Function at 0x140027b50
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x140113f00]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r14, rcx
xor r15d, r15d
mov dword [rbp - 1], r15d
mov ebx, r15d
lea r9, [rbp - 1]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140027bec
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 1]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp - 1]
mov r8d, dword [rbp - 1]
mov rdx, rax
mov ecx, 0x40
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140027ba5
test eax, eax
js 0x140027dbc
test rbx, rbx
je 0x140027dd2
mov rsi, r15
mov edi, r15d
cmp qword [rbx], r15
jbe 0x140027c5b
mov rax, r15
nop dword [rax + rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp + 0x2f], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp + 0x2f]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140027c4b
cmp qword [rbp - 0x39], r14
je 0x140027c56
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140027c10
jmp 0x140027c5b
movq rsi, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140027dd2
mov qword [rbp + 0x1f], r15
lea rdx, [rsi + 8]
mov r9d, 8
lea r8, [rbp + 0x1f]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
je 0x140027dd2
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
je 0x140027dd2
mov qword [rbp + 0x27], r15
add rdx, 8
mov r9d, 8
lea r8, [rbp + 0x27]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
je 0x140027dd2
mov rdx, qword [rbp + 0x27]
test rdx, rdx
je 0x140027dd2
mov qword [rbp + 0x17], r15
add rdx, 0x28
mov r9d, 8
lea r8, [rbp + 0x17]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
je 0x140027dd2
mov rdx, qword [rbp + 0x17]
test rdx, rdx
je 0x140027dd2
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
add rdx, 0x58
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 7]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
je 0x140027dd2
movzx eax, word [rbp + 7]
test ax, ax
je 0x140027dd2
mov qword [rbp + 0x2f], r15
mov edx, eax
shr rdx, 1
inc rdx
lea rcx, [rbp + 0x2f]
call fcn.1400265b0
nop
movzx r9d, word [rbp + 7]
mov rbx, qword [rbp + 0x2f]
mov r8, rbx
mov rdx, qword [rbp + 0xf]
lea rcx, [0x140114c58]
call fcn.14002ef90
test al, al
je 0x140027da6
mov word [rbp + 7], r15w
mov rdx, qword [rbp + 0x17]
add rdx, 0x58
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 7]
lea rcx, [0x140114c58]
call fcn.14002f070
test al, al
je 0x140027da6
mov dil, 1
jmp 0x140027da9
xor dil, dil
test rbx, rbx
je 0x140027db6
mov rcx, rbx
call fcn.1400d8ba8
movzx eax, dil
jmp 0x140027dd4
test rbx, rbx
je 0x140027dd2
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400d8ff0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret