Function at 0x140049060
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x38], r15d
mov ebx, r15d
lea r9, [rbp + 0x38]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400490e6
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x38]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x38]
mov r8d, dword [rbp + 0x38]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400490a0
test eax, eax
js 0x14004939f
test rbx, rbx
je 0x1400493b5
mov r14, r15
mov edi, r15d
cmp qword [rbx], rdi
jbe 0x14004915f
mov rax, r15
nop word [rax + rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp - 0x58]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14004914b
cmp qword [rbp - 0x38], rsi
je 0x14004915a
inc edi
mov eax, edi
cmp rax, qword [rbx]
jae 0x1400493a4
jmp 0x140049110
movq r14, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x1400493b5
mov qword [rbp + 0x48], r15
lea r8, [r14 + 8]
mov r9d, 8
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.140048880
test al, al
je 0x140049396
mov r8, qword [rbp + 0x48]
test r8, r8
je 0x140049396
mov qword [rbp - 0x60], r15
add r8, 8
mov r9d, 8
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.140048880
test al, al
je 0x14004938d
mov r8, qword [rbp - 0x60]
test r8, r8
je 0x14004938d
mov qword [rbp + 0x40], r15
add r8, 0x28
mov r9d, 8
lea rdx, [rbp + 0x40]
mov rcx, rsi
call fcn.140048880
test al, al
je 0x140049384
mov r8, qword [rbp + 0x40]
test r8, r8
je 0x140049384
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
add r8, 0x58
mov r9d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.140048880
test al, al
je 0x140049348
movzx eax, word [rbp - 0x48]
test ax, ax
je 0x140049348
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.14010f684
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140112010
mov qword [rbp - 0x58], rdi
movzx r9d, word [rbp - 0x48]
mov r8, qword [rbp - 0x40]
mov rdx, rdi
mov rcx, rsi
call fcn.140048880
test al, al
jne 0x140049293
lea rdx, str.____Failed_to_read_driver_name
jmp 0x1400492bd
mov word [rbp - 0x48], r15w
mov rdx, qword [rbp + 0x40]
add rdx, 0x58
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x48]
mov rcx, rsi
call fcn.140048880
test al, al
jne 0x1400492f4
lea rdx, str.____Failed_to_write_driver_name_length
lea rcx, [0x14019cdb0]
call fcn.140009320
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
xor bl, bl
jmp 0x14004933b
lea rdx, str.___MmUnloadedDrivers_Cleaned:
lea rcx, [0x14019cdb0]
call fcn.140009320
mov rbx, rax
mov rdx, rdi
mov rcx, rax
call fcn.140009320
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
mov bl, 1
mov rcx, rdi
call fcn.14010f640
movzx eax, bl
jmp 0x1400493b7
lea rdx, str.____Failed_to_find_driver_name
lea rcx, [0x14019cdb0]
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
jmp 0x1400493b5
lea rdx, str.____Failed_to_find_driver_section
jmp 0x14004934f
lea rdx, str.____Failed_to_find_driver_object
jmp 0x14004934f
lea rdx, str.____Failed_to_find_device_object
jmp 0x14004934f
test rbx, rbx
je 0x1400493b5
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret