Function at 0x180001fac
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x34]
mov dword [r9], 0
xor edi, edi
mov ecx, 0x40
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x180002240
xor ebx, ebx
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rbp, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rsi, [rsp + 0x34]
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call rdi
mov edx, dword [rsp + 0x34]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rbp
mov rbx, rax
mov r8d, dword [rsp + 0x34]
mov ecx, 0x40
mov rdx, rax
mov r9, rsi
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x180001ffe
test eax, eax
js 0x180002224
test rbx, rbx
je 0x180002224
cmp qword [rbx], 0
je 0x180002229
mov rdi, rbx
add rdi, 0x10
xor esi, esi
xor r14d, r14d
lea rax, [rsi + rsi*4]
xor ebp, ebp
mov r15, r14
mov rcx, qword [rsp + 0x28]
cmp qword [rdi + rax*8 + 0x10], rcx
sete r12b
jne 0x180002082
mov r15, qword [rdi + rax*8]
mov r13, qword [rdi + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov bpl, r12b
shl ebp, 2
cmp r13, rax
cmove r14, r15
mov eax, 6
cmovne ebp, eax
cmp ebp, 6
je 0x1800020ad
test ebp, ebp
jne 0x1800020b4
inc esi
cmp qword [rbx], rsi
ja 0x180002065
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x180002240
lea rdx, [rsp + 0x60]
mov qword [rdx], 0
add r14, 8
mov r9d, 8
mov rcx, qword [rsp + 0x28]
mov r8, r14
call fcn.18000239f
xor edi, edi
test al, al
je 0x180002240
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x180002240
lea rdx, [rsp + 0x58]
mov qword [rdx], 0
add r8, 8
mov r9d, 8
mov rcx, qword [rsp + 0x28]
call fcn.18000239f
xor edi, edi
test al, al
je 0x180002240
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x180002240
lea rdx, [rsp + 0x38]
mov qword [rdx], 0
add r8, 0x28
mov r9d, 8
mov rcx, qword [rsp + 0x28]
call fcn.18000239f
xor edi, edi
test al, al
je 0x180002240
mov r8, qword [rsp + 0x38]
test r8, r8
je 0x180002240
xorps xmm0, xmm0
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
add r8, 0x58
mov r9d, 0x10
mov rcx, qword [rsp + 0x28]
call fcn.18000239f
xor edi, edi
test al, al
je 0x180002240
movzx eax, word [rsp + 0x40]
test ax, ax
je 0x180002240
movzx ebx, ax
mov ecx, ebx
and ecx, 0xfffffffe
add rcx, 2
call fcn.18000866c
mov rsi, rax
lea r8, [rbx + 2]
xor edi, edi
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
mov r9, rbx
call fcn.18000239f
test al, al
je 0x180002240
lea r8, [rsp + 0x40]
mov word [r8], 0
mov rdx, qword [rsp + 0x38]
add rdx, 0x58
mov r9d, 0x10
mov rcx, qword [rsp + 0x28]
call fcn.18000239f
test al, al
je 0x18000223e
mov rcx, rsi
call fcn.180008638
mov dil, 1
jmp 0x180002240
test rbx, rbx
je 0x18000223e
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x180002240
xor edi, edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret