Function at 0x7fff25d508a0
Capabilities:
Access peb ldr_data
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 1
je 0x7fff25d50875
test edx, edx
je 0x7fff25d5088f
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call fcn.7fff25dd0708
mov r8, rdi
mov edx, ebx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x7fff25d508a0
mov edx, 0xfa0
lea rcx, [0x7fff25fd1260]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSectionAndSpinCount]
nop dword [rax + rax]
jmp 0x7fff25d5084c
test rdi, rdi
jne 0x7fff25d5084c
jmp 0x7fff25ddcaee
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, qword gs:[0x60]
xor r15d, r15d
mov rax, qword gs:[0x30]
mov rbp, r8
mov r14d, edx
mov ebx, 1
mov r9d, dword [rax + 0x40]
mov eax, edx
mov dword [rsp + 0x34], r9d
test edx, edx
je 0x7fff25d50d16
sub eax, ebx
je 0x7fff25d50982
sub eax, ebx
jne 0x7fff25d5094e
cmp byte [0x7fff25fd0fa8], r15b
jne 0x7fff25d5097b
mov r8, rbp
mov edx, r14d
call fcn.7fff25d50db8
mov bl, al
mov al, bl
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp eax, ebx
jne 0x7fff25d50911
call qword [sym.imp.ntdll.dll_RtlCleanUpTEBLangLists]
nop dword [rax + rax]
mov rax, qword gs:[0x30]
cmp qword [rax + 0x1768], r15
jne 0x7fff25ddcb08
call fcn.7fff25d50ecc
jmp 0x7fff25d50911
call fcn.7fff25d5125c
jmp 0x7fff25d50911
mov rax, qword [rsi + 0x20]
mov qword [0x7fff25fd0d58], rcx
movzx ecx, byte [0x7fff25fd0c70]
cmp dword [rax + 8], r15d
cmovl ecx, ebx
mov byte [0x7fff25fd0c70], cl
call fcn.7fff25d522f8
mov rcx, qword gs:[0x60]
lea r9, [0x7fff25f08620]
lea r8, str.BASEDLL_
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlCreateTagHeap]
nop dword [rax + rax]
mov dword [0x7fff25fd0c80], eax
mov edi, dword [rsi + 0x2c0]
call qword [sym.imp.ntdll.dll_RtlGetCurrentServiceSessionId]
nop dword [rax + rax]
mov edx, 0x200
lea rcx, [rsp + 0x40]
cmp edi, eax
je 0x7fff25d50da0
lea rax, str.Windows
mov qword [rsp + 0x28], rax
lea r9, str.Sessions
lea r8, str._ws_ld_ws
mov dword [rsp + 0x20], edi
call fcn.7fff25d528dc
xor r9d, r9d
lea rdx, [0x7fff25fd0de0]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25ddcb64
lea rcx, [rsp + 0x34]
call qword [sym.imp.ntdll.dll_RtlRandomEx]
nop dword [rax + rax]
mov eax, eax
lea rcx, [rsp + 0x34]
shl rax, 0x20
mov qword [0x7fff25fd0dc8], rax
call qword [sym.imp.ntdll.dll_RtlRandomEx]
nop dword [rax + rax]
mov eax, eax
lea r8, [rsp + 0x30]
or qword [0x7fff25fd0dc8], rax
lea rcx, [rsp + 0x40]
mov eax, 0x64
mov word [0x7fff25fd0c72], ax
call fcn.7fff25d5229c
test eax, eax
js 0x7fff25ddcb64
mov eax, 0xc8
mov word [0x7fff25fd0c72], ax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov rdx, qword [rcx + 8]
sub rdx, qword [rax + 0x380]
mov rax, qword gs:[0x60]
add rdx, qword [rax + 0x88]
cmp byte [rsp + 0x30], r15b
mov qword [0x7fff25fd0dd0], rdx
movzx eax, word [rdx + 0x38]
setne byte [0x7fff25fd0c84]
movups xmm0, xmmword [rdx]
mov word [0x7fff25fd0e20], ax
movups xmmword [0x7fff25fd0c88], xmm0
psrldq xmm0, 8
movq rax, xmm0
mov qword [0x7fff25fd0c90], rax
test rax, rax
je 0x7fff25ddcb39
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov r8, qword [rcx + 8]
sub r8, qword [rax + 0x380]
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x88]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov r9, qword [rcx + 8]
sub r9, qword [r8 + rdx + 0x9e8]
sub r9, qword [rax + 0x380]
mov rax, qword gs:[0x60]
mov rdx, qword [0x7fff25fd0dd0]
add r9, qword [rax + 0x88]
add qword [0x7fff25fd0c90], r9
movups xmm0, xmmword [rdx + 0x10]
movups xmmword [0x7fff25fd0c98], xmm0
psrldq xmm0, 8
movq rax, xmm0
mov qword [0x7fff25fd0ca0], rax
test rax, rax
je 0x7fff25ddcb45
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov r8, qword [rcx + 8]
sub r8, qword [rax + 0x380]
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x88]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x98]
mov rax, qword gs:[0x60]
mov r9, qword [rcx + 8]
sub r9, qword [r8 + rdx + 0x9e8]
sub r9, qword [rax + 0x380]
mov rax, qword gs:[0x60]
add r9, qword [rax + 0x88]
add qword [0x7fff25fd0ca0], r9
mov rax, qword [rsi + 0x20]
lea rdx, [0x7fff25fd0ed0]
mov r8b, bl
lea rcx, [0x7fff25fd0ec0]
movups xmm0, xmmword [rax + 0x70]
movdqu xmmword [0x7fff25fd0ed0], xmm0
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
nop dword [rax + rax]
test eax, eax
js 0x7fff25ddcb51
lea rcx, [sym.KERNELBASE.dll_UnhandledExceptionFilter]
call qword [sym.imp.ntdll.dll_RtlSetUnhandledExceptionFilter]
nop dword [rax + rax]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlEncodePointer]
nop dword [rax + rax]
mov r8, qword [0x7fff25fd0dd0]
mov ecx, 0x190
mov edx, ebx
mov word [0x7fff25fd0c72], cx
mov qword [0x7fff25fd0c60], rax
call fcn.7fff25d51b7c
test al, al
je 0x7fff25ddcb64
mov ecx, 0x1f4
mov word [0x7fff25fd0c72], cx
lea rcx, [0x7fff25fd0d30]
call qword [sym.imp.ntdll.dll_RtlInitializeCriticalSection]
nop dword [rax + rax]
test eax, eax
js 0x7fff25ddcb64
mov ecx, 0x258
mov word [0x7fff25fd0c72], cx
call fcn.7fff25d518ac
mov bl, al
test al, al
je 0x7fff25d5091e
call fcn.7fff25db2ea0
mov eax, 0x2bc
mov word [0x7fff25fd0c72], ax
test bl, bl
jne 0x7fff25d50911
jmp 0x7fff25d5091e
mov rcx, qword [0x7fff25fcf248]
mov qword [0x7fff25fcf248], r15
mov dword [0x7fff25fcf228], r15d
call qword [sym.imp.ntdll.dll_EtwEventUnregister]
nop dword [rax + rax]
test rbp, rbp
je 0x7fff25ddcb6c
cmp qword [0x7fff25fd0c68], r15
je 0x7fff25d50d6b
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [0x7fff25fd0c68]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rax, [sym.KERNELBASE.dll_LoadLibraryA]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNELBASE.dll_LoadLibraryW]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNELBASE.dll_LoadLibraryExA]
mov qword [rsp + 0x38], rax
lea rax, [sym.KERNELBASE.dll_LoadLibraryExW]
mov qword [rsp + 0x38], rax
jmp 0x7fff25d50d09
lea r8, str.Windows
call fcn.7fff25d50450
jmp 0x7fff25d50a1c
lea rcx, [0x7fff25fd1260]
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
nop dword [rax + rax]
nop
jmp 0x7fff25d5084c
mov r8, qword gs:[0x30]
xor edx, edx
mov rcx, qword gs:[0x60]
mov r8, qword [r8 + 0x1768]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x7fff25d50974
mov qword [0x7fff25fd0c90], r15
jmp 0x7fff25d50b9b
mov qword [0x7fff25fd0ca0], r15
jmp 0x7fff25d50c37
mov qword [0x7fff25fd0ec8], r15
mov dword [0x7fff25fd0ec0], r15d
jmp 0x7fff25d50c6c
mov bl, r15b
jmp 0x7fff25d5091e
movzx eax, word [0x7fff25fd0c72]
mov ecx, 0x258
cmp ax, cx
jbe 0x7fff25ddcba3
lea rcx, [0x7fff25fd1000]
call 0x7fff25e40d48
lea rcx, [0x7fff25fd0fc0]
call qword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
nop dword [rax + rax]
movzx eax, word [0x7fff25fd0c72]
mov ecx, 0x1f4
cmp ax, cx
jbe 0x7fff25ddcbb9
call fcn.7fff25e51508
movzx eax, word [0x7fff25fd0c72]
mov ecx, 0x190
cmp ax, cx
jbe 0x7fff25ddcbcd
xor r8d, r8d
xor edx, edx
call fcn.7fff25d51b7c
cmp qword [0x7fff25fd0ec8], r15
je 0x7fff25d50d40
lea rcx, [0x7fff25fd0ec0]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
nop dword [rax + rax]
nop
jmp 0x7fff25d50d40