Function at 0x1401224f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x90
mov rsi, rcx
mov rax, qword [0x1403295b8]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x30]
lea rbx, [rsi - 0x40000000]
cmp rbx, rax
cmovbe rbx, rax
mov r15, qword [rsp + 0x38]
cmp rsi, 0x40000001
cmovb rbx, rax
lea rax, [rsi + 0x40000000]
cmp rax, r15
cmovb r15, rax
add r15, 0xfffffffffffff001
mov rax, qword [0x140335668]
mov rdi, rsi
test rax, rax
jne 0x140122578
jmp 0x14012259f
mov rax, qword [rax]
test rax, rax
je 0x14012259c
cmp rbx, rax
ja 0x140122570
cmp r15, rax
jbe 0x140122570
cmp qword [rax + 8], 0
je 0x140122570
mov rsi, qword [rax + 8]
mov rcx, qword [rsi]
mov qword [rax + 8], rcx
inc dword [rax + 0x10]
jmp 0x140122800
mov rdi, rsi
cmp rbx, rdi
ja 0x14012263d
mov r12d, dword [rsp + 0x50]
mov rax, rdi
shr rax, 0x20
je 0x1401225c0
mov rax, rdi
xor edx, edx
div r12
jmp 0x1401225c7
mov eax, edi
xor edx, edx
div r12d
add rdx, r12
sub rdi, rdx
cmp rdi, rbx
jb 0x14012263d
lea r14, [rsp + 0x58]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov r8d, Ordinal_50
mov rcx, rdi
mov rdx, r14
call r13
test rax, rax
je 0x14012263d
cmp dword [rsp + 0x78], 0x10000
je 0x140122610
mov rdi, qword [rsp + 0x60]
sub rdi, r12
jb 0x14012263d
cmp rdi, rbx
jae 0x1401225e0
jmp 0x14012263d
test rdi, rdi
je 0x14012263d
mov edx, 0x1000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14012259f
jmp 0x140122719
lea r12, [rsp + 0x58]
mov r13, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp r15, rsi
jb 0x1401227fe
mov edi, dword [rsp + 0x50]
mov rax, rsi
shr rax, 0x20
je 0x140122670
mov rax, rsi
xor edx, edx
div rdi
jmp 0x140122676
mov eax, esi
xor edx, edx
div edi
add rsi, rdi
sub rsi, rdx
cmp rsi, r15
ja 0x1401227fe
lea ebx, [rdi - 1]
jmp 0x1401226a4
mov rax, rsi
xor edx, edx
div rdi
sub rsi, rdx
cmp rsi, r15
ja 0x1401227fe
mov r8d, Ordinal_50
mov rcx, rsi
mov rdx, r12
call r13
test rax, rax
je 0x1401227fe
cmp dword [rsp + 0x78], 0x10000
je 0x1401226f0
mov rsi, qword [rsp + 0x58]
add rsi, rbx
add rsi, qword [rsp + 0x70]
mov rax, rsi
shr rax, 0x20
jne 0x140122690
mov eax, esi
xor edx, edx
div edi
jmp 0x140122698
test rsi, rsi
je 0x1401227fe
mov edx, 0x1000
mov rcx, rsi
mov r8d, 0x3000
mov r9d, 0x40
call r14
test rax, rax
je 0x140122650
lea rcx, [rax + 0x40]
mov qword [rax + 8], 0
mov dword [rax + 0x10], 0
xor edx, edx
xor ebx, ebx
lea rdi, [rax + rdx]
add rdi, 0x40
mov qword [rax + rdx + 0x40], rbx
mov qword [rax + 8], rdi
lea rbx, [rax + rdx + 0x80]
mov qword [rax + rdx + 0x80], rdi
mov qword [rax + 8], rbx
lea rdi, [rax + rdx + 0xc0]
mov qword [rax + rdx + 0xc0], rbx
mov qword [rax + 8], rdi
lea rbx, [rax + rdx + 0x100]
mov qword [rax + rdx + 0x100], rdi
mov qword [rax + 8], rbx
lea rdi, [rax + rdx + 0x140]
mov qword [rax + rdx + 0x140], rbx
mov qword [rax + 8], rdi
lea rsi, [rax + rdx + 0x180]
mov qword [rax + rdx + 0x180], rdi
mov qword [rax + 8], rsi
lea rbx, [rcx + 0x180]
lea rdi, [rax + rdx]
add rdi, 0x1c0
mov qword [rax + rdx + 0x1c0], rsi
mov qword [rax + 8], rdi
add rcx, 0x1c0
lea rdi, [rdx + 0x1c0]
add rdx, 0x200
cmp rdx, 0xfc1
mov rdx, rdi
jb 0x140122730
mov rcx, qword [0x140335668]
mov qword [rax], rcx
mov qword [0x140335668], rax
jmp 0x140122589
xor esi, esi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140141380
mov rax, rsi
add rsp, 0x90
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret