Function at 0x14001d770
Capabilities:
Allocate or change rwx memory
Encode data using xor
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp + 7], rax
mov r14, rcx
lea r9, [rsp + 0x40]
xor ebx, ebx
mov ecx, 0x40
xor r8d, r8d
mov dword [rsp + 0x40], ebx
xor edx, edx
mov edi, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r15d, 4
cmp eax, 0xc0000004
jne 0x14001d808
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x40]
mov r9d, r15d
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001d7c0
mov qword [rsp + 0x140], r13
test eax, eax
js 0x14001e090
test rdi, rdi
je 0x14001e0a6
mov r13, rbx
mov qword [rsp + 0x138], rsi
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x14001d8ae
movaps xmmword [rsp + 0xf0], xmm6
mov rax, rbx
movaps xmmword [rsp + 0xe0], xmm7
nop word [rax + rax]
lea rax, [rax + rax*4]
movsd xmm0, qword [rdi + rax*8 + 0x30]
movups xmm6, xmmword [rdi + rax*8 + 0x10]
movups xmm7, xmmword [rdi + rax*8 + 0x20]
movsd qword [rbp - 0x49], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14001d88e
movq rax, xmm7
cmp rax, r14
je 0x14001d899
inc esi
mov eax, esi
cmp rax, qword [rdi]
jb 0x14001d850
jmp 0x14001d89e
movq r13, xmm6
movaps xmm6, xmmword [rsp + 0xf0]
movaps xmm7, xmmword [rsp + 0xe0]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x138]
test r13, r13
je 0x14001e0a6
lea r8, [r13 + 8]
mov qword [rbp - 9], rbx
mov r9d, 8
lea rdx, [rbp - 9]
mov rcx, r14
call fcn.14001bb70
test al, al
je 0x14001df00
mov r8, qword [rbp - 9]
test r8, r8
je 0x14001df00
add r8, 8
mov qword [rbp - 1], rbx
mov r9d, 8
lea rdx, [rbp - 1]
mov rcx, r14
call fcn.14001bb70
test al, al
je 0x14001dd6d
mov r8, qword [rbp - 1]
test r8, r8
je 0x14001dd6d
add r8, 0x28
mov qword [rbp - 0x11], rbx
mov r9d, 8
lea rdx, [rbp - 0x11]
mov rcx, r14
call fcn.14001bb70
test al, al
je 0x14001dce4
mov r8, qword [rbp - 0x11]
test r8, r8
je 0x14001dce4
xorps xmm0, xmm0
lea rdx, [rsp + 0x48]
add r8, 0x58
mov r9d, 0x10
mov rcx, r14
movups xmmword [rsp + 0x48], xmm0
call fcn.14001bb70
test al, al
je 0x14001dcd1
movzx eax, word [rsp + 0x48]
test ax, ax
je 0x14001dcd1
mov ecx, eax
mov eax, 2
shr rcx, 1
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.14002dfe4
movzx r8d, word [rsp + 0x48]
xor edx, edx
add r8, 2
mov rcx, rax
mov rdi, rax
call fcn.14002ed38
movzx r9d, word [rsp + 0x48]
mov rdx, rdi
mov r8, qword [rbp - 0x79]
mov rcx, r14
call fcn.14001bb70
test al, al
jne 0x14001da87
mov dword [rbp - 0x4d], 0xb8fcb8ea
mov dword [rbp - 0x49], 0xb8ffb8fb
lea rcx, [rbp - 0x69]
mov dword [rbp - 0x51], 0xb8b7b8f9
mov dword [rbp - 0x55], 0xb8e1b8b4
mov dword [rbp - 0x59], 0xb8f7b8f7
mov dword [rbp - 0x5d], 0xb8fdb8f9
mov dword [rbp - 0x61], 0xb8eeb8c8
mov dword [rbp - 0x65], 0xb8adb8d1
mov dword [rbp - 0x69], 0xb8aab8d1
mov dword [rbp - 0x45], 0xb8f9b8bc
mov dword [rbp - 0x41], 0xb8f6b8ec
mov dword [rbp - 0x3d], 0xb8c4b8d6
mov dword [rbp - 0x39], 0xb883b8d0
mov dword [rbp - 0x35], 0xb8c4b8ca
mov dword [rbp - 0x31], 0xb8c2b8cb
mov word [rbp - 0x2d], bx
mov byte [rbp - 0x2b], 1
call fcn.14001b330
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140023cc0
lea rdx, [0x140023ea0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14001e0a6
mov rax, qword [rbp - 0x11]
mov word [rsp + 0x48], bx
add rax, 0x58
je 0x14001dafc
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x48]
mov qword [rbp - 0x51], rax
lea r8, [rbp - 0x69]
lea rax, [rbp - 0x19]
mov qword [rbp - 0x59], rcx
mov qword [rsp + 0x30], rax
mov r9d, 0x28
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x61], rbx
mov qword [rbp - 0x69], 0x33
mov qword [rbp - 0x49], 0x10
mov dword [rbp - 0x19], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001dafc
mov rcx, rdi
call fcn.14002dc40
mov al, 1
jmp 0x14001e0a8
movdqa xmm3, xmmword [0x14003a7b0]
movdqa xmm4, xmmword [0x14003a7c0]
mov dword [rbp - 0x69], 0xb8aab8d1
mov dword [rbp - 0x65], 0xb8adb8d1
mov dword [rbp - 0x61], 0xb8eeb8c8
mov dword [rbp - 0x5d], 0xb8fdb8f9
mov dword [rbp - 0x59], 0xb8f7b8f7
mov dword [rbp - 0x55], 0xb8e1b8b4
mov dword [rbp - 0x51], 0xb8b7b8f9
mov dword [rbp - 0x4d], 0xb8ebb8ef
mov dword [rbp - 0x49], 0xb8efb8f3
mov dword [rbp - 0x45], 0xb8bdb8f9
mov dword [rbp - 0x41], 0xb8edb8fa
mov dword [rbp - 0x3d], 0xb8d7b8c9
mov dword [rbp - 0x39], 0xb8d1b8c7
mov dword [rbp - 0x35], 0xb8cbb884
mov dword [rbp - 0x31], 0xb8cab8c7
mov dword [rbp - 0x2d], 0xb889b8cd
mov dword [rbp - 0x29], 0xb8ceb8c6
mov dword [rbp - 0x25], 0xb8cab8c2
mov dword [rbp - 0x21], 0xb8c7b8da
mov word [rbp - 0x1d], bx
mov byte [rbp - 0x1b], 1
nop dword [rax]
movd xmm1, dword [rbp + rbx*2 - 0x69]
lea rax, [r15 - 1]
lea rcx, [r15 - 2]
movq xmm0, rbx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rbp + rbx*2 - 0x69], xmm1
movq xmm0, rax
movd xmm1, dword [rbp + rbx*2 - 0x65]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rbp + rbx*2 - 0x65], xmm1
add r15, 8
movd xmm1, dword [rbp + rbx*2 - 0x61]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rbp + rbx*2 - 0x61], xmm1
movd xmm1, dword [rbp + rbx*2 - 0x5d]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rbx*2 - 0x5d], xmm1
add rbx, 8
cmp r15, 0x24
jb 0x14001dba0
cmp rbx, 0x26
jae 0x14001dcc4
mov ecx, 0x4776
nop dword [rax]
nop word [rax + rax]
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x69], ax
inc rbx
cmp rbx, 0x26
jb 0x14001dcb0
mov byte [rbp - 0x1b], 0
lea rdx, [rbp - 0x69]
jmp 0x14001da66
mov dword [rbp - 0x4d], 0xb8f0b8fe
mov dword [rbp - 0x49], 0xb8ffb8f4
jmp 0x14001d9f7
lea rcx, [rbp - 0x69]
mov dword [rbp - 0x69], 0xb8aab8d1
mov dword [rbp - 0x65], 0xb8adb8d1
mov dword [rbp - 0x61], 0xb8eeb8c8
mov dword [rbp - 0x5d], 0xb8fdb8f9
mov dword [rbp - 0x59], 0xb8f7b8f7
mov dword [rbp - 0x55], 0xb8e1b8b4
mov dword [rbp - 0x51], 0xb8b7b8f9
mov dword [rbp - 0x4d], 0xb8f0b8fe
mov dword [rbp - 0x49], 0xb8ffb8f4
mov dword [rbp - 0x45], 0xb8f9b8bc
mov dword [rbp - 0x41], 0xb8f6b8ec
mov dword [rbp - 0x3d], 0xb8c4b8d6
mov dword [rbp - 0x39], 0xb8fcb8d0
mov dword [rbp - 0x35], 0xb8c0b8d7
mov dword [rbp - 0x31], 0xb8d3b8c5
mov dword [rbp - 0x2d], 0xb8c6b8c1
mov dword [rbp - 0x29], 0xb8c4
mov byte [rbp - 0x25], 1
call fcn.14001d140
jmp 0x14001da63
movdqa xmm3, xmmword [0x14003a7b0]
lea rdx, [rbp - 0x65]
movdqa xmm4, xmmword [0x14003a7c0]
mov dword [rbp - 0x69], 0xb8aab8d1
mov dword [rbp - 0x65], 0xb8adb8d1
mov dword [rbp - 0x61], 0xb8eeb8c8
mov dword [rbp - 0x5d], 0xb8fdb8f9
mov dword [rbp - 0x59], 0xb8f7b8f7
mov dword [rbp - 0x55], 0xb8e1b8b4
mov dword [rbp - 0x51], 0xb8b7b8f9
mov dword [rbp - 0x4d], 0xb8f0b8fe
mov dword [rbp - 0x49], 0xb8ffb8f4
mov dword [rbp - 0x45], 0xb8f9b8bc
mov dword [rbp - 0x41], 0xb8f6b8ec
mov dword [rbp - 0x3d], 0xb8c4b8d6
mov dword [rbp - 0x39], 0xb8fcb8d0
mov dword [rbp - 0x35], 0xb8c7b8cb
mov dword [rbp - 0x31], 0xb8c2b8cc
mov dword [rbp - 0x2d], 0xb8ddb8cb
mov word [rbp - 0x29], bx
mov byte [rbp - 0x27], 1
nop dword [rax]
movd xmm1, dword [rdx - 4]
lea rax, [r15 - 4]
xorps xmm0, xmm0
lea rcx, [r15 - 2]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x10]
punpckldq xmm1, xmm0
movq xmm2, rax
punpcklqdq xmm2, xmm2
lea rax, [r15 - 1]
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rdx - 0x14], xmm1
movq xmm0, rax
movd xmm1, dword [rdx - 0x10]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rdx - 0x10], xmm1
add r15, 8
movd xmm1, dword [rdx - 0xc]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rdx - 0xc], xmm1
lea rax, [r15 - 4]
movd xmm1, dword [rdx - 8]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 8], xmm1
cmp rax, 0x20
jb 0x14001de00
mov byte [rbp - 0x27], bl
lea rdx, [rbp - 0x69]
jmp 0x14001da66
movdqa xmm3, xmmword [0x14003a7b0]
lea rdx, [rbp - 0x65]
movdqa xmm4, xmmword [0x14003a7c0]
mov dword [rbp - 0x69], 0xb8aab8d1
mov dword [rbp - 0x65], 0xb8adb8d1
mov dword [rbp - 0x61], 0xb8eeb8c8
mov dword [rbp - 0x5d], 0xb8fdb8f9
mov dword [rbp - 0x59], 0xb8f7b8f7
mov dword [rbp - 0x55], 0xb8e1b8b4
mov dword [rbp - 0x51], 0xb8b7b8f9
mov dword [rbp - 0x4d], 0xb8f0b8fe
mov dword [rbp - 0x49], 0xb8ffb8f4
mov dword [rbp - 0x45], 0xb8f9b8bc
mov dword [rbp - 0x41], 0xb8e9b8fb
mov dword [rbp - 0x3d], 0xb8c2b8c9
mov dword [rbp - 0x39], 0xb8fcb8c7
mov dword [rbp - 0x35], 0xb8c7b8cb
mov dword [rbp - 0x31], 0xb8c2b8cc
mov dword [rbp - 0x2d], 0xb8ddb8cb
mov word [rbp - 0x29], bx
mov byte [rbp - 0x27], 1
nop dword [rax]
movd xmm1, dword [rdx - 4]
lea rax, [r15 - 4]
xorps xmm0, xmm0
lea rcx, [r15 - 2]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x10]
punpckldq xmm1, xmm0
movq xmm2, rax
punpcklqdq xmm2, xmm2
lea rax, [r15 - 1]
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rdx - 0x14], xmm1
movq xmm0, rax
movd xmm1, dword [rdx - 0x10]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rdx - 0x10], xmm1
add r15, 8
movd xmm1, dword [rdx - 0xc]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rdx - 0xc], xmm1
lea rax, [r15 - 4]
movd xmm1, dword [rdx - 8]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 8], xmm1
cmp rax, 0x20
jb 0x14001df90
mov byte [rbp - 0x27], bl
lea rdx, [rbp - 0x69]
jmp 0x14001da66
test rdi, rdi
je 0x14001e0a6
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov r13, qword [rsp + 0x140]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14002dc20
add rsp, 0x100
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret