Function at 0x14000354c
Capabilities:
Encode data using xor
Get disk size
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
xor edi, edi
mov r14d, 0x1f7047dd
mov r15b, 0x37
sub ecx, 1
je 0x1400035c9
sub ecx, 1
je 0x140003d9e
sub ecx, 1
je 0x1400035e8
sub ecx, 1
je 0x140003946
sub ecx, 1
je 0x140003b5f
sub ecx, 1
je 0x140003d0b
sub ecx, 1
je 0x140003ded
sub ecx, 1
je 0x140003dcf
cmp ecx, 1
je 0x140003e93
or eax, 0xffffffff
jmp 0x140003ea6
call fcn.140004930
mov ebx, 3
test eax, eax
je 0x1400035e1
lea edi, [rbx - 2]
mov ecx, ebx
call fcn.14000354c
mov ecx, ebx
call fcn.14000354c
movsd xmm0, qword [0x140223620]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x140223628]
mov dword [rsp + 0x28], eax
movzx eax, word [0x14022362c]
mov word [rsp + 0x2c], ax
cmp byte [0x14022362d], 0
je 0x14000364c
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xe
jl 0x14000361d
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
movsd xmm0, qword [str.AUQ__O]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x140223678]
mov word [rsp + 0x28], ax
mov al, byte [0x14022367a]
mov byte [rsp + 0x2a], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xb
jl 0x140003682
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
movsd xmm0, qword [str.AUZS]
movsd qword [rsp + 0x20], xmm0
mov al, byte [0x140223638]
mov byte [rsp + 0x28], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 9
jl 0x1400036db
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
movsd xmm0, qword [0x140223658]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [str.L92Bknphno]
mov dword [rsp + 0x28], eax
cmp byte [0x140223663], 0
je 0x14000376c
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xc
jl 0x14000373d
lea rax, [rsp + 0x20]
mov qword [rsp + 0x78], rax
movsd xmm0, qword [str.AU_nVL]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x140223648]
mov word [rsp + 0x28], ax
mov al, byte [0x14022364a]
mov byte [rsp + 0x2a], al
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xb
jl 0x1400037a2
lea rax, [rsp + 0x20]
mov qword [rbp - 0x80], rax
lea r12, [rsp + 0x60]
and dword [rbp + 0x1c0], 0
mov rax, qword [0x140232460]
mov r10, qword [rax + 0x70]
lea r9, [rbp + 0x1c0]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call r10
cmp eax, 0xc0000004
jne 0x14000392c
mov r8d, dword [rbp + 0x1c0]
mov r14d, r8d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test r8d, r8d
je 0x140003871
mov ecx, r8d
cmp r8, 0x1000
jb 0x140003840
call fcn.14000327c
jmp 0x140003845
call fcn.14003ecf4
mov rbx, rax
mov qword [rsp + 0x20], rax
lea rsi, [rax + r14]
mov qword [rsp + 0x30], rsi
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140067930
mov qword [rsp + 0x28], rsi
mov r8d, dword [rbp + 0x1c0]
jmp 0x140003876
mov rbx, qword [rsp + 0x20]
mov rax, qword [0x140232460]
mov r10, qword [rax + 0x70]
lea r9, [rbp + 0x1c0]
mov rdx, rbx
mov ecx, 0xb
call r10
test eax, eax
js 0x1400038f4
mov ecx, dword [rbp + 0x1c0]
movabs rax, 0xe38e38e38e38e38f
mul rcx
mov r15, rdx
shr r15, 8
xor r14d, r14d
test r15d, r15d
je 0x1400038f4
lea rcx, [r14 + r14*8]
shl rcx, 5
add rcx, 0x20
add rcx, rbx
mov edx, 0x5c
call fcn.140040f7c
test rax, rax
je 0x1400038ec
lea rcx, [rax + 1]
mov rdx, qword [r12]
call fcn.14004d198
test eax, eax
je 0x140003e14
inc r14d
cmp r14d, r15d
jb 0x1400038b9
test rbx, rbx
je 0x14000392c
sub rsi, rbx
cmp rsi, 0x1000
mov rax, rbx
jb 0x140003921
mov rbx, qword [rbx - 8]
sub rax, rbx
add rsi, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ec2
mov rdx, rsi
mov rcx, rbx
call fcn.14003ef78
add r12, 8
lea rax, [rbp - 0x78]
cmp r12, rax
jne 0x1400037df
mov r14d, 0x1f7047dd
mov r15b, 0x37
mov dword [rbp + 0x1c0], 0xc8
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor ebx, ebx
lea rcx, [rbp - 0x70]
call fcn.1400452e0
test rax, rax
je 0x140003990
movsx ecx, byte [rbp + rbx - 0x70]
call fcn.1400452a4
mov byte [rbp + rbx - 0x70], al
inc rbx
lea rcx, [rbp - 0x70]
call fcn.1400452e0
cmp rbx, rax
jb 0x140003971
mov rax, qword [str.dywyse_AZVBIXMKn2_0D]
mov qword [rbp + 0x1c8], rax
cmp byte [0x14022361f], 0
je 0x1400039e0
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x1400039b1
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
mov esi, 5
test rax, rax
je 0x140003a03
inc edi
mov ecx, esi
call fcn.14000354c
mov eax, dword [0x140223680]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223684]
mov word [rbp + 0x1cc], ax
mov al, byte [0x140223686]
mov byte [rbp + 0x1ce], al
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x140003a33
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003a80
inc edi
mov ecx, esi
call fcn.14000354c
mov eax, dword [0x140223610]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223614]
mov word [rbp + 0x1cc], ax
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 6
jl 0x140003aa4
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003af1
inc edi
mov ecx, esi
call fcn.14000354c
mov rax, qword [str.zyumznx_aqkoh_]
mov qword [rbp + 0x1c8], rax
cmp byte [0x14022360f], 0
je 0x140003b41
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003b12
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003b5f
inc edi
mov ecx, esi
call fcn.14000354c
mov r8d, 0x1f4
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp - 0x70]
call fcn.1400032c0
xor ebx, ebx
lea rcx, [rbp - 0x70]
call fcn.1400452e0
test rax, rax
je 0x140003ba9
movsx ecx, byte [rbp + rbx - 0x70]
call fcn.1400452a4
mov byte [rbp + rbx - 0x70], al
inc rbx
lea rcx, [rbp - 0x70]
call fcn.1400452e0
cmp rbx, rax
jb 0x140003b8a
mov rax, qword [str.kkxwkpx_AUTUNOX]
mov qword [rbp + 0x1c8], rax
cmp byte [0x140223657], 0
je 0x140003bf9
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003bca
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003c1a
inc edi
mov ecx, 6
call fcn.14000354c
mov eax, dword [0x140223664]
mov dword [rbp + 0x1c8], eax
movzx eax, word [0x140223668]
mov word [rbp + 0x1cc], ax
mov al, byte [0x14022366a]
mov byte [rbp + 0x1ce], al
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x140003c4a
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003c9a
inc edi
mov ecx, 6
call fcn.14000354c
mov rax, qword [str.dywyse_AZVBIXMKn2_0D]
mov qword [rbp + 0x1c8], rax
cmp byte [0x14022361f], 0
je 0x140003cea
xor r8d, r8d
lea r9, [rbp + 0x1c8]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140003cbb
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x70]
call fcn.140040d94
test rax, rax
je 0x140003d0b
inc edi
mov ecx, 6
call fcn.14000354c
mov eax, dword [0x14022367c]
mov dword [rbp + 0x1c0], eax
cmp byte [0x14022367f], 0
je 0x140003d59
xor r8d, r8d
lea r9, [rbp + 0x1c0]
mov eax, r14d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
mov al, r8b
sub al, cl
add al, r15b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 4
jl 0x140003d2a
xor r9d, r9d
lea r8, [rbp + 0x1c8]
xor edx, edx
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140003d9e
mov rax, qword [rbp + 0x1c8]
and rax, 0xffffffffc0000000
movabs rdx, 0xf00000000
cmp rax, rdx
ja 0x140003d9e
inc edi
mov ecx, 2
call fcn.14000354c
call fcn.140004996
mov rbx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140004996
mov edx, ebx
sub rax, rdx
cmp rax, 0x1c2
jbe 0x140003dcf
inc edi
mov ecx, 8
call fcn.14000354c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 4
jae 0x140003ded
inc edi
mov ecx, 7
call fcn.14000354c
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rsp + 0x28]
xorps xmm1, xmm1
test rcx, rcx
js 0x140003e5d
cvtsi2ss xmm1, rcx
jmp 0x140003e72
test rbx, rbx
je 0x140003e4c
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x140003e41
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ec2
mov rdx, rsi
mov rcx, rbx
call fcn.14003ef78
inc edi
mov ecx, 4
call fcn.14000354c
jmp 0x14000392c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mulss xmm1, dword [0x140223758]
movss xmm0, dword [0x14022375c]
comiss xmm0, xmm1
jbe 0x140003e93
inc edi
mov ecx, 9
call fcn.14000354c
call fcn.140004996
lea ecx, [rdi + 1]
cmp rax, 0xafe74
cmovae ecx, edi
mov eax, ecx
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140046484
int3