Function at 0x1400256a0
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
xor r15d, r15d
mov dword [rbp + 0x6f], r15d
mov ebx, r15d
lea r9, [rbp + 0x6f]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14002572b
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x6f]
mov r8d, dword [rbp + 0x6f]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x1400256e3
test eax, eax
js 0x140025a60
test rbx, rbx
je 0x140025a76
mov rsi, r15
mov edi, r15d
cmp qword [rbx], r15
jbe 0x1400257a2
mov rax, r15
nop word [rax + rax]
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp - 0x21], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x11], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp - 0x21]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x140025792
mov rax, qword [rbp - 0x11]
cmp rax, qword [0x1400c02b8]
je 0x14002579d
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x140025750
jmp 0x1400257a2
movq rsi, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rsi, rsi
je 0x140025a76
mov qword [rbp + 0x67], r15
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
mov eax, dword [rbx]
cmp dword [0x1400c6abc], eax
jle 0x140025812
lea rcx, [0x1400c6abc]
call fcn.14009f2b8
cmp dword [0x1400c6abc], 0xffffffff
jne 0x140025812
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140024190
mov qword [0x1400c6b68], rax
lea rcx, [0x1400c6abc]
call fcn.14009f24c
mov qword [rsp + 0x20], 8
lea r9, [rsi + 8]
lea r8, [rbp + 0x67]
mov rdx, qword [0x1400c6b68]
call fcn.1400276c0
mov rax, qword [rbp + 0x67]
test rax, rax
je 0x140025a76
mov qword [rbp + 0x77], r15
lea rdi, [rax + 8]
mov eax, dword [rbx]
cmp dword [0x1400c6abc], eax
jle 0x140025885
lea rcx, [0x1400c6abc]
call fcn.14009f2b8
cmp dword [0x1400c6abc], 0xffffffff
jne 0x140025885
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140024190
mov qword [0x1400c6b68], rax
lea rcx, [0x1400c6abc]
call fcn.14009f24c
mov qword [rsp + 0x20], 8
mov r9, rdi
lea r8, [rbp + 0x77]
mov rdx, qword [0x1400c6b68]
call fcn.1400276c0
mov rax, qword [rbp + 0x77]
test rax, rax
je 0x140025a76
mov qword [rbp + 0x7f], r15
lea rdi, [rax + 0x28]
mov eax, dword [rbx]
cmp dword [0x1400c6abc], eax
jle 0x1400258f7
lea rcx, [0x1400c6abc]
call fcn.14009f2b8
cmp dword [0x1400c6abc], 0xffffffff
jne 0x1400258f7
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140024190
mov qword [0x1400c6b68], rax
lea rcx, [0x1400c6abc]
call fcn.14009f24c
mov qword [rsp + 0x20], 8
mov r9, rdi
lea r8, [rbp + 0x7f]
mov rdx, qword [0x1400c6b68]
call fcn.1400276c0
mov rax, qword [rbp + 0x7f]
test rax, rax
je 0x140025a76
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
lea rdi, [rax + 0x58]
mov eax, dword [rbx]
cmp dword [0x1400c6abc], eax
jle 0x14002596c
lea rcx, [0x1400c6abc]
call fcn.14009f2b8
cmp dword [0x1400c6abc], 0xffffffff
jne 0x14002596c
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140024190
mov qword [0x1400c6b68], rax
lea rcx, [0x1400c6abc]
call fcn.14009f24c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recv
mov r9, rdi
lea r8, [rbp - 0x31]
mov rdx, qword [0x1400c6b68]
call fcn.1400276c0
movzx eax, word [rbp - 0x31]
test ax, ax
je 0x140025a76
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.14009f570
mov qword [rbp - 0x39], rax
movzx r8d, word [rbp - 0x31]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx esi, word [rbp - 0x31]
mov r14, qword [rbp - 0x29]
mov eax, dword [rbx]
cmp dword [0x1400c6abc], eax
jle 0x140025a18
lea rcx, [0x1400c6abc]
call fcn.14009f2b8
cmp dword [0x1400c6abc], 0xffffffff
jne 0x140025a18
xor r8d, r8d
lea rdx, str.RtlCopyMemory
call fcn.140024190
mov qword [0x1400c6b68], rax
lea rcx, [0x1400c6abc]
call fcn.14009f24c
mov qword [rsp + 0x20], rsi
mov r9, r14
lea r8, [rbp - 0x39]
mov rdx, qword [0x1400c6b68]
call fcn.1400276c0
cmp qword [rbp - 0x39], 0
je 0x140025a76
mov word [rbp - 0x31], r15w
mov r9d, 8
lea r8, [rbp - 0x31]
mov rdx, rdi
call fcn.140026cb0
mov al, 1
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rbx, rbx
je 0x140025a76
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret