Function at 0x14006e970
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140162080]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
xor r15d, r15d
mov dword [rbp - 0x39], r15d
mov ebx, r15d
lea r9, [rbp - 0x39]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14006ea0a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x39]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp - 0x39]
mov r8d, dword [rbp - 0x39]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14006e9c4
test eax, eax
js 0x14006ecd2
test rbx, rbx
je 0x14006ece8
mov r14, r15
mov edi, r15d
cmp qword [rbx], rdi
jbe 0x14006ea89
mov rax, r15
nop dword [rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp - 1], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x49], xmm0
movsd xmm0, qword [rbx + rax*8 + 0x30]
movsd qword [rbp + 0x2f], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp - 1]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14006ea76
cmp qword [rbp - 0x49], rsi
je 0x14006ea84
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x14006ea30
jmp 0x14006ecd7
movq r14, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x14006ece8
mov qword [rbp - 0x11], r15
lea r8, [r14 + 8]
mov r9d, 8
lea rdx, [rbp - 0x11]
mov rcx, rsi
call fcn.14006dfd0
test al, al
je 0x14006ecc9
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x14006ecc9
mov qword [rbp - 9], r15
add r8, 8
mov r9d, 8
lea rdx, [rbp - 9]
mov rcx, rsi
call fcn.14006dfd0
test al, al
je 0x14006ecc0
mov r8, qword [rbp - 9]
test r8, r8
je 0x14006ecc0
mov qword [rbp - 0x19], r15
add r8, 0x28
mov r9d, 8
lea rdx, [rbp - 0x19]
mov rcx, rsi
call fcn.14006dfd0
test al, al
je 0x14006ecb7
mov r8, qword [rbp - 0x19]
test r8, r8
je 0x14006ecb7
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
add r8, 0x58
mov r9d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x31]
mov rcx, rsi
call fcn.14006dfd0
test al, al
je 0x14006ec92
movzx eax, word [rbp - 0x31]
test ax, ax
je 0x14006ec92
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.140105504
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140106020
mov qword [rbp - 1], rdi
movzx r9d, word [rbp - 0x31]
mov r8, qword [rbp - 0x29]
mov rdx, rdi
mov rcx, rsi
call fcn.14006dfd0
test al, al
jne 0x14006ebc0
lea rdx, str.____Failed_to_read_driver_name
jmp 0x14006ec67
mov word [rbp - 0x31], r15w
mov rax, qword [rbp - 0x19]
add rax, 0x58
je 0x14006ec60
mov qword [rbp + 0x17], r15
mov qword [rbp + 0xf], gethostname
lea rcx, [rbp - 0x31]
mov qword [rbp + 0x1f], rcx
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], reloc.WS2_32.dll_recv
mov dword [rbp - 0x21], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp - 0x21]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, Ordinal_41
lea r8, [rbp + 0xf]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14006ec60
lea rdx, str.___MmUnloadedDrivers_Cleaned:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400717b0
mov rbx, rax
mov rdx, rdi
mov rcx, rax
call fcn.1400717b0
lea rdx, [0x140071990]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov bl, 1
jmp 0x14006ec85
lea rdx, str.____Failed_to_write_driver_name_length
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400717b0
lea rdx, [0x140071990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor bl, bl
mov rcx, rdi
call fcn.140105460
movzx eax, bl
jmp 0x14006ecea
lea rdx, str.____Failed_to_find_driver_name
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400717b0
lea rdx, [0x140071990]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14006ece8
lea rdx, str.____Failed_to_find_driver_section
jmp 0x14006ec99
lea rdx, str.____Failed_to_find_driver_object
jmp 0x14006ec99
lea rdx, str.____Failed_to_find_device_object
jmp 0x14006ec99
test rbx, rbx
je 0x14006ece8
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140104d30
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret