Function at 0x140106640
Capabilities:
Execute anti-debugging instructions
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x3d8]
sub rsp, 0x4d0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movups xmm0, xmmword [0x1402360b8]
xor eax, eax
cmp qword [0x1402c2968], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x190], rax
movups xmmword [rbp + 0x170], xmm1
mov dword [rbp + 0x198], eax
movups xmmword [rbp + 0x180], xmm1
mov word [rbp + 0x19c], ax
je 0x1401066d8
cmp qword [0x1402c2848], rax
je 0x1401066d8
lea rcx, [rsp + 0x30]
call fcn.140107440
test al, al
je 0x1401066d8
movsd xmm6, qword [rsp + 0x30]
jmp 0x1401066ea
mov rax, qword [0x1402c2930]
xorps xmm6, xmm6
mov ecx, dword [rax + 8]
cvtsi2sd xmm6, rcx
movzx eax, word [0x1402bcf88]
lea r8, [rbp + 0x1a0]
movss xmm1, dword [0x1402bf978]
lea rcx, [rbp + 0xc0]
movss xmm0, dword [0x1402bf97c]
xor r14d, r14d
movsd xmm7, qword [0x140288b30]
mov r9d, 0x200
cvtps2pd xmm1, xmm1
mov word [rbp + 0xc4], ax
mov eax, 0x25
mov dword [rbp + 0xc0], 0x4b
mov dword [rbp + 0xe0], r14d
mov word [rbp + 0xf0], ax
lea edx, [rax - 0x23]
mov qword [rsp + 0x20], r14
cvtps2pd xmm0, xmm0
divsd xmm6, xmm7
addsd xmm1, xmm0
mulsd xmm1, qword [0x140288b20]
movsd qword [rbp + 0xd0], xmm1
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x14010677f
lea r9, [rbp + 0x1a0]
jmp 0x14010679f
mov edx, 2
lea rcx, [rbp + 0xc0]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2908]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, word [0x1402bcf88]
lea rax, [0x14027c448]
mov qword [rbp + 0xf8], rax
lea r8, [rbp + 0x1a0]
mov eax, dword [0x1402c2850]
xorps xmm0, xmm0
mov word [rbp + 0xc4], cx
mov r9d, 0x200
mov word [rbp + 0x104], cx
mov edx, 4
lea rcx, [rbp + 0xc0]
movsd qword [rbp + 0xd0], xmm6
cvtsi2sd xmm0, rax
lea rax, str._GHz
mov dword [rbp + 0xc0], 0x4b
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 6
mov dword [rbp + 0x100], 0x4b
mov dword [rbp + 0x120], 1
divsd xmm0, xmm7
mov qword [rbp + 0x130], 8
mov qword [rbp + 0x138], rax
mov qword [rsp + 0x20], r14
movsd qword [rbp + 0x110], xmm0
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106875
lea r9, [rbp + 0x1a0]
jmp 0x140106895
mov edx, 4
lea rcx, [rbp + 0xc0]
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2970]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402bee20]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x1401068f5
lea r9, [rbp + 0x1a0]
jmp 0x140106926
mov eax, dword [0x1402bee20]
lea rcx, [rsp + 0x60]
mov edx, 1
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c29b8]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402bee28]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106982
lea r9, [rbp + 0x1a0]
jmp 0x1401069b4
mov eax, dword [0x1402bee28]
lea rcx, ds:[rbp - 0x80]
mov edx, 1
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x80], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2880]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402bee24]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106a15
lea r9, [rbp + 0x1a0]
jmp 0x140106a43
mov eax, dword [0x1402bee24]
lea rcx, [rbp - 0x60]
mov edx, 1
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2820]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, [rbp + 0x90]
lea r8d, [r9 + 0x30]
lea ecx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140106a95
mov rcx, qword [rbp + 0x98]
lea r8, [rbp + 0x160]
sub rcx, qword [rbp + 0x90]
mov edx, 2
mov qword [rsp + 0x20], r14
call fcn.140143f40
mov rcx, qword [0x1402c2830]
lea r9, [rbp + 0x160]
xor r8d, r8d
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c2910], 1
jbe 0x140106b33
mov eax, dword [0x1402c2924]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106b03
lea r9, [rbp + 0x1a0]
jmp 0x140106b3d
mov eax, dword [0x1402c2924]
lea rcx, ds:[rbp - 0x40]
mov edx, 1
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140106b3a
lea r9, [0x14026b3a0]
xor r8d, r8d
mov rcx, qword [0x1402c2938]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c2910], 1
jbe 0x140106bd3
mov eax, dword [0x1402c283c]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106ba2
lea r9, [rbp + 0x1a0]
jmp 0x140106bdd
mov eax, dword [0x1402c283c]
lea rcx, ds:[rbp - 0x20]
mov edx, 1
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140106bda
lea r9, [0x14026b3a0]
xor r8d, r8d
mov rcx, qword [0x1402c2868]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c2910], 1
jbe 0x140106c73
mov rax, qword [0x1402c2980]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106c43
lea r9, [rbp + 0x1a0]
jmp 0x140106c7d
mov rax, qword [0x1402c2980]
lea rcx, ds:[rbp]
mov edx, 1
mov qword [rbp + 0x10], rax
mov dword [rbp], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140106c7a
lea r9, [0x14026b3a0]
xor r8d, r8d
mov rcx, qword [0x1402c2958]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c2910], 1
jbe 0x140106d13
mov eax, dword [0x1402c2964]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106ce2
lea r9, [rbp + 0x1a0]
jmp 0x140106d1d
mov eax, dword [0x1402c2964]
lea rcx, ds:[rbp + 0x20]
mov edx, 1
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x20], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140106d1a
lea r9, [0x14026b3a0]
xor r8d, r8d
mov rcx, qword [0x1402c29c8]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c2890]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106d79
lea r9, [rbp + 0x1a0]
jmp 0x140106dac
mov eax, dword [0x1402c2890]
lea rcx, [rbp + 0x40]
mov edx, 1
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2870]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c289c]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106e08
lea r9, [rbp + 0x1a0]
jmp 0x140106e36
mov eax, dword [0x1402c289c]
lea rcx, [rbp + 0x60]
mov edx, 1
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x60], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2950]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c2898]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106e95
lea r9, [rbp + 0x1a0]
jmp 0x140106ec6
mov eax, dword [0x1402c2898]
lea rcx, [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c29c0]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[rbp + 0x88]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
lock or dword [rsp], r14d
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
lock or dword [rsp], r14d
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
lock or dword [rsp], r14d
rdtsc
shl rdx, 0x20
or rax, rdx
mov rsi, rax
lock or dword [rsp], r14d
lea rcx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
mov rbx, qword [rbp + 0x80]
sub rbx, qword [rbp + 0x88]
test rdi, rdi
jne 0x140106f5d
test rsi, rsi
jne 0x140106f5d
cmp dword [rsp + 0x30], r14d
jne 0x140106f5d
cmp dword [rsp + 0x3c], r14d
cmove rbx, r14
lea rax, [0x14027c458]
mov dword [rbp + 0xc0], 0x10009
mov qword [rbp + 0xf8], rax
lea r8, [rbp + 0x1a0]
mov eax, dword [0x1402bf648]
lea rcx, [rbp + 0xc0]
mov r9d, 0x200
mov qword [rbp + 0x110], rax
mov edx, 3
mov qword [rbp + 0xd0], rbx
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 6
mov dword [rbp + 0x100], 0x10009
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_PhFormatToBuffer
xor r8d, r8d
test al, al
je 0x140106fdb
lea r9, [rbp + 0x1a0]
jmp 0x140107006
mov edx, 1
mov dword [rsp + 0x40], 0x10009
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rbx
call sym.SystemInformer.exe_PhFormat
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c2840]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401dd6a0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret