Function at 0x14003bf10
Capabilities:
Allocate or change rwx memory
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
sub rsp, 0x190
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400b3100]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rsi, rcx
xor r15d, r15d
mov dword [rbp], r15d
mov ebx, r15d
lea r9, [rbp]
xor r8d, r8d
xor edx, edx
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14003bfbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp]
mov r8d, dword [rbp]
mov rdx, rax
mov ecx, 0x40
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14003bf75
test eax, eax
js 0x14003c93e
test rbx, rbx
je 0x14003c954
mov r14, r15
mov edi, r15d
cmp qword [rbx], rdi
jbe 0x14003c02e
mov rax, r15
nop dword [rax]
lea rax, [rax + rax*4]
movups xmm6, xmmword [rbx + rax*8 + 0x10]
movups xmm7, xmmword [rbx + rax*8 + 0x20]
movsd xmm0, qword [rbx + rax*8 + 0x30]
movsd qword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14003c01e
movq rax, xmm7
cmp rax, rsi
je 0x14003c029
inc edi
mov eax, edi
cmp rax, qword [rbx]
jb 0x14003bfe0
jmp 0x14003c02e
movq r14, xmm6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r14, r14
je 0x14003c954
mov qword [rbp + 0x88], r15
lea r8, [r14 + 8]
mov r9d, 8
lea rdx, [rbp + 0x88]
mov rcx, rsi
call fcn.14003ac90
test al, al
je 0x14003c8c1
mov r8, qword [rbp + 0x88]
test r8, r8
je 0x14003c8c1
mov qword [rbp + 0x90], r15
add r8, 8
mov r9d, 8
lea rdx, [rbp + 0x90]
mov rcx, rsi
call fcn.14003ac90
test al, al
je 0x14003c80a
mov r8, qword [rbp + 0x90]
test r8, r8
je 0x14003c80a
mov qword [rbp + 0x80], r15
add r8, 0x28
mov r9d, 8
lea rdx, [rbp + 0x80]
mov rcx, rsi
call fcn.14003ac90
test al, al
je 0x14003c753
mov r8, qword [rbp + 0x80]
test r8, r8
je 0x14003c753
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
add r8, 0x58
mov r9d, 0x10
lea rdx, [rbp + 8]
mov rcx, rsi
call fcn.14003ac90
test al, al
je 0x14003c5a9
movzx eax, word [rbp + 8]
test ax, ax
je 0x14003c5a9
mov ecx, eax
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovb rbx, rax
mov rcx, rbx
call fcn.140058b94
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.140085510
mov qword [rbp + 0x98], rdi
movzx r9d, word [rbp + 8]
mov r8, qword [rbp + 0x10]
mov rdx, rdi
mov rcx, rsi
call fcn.14003ac90
test al, al
jne 0x14003c311
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x8860024409e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x499590ff0f06e7cf
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95c465864812f9b5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26d156ff424b0caa
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x48], rax
movabs rax, 0xd53283a08030125c
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
movabs rcx, 0xb204537318ddc612
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x58], rax
movabs rax, 0x9c3c55bc88c875c3
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa0], rax
movabs rax, 0x1756a5bdc996cf34
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8805023609c59e8d
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb0], rax
movabs rax, 0x49f190df0f62e7ae
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb8], rax
movabs rax, 0x95a165f0487bf9c7
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc0], rax
movabs rax, 0x26b05691426b0cd8
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc8], rax
movabs rax, 0xd53283aa80551231
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
lea rdx, [rbp + 0x20]
jmp 0x14003c583
mov word [rbp + 8], r15w
mov rax, qword [rbp + 0x80]
add rax, 0x58
je 0x14003c382
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x20], 0x33
lea rcx, [rbp + 8]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 0x10
mov dword [rbp + 0x18], r15d
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x18]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, 0x28
lea r8, [rbp + 0x20]
mov edx, 0x80862007
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14003c382
mov bl, 1
jmp 0x14003c599
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x8877024109e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x49d190ba0f16e7c7
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95d765994809f9a3
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26de56b142190cbd
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x48], rax
movabs rax, 0xd51283cf80381250
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
movabs rax, 0xb263531d18b8c67e
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x58], rax
movabs rax, 0x3fc86beed6e02a5f
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x60], rax
movabs rdx, 0xf9b24b85f2a042fc
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x68], rax
movabs rax, 0x9c3c55bc88c875c3
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa0], rax
movabs rax, 0x1756a5bdc996cf34
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8805023609c59e8d
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb0], rax
movabs rax, 0x49f190df0f62e7ae
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb8], rax
movabs rax, 0x95a165f0487bf9c7
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc0], rax
movabs rax, 0x26b05691426b0cd8
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc8], rax
movabs rax, 0xd53283aa80551231
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd0], rax
movabs rcx, 0xb204537318ddc612
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd8], rax
movabs rax, 0x3fc86be4d6882a2b
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xe8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa xmm0, xmmword [rbp + 0x60]
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [0x1400b4830]
vmovdqa ymmword [rbp + 0x40], ymm1
vzeroupper
call fcn.140046970
xor bl, bl
mov rcx, rdi
call fcn.1400587f0
movzx eax, bl
jmp 0x14003c956
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x886c025009e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x499590ff0f06e7c0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95c465864812f9b5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26d156ff424b0caa
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x48], rax
movabs rax, 0xd53283a08030125c
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
movabs rcx, 0xb204537318ddc612
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x58], rax
movabs rax, 0x9c3c55bc88c875c3
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa0], rax
movabs rax, 0x1756a5bdc996cf34
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xa8], rax
movabs rax, 0x8805023609c59e8d
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb0], rax
movabs rax, 0x49f190df0f62e7ae
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xb8], rax
movabs rax, 0x95a165f0487bf9c7
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc0], rax
movabs rax, 0x26b05691426b0cd8
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xc8], rax
movabs rax, 0xd53283aa80551231
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0x18], rcx
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rdx, [rbp + 0x20]
lea rcx, [0x1400b4830]
vzeroupper
call fcn.140046970
jmp 0x14003c954
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x886c025009e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x499590ff0f06e7c0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95c465864812f9b5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26d556e242340caa
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x48], rax
movabs rax, 0xd55d83c380211252
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
movabs rax, 0xb204537318d7c67c
mov qword [rbp + 0x18], rax
movabs rcx, 0xb204537318ddc612
jmp 0x14003c651
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x886c025009e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x499590ff0f06e7c0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95c465864812f9b5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26d256fe42340caa
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x48], rax
movabs rax, 0xd54683c98030125b
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x50], rax
movabs rax, 0xb204537318ddc618
mov qword [rbp + 0x18], rax
movabs rcx, 0xb204537318ddc612
jmp 0x14003c651
movabs rax, 0x9c5055d588a975a5
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
movabs rax, 0x1722a59dc9f2cf51
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x28], rax
movabs rax, 0x886c025009e59ee2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x30], rax
movabs rax, 0x499590ff0f06e7c0
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x38], rax
movabs rax, 0x95c26599480df9a2
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x40], rax
movabs rax, 0x26d256fe42340cbd
jmp 0x14003c882
test rbx, rbx
je 0x14003c954
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140058530
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret