Function at 0x140064800
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rsi, rcx
xor r15d, r15d
mov dword [rbp + 0x6f], r15d
mov ebx, r15d
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140064888
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x6f]
mov r8d, dword [rbp + 0x6f]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140064840
test eax, eax
js 0x140064ce9
test rbx, rbx
je 0x140064cff
mov r14, r15
mov edi, r15d
cmp qword [rbx], rdi
jbe 0x140064906
mov rax, r15
nop word [rax + rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp + 0xf], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp + 0x1f], xmm0
movsd xmm0, qword [rbx + rax*8 + 0x30]
movsd qword [rbp - 0x19], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp + 0xf]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x1400648f6
cmp qword [rbp + 0x1f], rsi
je 0x140064901
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x1400648b0
jmp 0x140064906
movq r14, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x140064cff
mov qword [rbp - 1], r15
add r14, 8
je 0x140064ccc
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
mov qword [rbp - 0x29], r14
lea rax, [rbp - 1]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], 8
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064ccc
mov rax, qword [rbp - 1]
test rax, rax
je 0x140064ccc
mov qword [rbp + 7], r15
add rax, 8
je 0x140064caf
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
mov qword [rbp - 0x29], rax
lea rax, [rbp + 7]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], 8
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064caf
mov rax, qword [rbp + 7]
test rax, rax
je 0x140064caf
mov qword [rbp + 0x7f], r15
add rax, 0x28
je 0x140064c92
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
mov qword [rbp - 0x29], rax
lea rax, [rbp + 0x7f]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], 8
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064c92
mov rax, qword [rbp + 0x7f]
test rax, rax
je 0x140064c92
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
add rax, 0x58
je 0x140064c75
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_recv
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064c75
movzx eax, word [rbp - 0x11]
test ax, ax
je 0x140064c75
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.14015d92c
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1401a34b0
mov qword [rbp + 0xf], rdi
movzx eax, word [rbp - 0x11]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x140064c48
test rax, rax
je 0x140064c48
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], rax
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064c48
mov word [rbp - 0x11], r15w
mov rax, qword [rbp + 0x7f]
add rax, 0x58
je 0x140064c3f
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x39], gethostname
lea rcx, [rbp - 0x11]
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_recv
mov dword [rbp + 0x77], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x77]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp - 0x39]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140064c3f
lea rdx, str.___MmUnloadedDrivers_Cleaned:
lea rcx, [0x140662140]
call fcn.1400688a0
mov rbx, rax
mov rdx, rdi
mov rcx, rax
call fcn.1400688a0
mov rcx, rbx
call fcn.140068b60
mov bl, 1
jmp 0x140064c65
lea rdx, str.____Failed_to_write_driver_name_length
jmp 0x140064c4f
lea rdx, str.____Failed_to_read_driver_name
lea rcx, [0x140662140]
call fcn.1400688a0
mov rcx, rax
call fcn.140068b60
xor bl, bl
mov rcx, rdi
call fcn.14015d5e8
movzx eax, bl
jmp 0x140064d01
lea rdx, str.____Failed_to_find_driver_name
lea rcx, [0x140662140]
call fcn.1400688a0
mov rcx, rax
call fcn.140068b60
jmp 0x140064cff
lea rdx, str.____Failed_to_find_driver_section
lea rcx, [0x140662140]
call fcn.1400688a0
mov rcx, rax
call fcn.140068b60
jmp 0x140064cff
lea rdx, str.____Failed_to_find_driver_object
lea rcx, [0x140662140]
call fcn.1400688a0
mov rcx, rax
call fcn.140068b60
jmp 0x140064cff
lea rdx, str.____Failed_to_find_device_object
lea rcx, [0x140662140]
call fcn.1400688a0
mov rcx, rax
call fcn.140068b60
jmp 0x140064cff
test rbx, rbx
je 0x140064cff
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret