Function at 0x1401087e0
Capabilities:
Execute anti-debugging instructions
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x3d8]
sub rsp, 0x4d0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1402ba040]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
movups xmm0, xmmword [0x14023a1f8]
xor eax, eax
cmp qword [0x1402c7c28], rax
xorps xmm1, xmm1
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x190], rax
movups xmmword [rbp + 0x170], xmm1
mov dword [rbp + 0x198], eax
movups xmmword [rbp + 0x180], xmm1
mov word [rbp + 0x19c], ax
je 0x140108878
cmp qword [0x1402c7b08], rax
je 0x140108878
lea rcx, [rsp + 0x30]
call fcn.1401095e0
test al, al
je 0x140108878
movsd xmm6, qword [rsp + 0x30]
jmp 0x14010888a
mov rax, qword [0x1402c7bf0]
xorps xmm6, xmm6
mov ecx, dword [rax + 8]
cvtsi2sd xmm6, rcx
movzx eax, word [0x1402c2228]
lea r8, [rbp + 0x1a0]
movss xmm1, dword [0x1402c4918]
lea rcx, [rbp + 0xc0]
movss xmm0, dword [0x1402c4c38]
xor r14d, r14d
movsd xmm7, qword [0x14028d350]
mov r9d, 0x200
cvtps2pd xmm1, xmm1
mov word [rbp + 0xc4], ax
mov eax, 0x25
mov dword [rbp + 0xc0], 0x4b
mov dword [rbp + 0xe0], r14d
mov word [rbp + 0xf0], ax
lea edx, [rax - 0x23]
mov qword [rsp + 0x20], r14
cvtps2pd xmm0, xmm0
divsd xmm6, xmm7
addsd xmm1, xmm0
mulsd xmm1, qword [0x14028d340]
movsd qword [rbp + 0xd0], xmm1
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x14010891f
lea r9, [rbp + 0x1a0]
jmp 0x14010893f
mov edx, 2
lea rcx, [rbp + 0xc0]
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7bc8]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
movzx ecx, word [0x1402c2228]
lea rax, [0x140280bc8]
mov qword [rbp + 0xf8], rax
lea r8, [rbp + 0x1a0]
mov eax, dword [0x1402c7b10]
xorps xmm0, xmm0
mov word [rbp + 0xc4], cx
mov r9d, 0x200
mov word [rbp + 0x104], cx
mov edx, 4
lea rcx, [rbp + 0xc0]
movsd qword [rbp + 0xd0], xmm6
cvtsi2sd xmm0, rax
lea rax, str._GHz
mov dword [rbp + 0xc0], 0x4b
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 6
mov dword [rbp + 0x100], 0x4b
mov dword [rbp + 0x120], 1
divsd xmm0, xmm7
mov qword [rbp + 0x130], 8
mov qword [rbp + 0x138], rax
mov qword [rsp + 0x20], r14
movsd qword [rbp + 0x110], xmm0
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108a15
lea r9, [rbp + 0x1a0]
jmp 0x140108a35
mov edx, 4
lea rcx, [rbp + 0xc0]
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7c30]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c40d0]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108a95
lea r9, [rbp + 0x1a0]
jmp 0x140108ac6
mov eax, dword [0x1402c40d0]
lea rcx, [rsp + 0x60]
mov edx, 1
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7c78]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c40d8]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108b22
lea r9, [rbp + 0x1a0]
jmp 0x140108b54
mov eax, dword [0x1402c40d8]
lea rcx, ds:[rbp - 0x80]
mov edx, 1
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x80], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7b40]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c40d4]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108bb5
lea r9, [rbp + 0x1a0]
jmp 0x140108be3
mov eax, dword [0x1402c40d4]
lea rcx, [rbp - 0x60]
mov edx, 1
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7ae0]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
lea rdx, [rbp + 0x90]
lea r8d, [r9 + 0x30]
lea ecx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140108c35
mov rcx, qword [rbp + 0x98]
lea r8, [rbp + 0x160]
sub rcx, qword [rbp + 0x90]
mov edx, 2
mov qword [rsp + 0x20], r14
call fcn.1401468e0
mov rcx, qword [0x1402c7af0]
lea r9, [rbp + 0x160]
xor r8d, r8d
lea edx, [r8 + 0xc]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c7bd0], 1
jbe 0x140108cd3
mov eax, dword [0x1402c7be4]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108ca3
lea r9, [rbp + 0x1a0]
jmp 0x140108cdd
mov eax, dword [0x1402c7be4]
lea rcx, ds:[rbp - 0x40]
mov edx, 1
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x40], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140108cda
lea r9, [0x14026f500]
xor r8d, r8d
mov rcx, qword [0x1402c7bf8]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c7bd0], 1
jbe 0x140108d73
mov eax, dword [0x1402c7afc]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108d42
lea r9, [rbp + 0x1a0]
jmp 0x140108d7d
mov eax, dword [0x1402c7afc]
lea rcx, ds:[rbp - 0x20]
mov edx, 1
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x20], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140108d7a
lea r9, [0x14026f500]
xor r8d, r8d
mov rcx, qword [0x1402c7b28]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c7bd0], 1
jbe 0x140108e13
mov rax, qword [0x1402c7c40]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108de3
lea r9, [rbp + 0x1a0]
jmp 0x140108e1d
mov rax, qword [0x1402c7c40]
lea rcx, ds:[rbp]
mov edx, 1
mov qword [rbp + 0x10], rax
mov dword [rbp], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140108e1a
lea r9, [0x14026f500]
xor r8d, r8d
mov rcx, qword [0x1402c7c18]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x1402c7bd0], 1
jbe 0x140108eb3
mov eax, dword [0x1402c7c24]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108e82
lea r9, [rbp + 0x1a0]
jmp 0x140108ebd
mov eax, dword [0x1402c7c24]
lea rcx, ds:[rbp + 0x20]
mov edx, 1
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x20], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
mov r9, qword [rax + 8]
jmp 0x140108eba
lea r9, [0x14026f500]
xor r8d, r8d
mov rcx, qword [0x1402c7c88]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c7b50]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108f19
lea r9, [rbp + 0x1a0]
jmp 0x140108f4c
mov eax, dword [0x1402c7b50]
lea rcx, [rbp + 0x40]
mov edx, 1
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x40], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7b30]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c7b5c]
lea r8, [rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140108fa8
lea r9, [rbp + 0x1a0]
jmp 0x140108fd6
mov eax, dword [0x1402c7b5c]
lea rcx, [rbp + 0x60]
mov edx, 1
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x60], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7c10]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x1402c7b58]
lea r8, ds:[rbp + 0x1a0]
mov r9d, 0x200
mov qword [rbp + 0xd0], rax
mov edx, 1
mov dword [rbp + 0xc0], 0x10009
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x140109035
lea r9, [rbp + 0x1a0]
jmp 0x140109066
mov eax, dword [0x1402c7b58]
lea rcx, [rsp + 0x40]
mov edx, 1
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x40], 0x10009
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7c80]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, ds:[rbp + 0x88]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
lock or dword [rsp], r14d
rdtsc
shl rdx, 0x20
or rax, rdx
mov rdi, rax
lock or dword [rsp], r14d
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x3c], edx
lock or dword [rsp], r14d
rdtsc
shl rdx, 0x20
or rax, rdx
mov rsi, rax
lock or dword [rsp], r14d
lea rcx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_RtlQueryPerformanceCounter]
mov rbx, qword [rbp + 0x80]
sub rbx, qword [rbp + 0x88]
test rdi, rdi
jne 0x1401090fd
test rsi, rsi
jne 0x1401090fd
cmp dword [rsp + 0x30], r14d
jne 0x1401090fd
cmp dword [rsp + 0x3c], r14d
cmove rbx, r14
lea rax, [0x140280be0]
mov dword [rbp + 0xc0], 0x10009
mov qword [rbp + 0xf8], rax
lea r8, [rbp + 0x1a0]
mov eax, dword [0x1402c48e4]
lea rcx, [rbp + 0xc0]
mov r9d, 0x200
mov qword [rbp + 0x110], rax
mov edx, 3
mov qword [rbp + 0xd0], rbx
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 6
mov dword [rbp + 0x100], 0x10009
mov qword [rsp + 0x20], r14
call sym.SystemInformer.exe_QiFormatToBuffer
xor r8d, r8d
test al, al
je 0x14010917b
lea r9, [rbp + 0x1a0]
jmp 0x1401091a6
mov edx, 1
mov dword [rsp + 0x40], 0x10009
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x50], rbx
call sym.SystemInformer.exe_QiFormat
mov rcx, rax
call sym.SystemInformer.exe_QiAutoDereferenceObject
xor r8d, r8d
mov r9, qword [rax + 8]
mov rcx, qword [0x1402c7b00]
mov edx, 0xc
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1401e0100
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret