Function at 0x1400cb8b8
Capabilities:
Encode data using xor
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
xor ebx, ebx
mov r13d, r9d
mov r12d, edx
mov edi, ecx
mov esi, ebx
mov r14d, 0x1f7047dd
cmp ecx, 0x34
jb 0x1400cb95a
cmp byte [0x14042e2b1], bl
movups xmm0, xmmword [0x14042e2a0]
movzx eax, word [0x14042e2b0]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cb947
mov r8d, ebx
lea r9, [rbp - 0x61]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9], al
inc r9
cmp r8d, 0x12
jl 0x1400cb919
mov r8d, edi
lea rdx, [rbp - 0x61]
mov ecx, 2
call fcn.1400c963c
mov edi, ebx
call fcn.1400cb7e0
mov qword [rbp - 0x31], rax
test rax, rax
je 0x1400cc121
mov rdx, qword [0x14049ce68]
test rdx, rdx
je 0x1400cc0c9
mov r8d, dword [rdx]
mov ecx, ebx
test r8d, r8d
je 0x1400cb9a1
mov r9, qword [rdx + 8]
mov r15d, ecx
shl r15, 6
add r15, r9
cmp dword [r15 + 0xc], edi
je 0x1400cb9a4
inc ecx
cmp ecx, r8d
jb 0x1400cb98a
mov r15, rbx
test r15, r15
je 0x1400cc0c9
mov eax, edi
imul r14, rax, 0x88
lea rax, [0x140497fe0]
add r14, rax
mov qword [r14], r15
test r13d, r13d
je 0x1400cba74
mov eax, r13d
sub eax, 1
je 0x1400cb9fc
sub eax, 1
je 0x1400cb9f5
sub eax, 1
je 0x1400cb9ee
cmp eax, 1
je 0x1400cb9e7
mov eax, ebx
jmp 0x1400cba0a
mov eax, 8
jmp 0x1400cba01
mov eax, 4
jmp 0x1400cba01
mov eax, 2
jmp 0x1400cba01
mov eax, 1
test dword [r15 + 0x1c], eax
mov eax, ebx
seta al
test eax, eax
jne 0x1400cba74
cmp byte [0x14042e269], bl
movups xmm0, xmmword [0x14042e258]
movzx eax, word [0x14042e268]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cba5a
lea rdi, [rbp - 0x61]
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x39
mov al, bl
inc ebx
sub al, dl
add al, 0x34
xor byte [rdi], al
inc rdi
cmp ebx, 0x12
jl 0x1400cba30
mov r9d, dword [r15 + 0x1c]
lea rdx, [rbp - 0x61]
mov r8d, r13d
mov ecx, 1
call fcn.1400c963c
jmp 0x1400cc121
xor eax, eax
mov dword [rbp + 0x5f], ebx
lea rdi, [rbp - 0x61]
lea r9, [rbp + 0x5f]
lea edx, [rax + 0x20]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
lea ecx, [rax + 0x5a]
lea rdx, [rbp - 0x61]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r13d, 1
test r12d, r12d
je 0x1400cbafe
test byte [r15 + 0x18], r13b
jne 0x1400cbafe
cmp byte [0x14042e2e1], bl
movups xmm0, xmmword [0x14042e2d0]
movzx eax, word [0x14042e2e0]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cbaf6
lea rdi, [rbp - 0x61]
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
add ebx, r13d
sub al, cl
add al, 0x34
xor byte [rdi], al
add rdi, r13
cmp ebx, 0x12
jl 0x1400cbacb
mov ecx, r13d
jmp 0x1400cc118
mov r12d, dword [rbp + 0x6f]
cmp r12d, dword [r15]
jae 0x1400cbb6a
mov eax, dword [0x14042e320]
lea rdi, [rbp - 0x61]
movups xmm0, xmmword [0x14042e300]
mov dword [rbp - 0x41], eax
movups xmm1, xmmword [0x14042e310]
mov al, byte [0x14042e324]
movups xmmword [rbp - 0x61], xmm0
mov byte [rbp - 0x3d], al
movups xmmword [rbp - 0x51], xmm1
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
add ebx, r13d
sub al, cl
add al, 0x34
xor byte [rdi], al
add rdi, r13
cmp ebx, 0x25
jl 0x1400cbb33
lea rdx, [rbp - 0x61]
mov ecx, r13d
jmp 0x1400cc11c
cmp dword [r15 + 4], 0xffffffff
je 0x1400cbbe0
cmp r12d, dword [r15 + 4]
jbe 0x1400cbbe0
mov eax, dword [0x14042e220]
lea r8, [rbp - 0x61]
movups xmm0, xmmword [0x14042e200]
mov dword [rbp - 0x41], eax
mov edi, ebx
movups xmm1, xmmword [0x14042e210]
movzx eax, word [0x14042e224]
movups xmmword [rbp - 0x61], xmm0
mov word [rbp - 0x3d], ax
movups xmmword [rbp - 0x51], xmm1
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, dil
add edi, r13d
sub al, cl
add al, 0x34
xor byte [r8], al
add r8, r13
cmp edi, 0x26
jl 0x1400cbba7
lea rdx, [rbp - 0x61]
mov ecx, r13d
call fcn.1400c963c
mov edx, dword [rbp + 0x7f]
mov edi, r13d
mov ecx, edx
test edx, edx
je 0x1400cbc14
sub ecx, 1
je 0x1400cbc14
sub ecx, 1
je 0x1400cbc14
cmp ecx, 1
jne 0x1400cbc6f
cmp qword [r14 + 0x80], rbx
jne 0x1400cbcd0
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_process_handle_acquisition_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x1400cbb62
mov rax, qword [r14]
mov ecx, dword [rax + 0x18]
test cl, 0x20
je 0x1400cbc31
cmp qword [r14 + 0x58], rbx
jne 0x1400cbc31
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x1400cbb62
test ecx, 0x180
je 0x1400cbc6f
mov eax, r13d
mov ecx, r13d
cmp qword [r14 + 0x68], rbx
je 0x1400cbc4b
cmp qword [r14 + 0x70], rbx
jne 0x1400cbc4d
mov eax, ebx
cmp qword [r14 + 0x48], rbx
je 0x1400cbc59
cmp qword [r14 + 0x50], rbx
jne 0x1400cbc5b
mov ecx, ebx
test eax, eax
jne 0x1400cbc6f
test ecx, ecx
jne 0x1400cbc6f
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x1400cbb62
test edx, edx
je 0x1400cbcb9
sub edx, 1
je 0x1400cbc8c
cmp edx, 1
jne 0x1400cbcd0
cmp qword [r14 + 0x40], rbx
jne 0x1400cbcd0
lea rdx, str.____Abort:_selected_provider_does_not_support_changing_DSE_values_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x1400cbcc6
mov rax, qword [r14]
test dword [rax + 0x18], 0x100
je 0x1400cbcad
cmp qword [r14 + 0x68], rbx
je 0x1400cbca4
cmp qword [r14 + 0x70], rbx
jne 0x1400cbcd0
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x1400cbcc6
cmp qword [r14 + 0x48], rbx
je 0x1400cbca4
cmp qword [r14 + 0x50], rbx
jmp 0x1400cbca2
cmp qword [r14 + 0x38], rbx
jne 0x1400cbcd0
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r13d
call fcn.1400c963c
mov edi, ebx
test edi, edi
je 0x1400cc121
mov ecx, reloc.WS2_32.dll_sendto
call fcn.1400cd720
mov ecx, 0xa
call fcn.1400cd720
test dword [r15 + 0x18], 0x800
je 0x1400cbd03
call fcn.1400ce10c
test eax, eax
je 0x1400cc121
mov rax, qword gs:[0x30]
mov edi, 8
mov r8d, 0x478
mov edx, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x1400cbd85
cmp byte [0x14042e299], bl
movups xmm0, xmmword [0x14042e288]
movzx eax, word [0x14042e298]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cbaf6
lea rdi, [rbp - 0x61]
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
add ebx, r13d
sub al, cl
add al, 0x34
xor byte [rdi], al
add rdi, r13
cmp ebx, 0x12
jl 0x1400cbd55
jmp 0x1400cbaf6
mov qword [rax + 0x40], r14
mov rax, qword [r14 + 0x78]
test rax, rax
je 0x1400cbe10
mov rcx, rsi
call rax
test eax, eax
jne 0x1400cbe10
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp byte [0x14042e1f9], bl
mov rsi, rbx
movups xmm0, xmmword [0x14042e1e8]
movzx eax, word [0x14042e1f8]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cbaf6
lea rdi, [rbp - 0x61]
mov eax, 0x1f7047dd
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
add ebx, r13d
sub al, cl
add al, 0x34
xor byte [rdi], al
add rdi, r13
cmp ebx, 0x12
jl 0x1400cbde0
jmp 0x1400cbaf6
test byte [r15 + 0x18], 0x40
je 0x1400cbe1c
mov rax, rbx
jmp 0x1400cbe41
mov rax, qword [r14]
cmp dword [rax + 0x10], 2
jb 0x1400cbe29
mov dword [rax + 0x10], r13d
mov rax, qword [r14]
mov ecx, dword [rax + 0x10]
lea rax, [rcx + rcx*4]
shl rax, 4
lea rcx, str.PROCEXP152
add rax, rcx
mov qword [rsi + 0x48], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x20]
mov rcx, qword [r15 + 0x28]
mov rax, rcx
test rcx, rcx
jne 0x1400cbe6b
mov rcx, rbx
jmp 0x1400cbe76
add rcx, 2
cmp word [rcx], bx
jne 0x1400cbe67
sub rcx, rax
sar rcx, 1
movzx eax, word [r13 + 0x38]
lea rcx, [rcx + 0x20]
mov edx, edi
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x1400cc0a8
mov eax, dword [rbp + 0x77]
mov dword [rsi + 8], eax
mov rax, qword [rbp - 0x31]
mov qword [rsi + 0x10], rax
mov dword [rsi + 4], r12d
call fcn.1400c9184
mov qword [rsi + 0x18], rax
lea rdi, [rbp - 0x21]
xor eax, eax
mov dword [rbp + 0x5f], ebx
lea r9, [rbp + 0x5f]
lea rdx, [rbp - 0x21]
lea r12d, [rax + 0x40]
mov ecx, r12d
mov r8d, r12d
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400cbef3
mov rax, qword [rbp + 7]
jmp 0x1400cbf0c
xor eax, eax
lea rdi, [rbp - 0x61]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp - 0x51]
mov ecx, reloc.WS2_32.dll_shutdown
mov qword [rsi + 0x38], rax
mov r14d, 0x20206f49
call fcn.1400cd8c8
mov r8, rax
test rax, rax
je 0x1400cbf72
mov rcx, rbx
cmp dword [rax], ebx
jbe 0x1400cbf59
mov edi, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov r9, rcx
cmp rdx, rcx
jbe 0x1400cbf45
mov r14d, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, r9
cmovbe rcx, r9
sub rdi, 1
jne 0x1400cbf36
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsi + 0x30]
mov dword [rsi + 0xc], r14d
movzx edx, word [r13 + 0x38]
mov r8, qword [r13 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400cecd8
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14042d7a0]
call fcn.1400ced2c
mov rdx, qword [r15 + 0x28]
mov rcx, qword [rsi + 0x30]
call fcn.1400ced2c
mov rcx, qword [rsi + 0x30]
lea rdx, str..sys
call fcn.1400ced2c
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
je 0x1400cc08b
mov rax, qword [rsi + 0x40]
mov dword [rsi + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x1400cc121
mov rdx, rsi
test byte [r15 + 0x18], r12b
jne 0x1400cbff2
mov edx, dword [r15 + 8]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x1400cc121
cmp byte [0x14042e369], bl
movups xmm0, xmmword [0x14042e358]
movzx eax, word [0x14042e368]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cc050
mov edi, ebx
lea r8, [rbp - 0x61]
mov eax, 0x1f7047dd
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, dil
inc edi
sub al, cl
add al, 0x34
xor byte [r8], al
inc r8
cmp edi, 0x12
jl 0x1400cc024
lea rdx, [rbp - 0x61]
mov ecx, 1
call fcn.1400c963c
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1400cc06d
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + reloc.WS2_32.dll_recv]
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x1400cc0a8
mov rax, qword gs:[0x30]
jmp 0x1400cc098
mov rax, qword gs:[0x30]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbx
jmp 0x1400cc121
cmp byte [0x14042e381], bl
movups xmm0, xmmword [0x14042e370]
movzx eax, word [0x14042e380]
mov word [rbp - 0x51], ax
movups xmmword [rbp - 0x61], xmm0
je 0x1400cc113
lea rdi, [rbp - 0x61]
mov eax, r14d
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, bl
inc ebx
sub al, cl
add al, 0x34
xor byte [rdi], al
inc rdi
cmp ebx, 0x12
jl 0x1400cc0eb
mov ecx, 1
lea rdx, [rbp - 0x61]
call fcn.1400c963c
mov rbx, qword [rsp + 0xe8]
mov rax, rsi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret