx, 0x736c7561
je 0x18000ef90
mov eax, 4
lea rax, [rax + rax*4]
lea rcx, [0x1804677d0]
mov rax, qword [rcx + rax*4]
mov qword [rsp + 0x64], rax
test ebp, ebp
je 0x18000f7e0
mov eax, 1
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
mov r11d, ecx
mov r10d, edx
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov edx, eax
shr edx, 8
and edx, 0xf
cmp edx, 6
je 0x18000efdb
cmp edx, 0xf
jne 0x18000efef
mov r8d, eax
shr r8d, 0xc
mov esi, r8d
and esi, 0xf0
or ecx, esi
jmp 0x18000eff6
mov r8d, eax
shr r8d, 0xc
mov esi, eax
shr esi, 0x14
movzx esi, sil
add esi, 0xf
cmp edx, 0xf
cmovne esi, edx
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x44], esi
movzx ecx, r9b
mov dword [rsp + 0x4c], ecx
and r8d, 3
mov dword [rsp + 0x54], r8d
mov ecx, r9d
shr ecx, 0x10
movzx ecx, cl
mov dword [rsp + 0x58], ecx
and eax, 0xf
mov dword [rsp + 0x50], eax
shr r9d, 5
and r9d, 0x7f8
mov dword [rsp + 0x5c], r9d
mov eax, r11d
and eax, 1
shl rax, 0x2f
mov ecx, r11d
and ecx, 2
shl ecx, 0x16
or rcx, rax
mov eax, r11d
and eax, 8
shl eax, 9
or rax, rcx
mov ecx, r11d
shr ecx, 5
and ecx, 1
shl rcx, 0x3a
or rcx, rax
mov edi, r11d
shr edi, 6
mov r9d, edi
and r9d, 1
shl r9, 0x2b
or r9, rcx
mov ecx, r11d
shr ecx, 9
and ecx, 1
shl rcx, 0x33
mov eax, r11d
shr eax, 0xd
and eax, 1
shl rax, 0x30
mov r8d, r11d
shr r8d, 0x13
mov edx, r8d
and edx, 1
shl rdx, 0x30
mov esi, r11d
shr esi, 0x14
and esi, 1
shl rsi, 0x31
or rsi, rdx
mov edx, r11d
shr edx, 8
and edx, 0x4000
or rdx, rsi
mov esi, r11d
and esi, 0x800000
lea rsi, [rdx + rsi*4]
and r8d, 0x40
mov edx, r11d
shr edx, 0x1a
and edx, 1
mov qword [rsp + 0xc8], rdx
and edi, 0x200000
mov ebx, r11d
shr ebx, 0x1e
and ebx, 1
shl rbx, 0x21
or rbx, rdi
mov edi, r10d
and edi, 1
shl rdi, 0x38
or rdi, r8
mov r14d, r10d
shr r14d, 4
and r14d, 1
shl r14, 0x23
mov r8d, r10d
and r8d, 0x20
shl r8d, 0xd
or r8, r14
or r8, rbx
or r8, r9
mov r9d, r10d
shr r9d, 8
and r9d, 1
shl r9, 0x31
mov ebx, r10d
shr ebx, 0xf
and ebx, 1
shl rbx, 0x2e
mov r14d, r10d
shr r14d, 0x13
and r14d, 1
shl r14, 0x2a
mov r12d, r10d
shr r12d, 0xd
and r12d, 0x400
or r12, rcx
mov ecx, r10d
shr ecx, 0x18
and ecx, 1
shl rcx, 0x3d
mov r13d, r10d
shr r13d, 0x19
and r13d, 1
movabs r15, 0x600000000800
imul r15, r13
or r15, r12
or r15, rsi
or r15, r8
mov rsi, r15
or rsi, 0x10
mov qword [rsp + 0xc0], rsi
shr r10d, 0x1b
and r10d, 2
or r10, rdi
or r10, rbx
or r10, r9
or r10, r14
or r10, rax
add r10, rcx
mov qword [rsp + 0xb8], r10
xor eax, eax
test edx, edx
je 0x18000f231
and r15d, 0x200000
je 0x18000f231
xor ecx, ecx
xgetbv
test r11d, 0x10000000
je 0x18000f231
mov ecx, eax
and ecx, 6
cmp ecx, 6
jne 0x18000f231
mov ecx, r11d
shr ecx, 0xc
and ecx, 1
shl rcx, 0x36
shr r11d, 0x1d
and r11d, 1
shl r11, 0x35
or r11, rcx
or r11, r10
or r11, 0x1000
mov qword [rsp + 0xb8], r11
mov r10, r11
cmp ebp, 7
jb 0x18000f7e0
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov eax, 7
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
mov dword [rsp + 0x2c], eax
mov eax, edx
mov edx, r8d
and edx, 1
shl rdx, 0x39
mov r9d, r8d
shr r9d, 3
mov dword [rsp + 0x3c], r9d
mov r11d, r9d
and r11d, 1
shl r11, 0x24
or r11, rdx
mov ebx, r8d
shr ebx, 2
and ebx, 4
mov edx, r8d
shr edx, 7
and edx, 1
shl rdx, 0x2a
or rdx, rbx
mov r14d, r8d
shr r14d, 8
and r14d, 1
shl r14, 0x25
mov ebx, r8d
shr ebx, 9
mov r15d, ebx
and r15d, 1
shl r15, 0x34
or r15, r14
or r15, r11
mov r11d, r8d
shr r11d, 0xb
and r11d, 1
shl r11, 0x25
mov r14d, r8d
shr r14d, 0x12
and r14d, 1
shl r14, 0x22
or r14, r11
or r14, rdx
or r14, rsi
mov edx, r8d
shr edx, 0xe
and edx, 0x20
or rdx, r15
mov r11d, r8d
shr r11d, 0x14
and r11d, 1
shl r11, 0x29
mov r15d, r8d
shr r15d, 0x17
and r15d, 1
shl r15, 0x2b
mov esi, r8d
shr esi, 0x18
and esi, 1
shl rsi, 0x2c
or rsi, r15
or rsi, rdx
mov edx, r8d
shr edx, 0x1d
and edx, 1
shl rdx, 0x27
mov r15d, ecx
and r15d, 1
shl r15d, 0x1c
or r15, rdx
mov ebp, ecx
shl ebp, 0x12
mov r12d, ebp
and r12d, 0x400000
or r12, r15
mov edx, ecx
shr edx, 5
and edx, 1
shl rdx, 0x3c
or rdx, r12
or rdx, r11
mov r15d, ecx
shr r15d, 7
mov r11d, r15d
and r11d, 1
shl r11, 0x27
and r15d, 2
mov r12d, ecx
shr r12d, 9
and r12d, 1
shl r12, 0x39
or r12, r15
mov r15d, ecx
shr r15d, 0xa
and r15d, 1
shl r15, 0x3b
or r15, r12
mov r12d, ecx
shl r12d, 9
and r12d, 0x80000000
or r12, r15
or r12, rdx
or r12, r14
mov r13d, ecx
shr r13d, 0x19
and r13d, 1
shl r13, 0x29
or r13, r11
mov edx, ecx
shr edx, 0xb
and edx, 0x10000
mov r11d, ecx
shr r11d, 0xd
and r11d, 0x8000
or r11d, edx
mov r14d, ecx
shr r14d, 0x1d
and r14d, 1
shl r14, 0x33
mov edx, eax
shr edx, 4
and edx, 1
shl rdx, 0x3a
or rdx, r14
mov r14d, eax
shr r14d, 5
and r14d, 1
shl r14, 0x38
mov r15d, eax
shr r15d, 0xe
mov edi, r15d
and edi, 1
shl rdi, 0x26
or rdi, r14
mov r9d, eax
shr r9d, 0x10
and r9d, 1
shl r9, 0x37
or r9, rdi
mov r14d, eax
shl r14d, 6
and r14d, 0x1000000
or r14, r9
or r14, r11
mov r9d, eax
shr r9d, 0x14
and r9d, 1
shl r9, 0x26
or r9, r13
or r9, rdx
or r14, r12
mov qword [rsp + 0xc0], r14
or rsi, r10
or rsi, r9
mov qword [rsp + 0xb8], rsi
movabs rdx, 0x2000000004
test r12, rdx
je 0x18000f496
movabs rdx, 0x40000000000000
or r14, rdx
mov qword [rsp + 0xc0], r14
mov r12, qword [rsp + 0x30]
mov edx, r12d
and edx, 0xe6
test r8b, 0x20
je 0x18000f4c2
and r10d, 0x1000
je 0x18000f4c2
or rsi, 0x2000
mov qword [rsp + 0xb8], rsi
mov r10d, r12d
and r10d, 0x60000
cmp edx, 0xe6
jne 0x18000f5c3
mov edx, r8d
and edx, 0x10000
je 0x18000f5c3
mov r12d, r8d
shr r12d, 1
and r12d, 0x2000000
mov r13d, r8d
shr r13d, 6
and r13d, 0x200000
and ebx, 0x80000
mov r11d, r8d
shr r11d, 0xc
and r11d, 0x40000
mov dword [rsp + 0x38], r10d
mov r10d, dword [rsp + 0x3c]
and r10d, 0x10000000
mov edx, ecx
and edx, 2
shl edx, 0x19
mov r9d, ecx
and r9d, 0x40
shl r9d, 0x15
or r9d, edx
and ebp, 0x20000000
or ebp, r9d
mov edx, ecx
shl edx, 5
and edx, 0x20000
or edx, ebp
shl ecx, 0x11
and ecx, 0x80000000
or ecx, edx
mov edx, eax
and edx, 4
shl edx, 0xd
or edx, ecx
mov ecx, eax
and ecx, 8
shl ecx, 0xb
mov r9d, eax
shl r9d, 0x16
and r9d, 0x40000000
or r9d, ecx
mov ecx, eax
and ecx, 0x800000
mov edi, r8d
and edi, 0x220000
lea ecx, [rcx + rdi*8]
or ecx, r12d
mov r12, qword [rsp + 0x30]
or ecx, r13d
or ecx, ebx
or ecx, r11d
or ecx, r10d
mov r10d, dword [rsp + 0x38]
or ecx, edx
or ecx, r9d
or ecx, 0x400000
or rsi, rcx
mov qword [rsp + 0xb8], rsi
mov ebp, dword [rsp + 0x28]
cmp r10d, 0x60000
jne 0x18000f5fa
and r15d, 0x100
mov ecx, eax
shr ecx, 0xd
and ecx, 0x800
or ecx, r15d
shr eax, 0xf
and eax, 0x400
or eax, ecx
or rsi, rax
mov qword [rsp + 0xb8], rsi
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000f73f
mov eax, 7
mov ecx, 1
xchg rbx, r9
cpuid
xchg rbx, r9
mov ebx, eax
and ebx, 8
shl ebx, 0x1b
mov ecx, eax
shr ecx, 7
and ecx, 1
shl rcx, 0x2f
mov r11d, eax
shr r11d, 0xa
shl r11, 0x3f
or r11, rcx
mov edi, eax
shr edi, 0xb
and edi, 1
shl rdi, 0x3c
mov ecx, eax
shr ecx, 0xc
mov r9d, ecx
and r9d, 1
shl r9, 0x3b
or r9, rdi
or r9, r11
mov r11d, eax
shr r11d, 0x13
mov edi, r11d
and edi, 1
shl rdi, 0x3e
and r11d, 8
or r11, rdi
mov edi, eax
shr edi, 0x14
and edi, 0x40
or rdi, r11
mov r11d, eax
shr r11d, 8
and r11d, 0x80000
or r11, rdi
mov edi, edx
shl edi, 0xc
and edi, 0x4000000
or rdi, r11
or rdi, rbx
or rdi, r14
mov qword [rsp + 0xc0], rdi
mov ebx, edx
shr ebx, 0x12
and ebx, 1
shl rbx, 0x28
or rbx, r9
or rbx, rsi
test esi, 0x2000
je 0x18000f709
mov r9d, eax
shr r9d, 4
and r9d, 1
shl r9, 0x22
mov r11d, eax
shr r11d, 0x17
and r11d, 1
shl r11, 0x20
or r11, r9
mov r9d, edx
shr r9d, 4
and r9d, 1
shl r9, 0x23
or r9, r11
shr edx, 5
and edx, 1
shl rdx, 0x21
or rdx, r9
or rbx, rdx
mov edx, ebx
shr edx, 6
shl eax, 0xb
and eax, edx
and eax, 0x10000
or rax, rbx
mov qword [rsp + 0xb8], rax
cmp r10d, 0x60000
jne 0x18000f742
and ecx, 0x200
or rax, rcx
mov qword [rsp + 0xb8], rax
jmp 0x18000f742
mov rdi, r14
cmp ebp, 0xd
jb 0x18000f7e0
mov eax, reloc.WS2_32.dll_listen
xor ecx, ecx
xchg rbx, r9
cpuid
xchg rbx, r9
test r8d, 0x4000
je 0x18000f77f
and r12d, eax
and r12d, 0x18
cmp r12d, 0x18
jne 0x18000f77f
or rdi, 0x20000
mov qword [rsp + 0xc0], rdi
mov eax, reloc.WS2_32.dll_listen
mov ecx, 1
xchg rbx, r8
cpuid
xchg rbx, r8
lea ecx, [rax*4]
and ecx, 4
mov edx, eax
and edx, 2
and eax, 8
or rdx, qword [rsp + 0xc8]
or rax, rcx
or rdx, rax
mov qword [rsp + 0xc8], rdx
cmp ebp, 0xe
jb 0x18000f7e0
mov eax, reloc.WS2_32.dll_ntohl
xor ecx, ecx
xchg rbx, r8
cpuid
xchg rbx, r8
and r8d, 0x10
shl r8d, 0x19
or rdi, r8
mov qword [rsp + 0xc0], rdi
mov edi, 0x80000000
lea r9, [rsp + 0x74]
lea r10, [0x180467834]
mov ebp, 0x80000007
mov r8d, 0x80000000
mov rbx, r9
jmp 0x18000f82c
shr eax, 4
and eax, 1
shl rax, 0x2c
or qword [rsp + 0xc0], rax
mov r8d, 0x8000001f
nop dword [rax]
inc r8d
cmp r8d, edi
ja 0x18000fa68
xor ecx, ecx
mov eax, r8d
xchg rbx, r14
cpuid
xchg rbx, r14
lea r11d, [r8 - 0x80000000]
cmp r11d, 0x1f
ja case.0x18000f84f.2147483643
mov esi, edx
movsxd r11, dword [r10 + r11*4]
add r11, r10
jmp r11
mov dword [rbx], eax
mov dword [rbx + 4], r14d
mov dword [rbx + 8], ecx
mov dword [rbx + 0xc], esi
add rbx, 0x10
cmp r8d, 0x80000004
cmove r8d, ebp
jmp case.0x18000f84f.2147483643
cmp eax, 0x8000001f
mov ecx, 0x8000001f
cmovae eax, ecx
mov r8d, 0x80000000
mov edi, eax
jmp case.0x18000f84f.2147483643
mov r8d, ecx
shl r8d, 5
and r8d, 0x20
mov r12d, ecx
shr r12d, 2
and r12d, 1
shl r12, 0x34
lea eax, [rcx*8]
mov r11d, eax
and r11d, 0x100
or r11d, r8d
mov r8d, ecx
shr r8d, 6
and r8d, 1
shl r8, 0x32
mov ebp, ecx
shl ebp, 0xd
and ebp, 0x100000
or ebp, r11d
mov r11d, ecx
shl r11d, 0x13
and r11d, 0x8000000
or r11d, ebp
mov r15d, ecx
shr r15d, 0xc
and r15d, 1
shl r15, 0x28
or r15, r8
mov ebp, ecx
shr ebp, 8
and ebp, 0x80
or ebp, r11d
mov r14d, ecx
shr r14d, 0x15
and r14d, 1
shl r14, 0x35
or r14, r15
mov r8d, ecx
shr r8d, 0x10
mov r15d, r8d
and r15d, 0x2000
or r15d, ebp
or r15, r12
mov r11d, esi
shr r11d, 0x12
and r11d, 4
mov r12, qword [rsp + 0xb8]
mov ebp, esi
shr ebp, 0x15
and ebp, 1
shl rbp, 0x3e
or rbp, r11
mov r11d, esi
shr r11d, 0xb
and r11d, 0x800
mov r13d, esi
shr r13d, 0x1b
and r13d, 1
shl r13, 0x24
or r13, r11
mov r11d, esi
shr r11d, 2
and r11d, 0x8000000
or r11, r13
mov edx, esi
shr edx, 0x1e
and edx, 1
mov r13, rdx
shl r13, 4
or r13, rbp
or r13, r12
mov qword [rsp + 0xb8], r13
shl rdx, 0xb
shr esi, 4
and esi, 0x8000000
or rsi, rdx
or rsi, r14
or rsi, r11
or rsi, r15
or rsi, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], rsi
test r12d, 0x1000
je 0x18000f9f2
shr ecx, 0xb
shl rcx, 0x3f
or rsi, rcx
mov qword [rsp + 0xc0], rsi
and r8d, 1
shl r8, 0x37
or r13, r8
mov qword [rsp + 0xb8], r13
mov ebp, 0x80000007
mov r8d, 0x80000001
cmp dword [rsp + 0x64], 0x444d41
jne case.0x18000f84f.2147483643
and eax, 0x80
or r13, rax
mov qword [rsp + 0xb8], r13
jmp case.0x18000f84f.2147483643
mov eax, r14d
and eax, 1
mov rcx, rax
shl rcx, 0x2d
or qword [rsp + 0xb8], rcx
shl rax, 0x20
mov ecx, r14d
and ecx, 0x100
shr r14d, 9
and r14d, 1
shl r14, 0x3d
lea rax, [rax + rcx*2]
or rax, r14
or qword [rsp + 0xc0], rax
mov r8d, 0x8000001e
jmp case.0x18000f84f.2147483643
xor ecx, ecx
mov rax, r9
jmp 0x18000fa86
mov r8d, ecx
nop word cs:[rax + rax]
inc r9
mov ecx, r8d
movzx edx, byte [r9]
mov byte [r9], 0
cmp edx, 0x20
je 0x18000fab0
test edx, edx
je 0x18000facb
mov byte [rax], dl
inc rax
mov r8d, edx
jmp 0x18000fa80
mov r8b, 0x40
cmp cl, 0x40
je 0x18000fa80
movzx r8d, byte [r9 + 1]
cmp r8d, 0x20
je 0x18000fa6f
cmp r8d, 0x40
je 0x18000fa6f
jmp 0x18000fa97
mov byte [rax], 0
lea rcx, [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0xf8]
mov dword [rsp + 0x60], eax
lea rcx, [0x18065bd20]
lea rdx, [rsp + 0x40]
mov r8d, 0x98
call sub.VCRUNTIME140.dll_memcpy
mov byte [0x18065bdb8], 1
lea rax, [0x18065bd20]
add rsp, 0x108
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret