Function at 0x14001fa40
Capabilities:
Get system information on windows
Hash data using djb2
Make suspicious ntquerysysteminformation call
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x14009b040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x39], rdx
xor eax, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
xor edi, edi
mov dword [rbp - 0x31], eax
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x31]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rbp - 0x31]
mov r8d, dword [rbp - 0x31]
mov rdx, rax
mov ecx, ntohs
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001fa90
test eax, eax
js 0x14001fbea
xor ecx, ecx
mov ebx, ecx
cmp dword [rdi], ecx
jbe 0x14001fbea
lea r14, [rdi + 0x2e]
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
movsxd rax, ebx
imul r12, rax, 0x128
movzx edx, word [r14]
add rdx, 0x30
add rdx, r12
add rdx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rcx
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14001fb30
lea rcx, [rbp - 0x29]
call fcn.140002e60
nop
lea rax, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rax, qword [rbp - 0x29]
mov edx, 0x1505
mov r8, qword [rbp - 0x19]
add r8, rax
cmp rax, r8
je 0x14001fb83
nop dword [rax]
nop word [rax + rax]
imul rdx, rdx, 0x21
movsx rcx, byte [rax]
add rdx, rcx
inc rax
cmp rax, r8
jne 0x14001fb70
cmp rdx, qword [r13]
je 0x14001fc5d
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14001fbc8
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fbc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001fc56
call fcn.1400728d4
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], cl
inc ebx
add r14, 0x128
cmp ebx, dword [rdi]
jb 0x14001fb00
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0
xor r8d, r8d
lea rdx, [0x14007b033]
mov rcx, r15
call fcn.140002e60
mov dword [rsp + 0x30], 1
mov rax, r15
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140072440
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r13, [r12 + rdi]
lea rdx, [r13 + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
xor r12d, r12d
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], r12
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x14001fc80
lea rcx, [rbp - 9]
call fcn.140002e60
nop
lea r14, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova r14, qword [rbp - 9]
mov rax, qword [rbp + 7]
cmp rax, 0xc
jb 0x14001fcff
lea r12, [rax + r14]
lea r8, [r12 - 0xb]
sub r8, r14
mov rcx, r14
mov edx, 0x5c
call sub.VCRUNTIME140.dll_memchr
test rax, rax
mov rbx, rax
je 0x14001fcfc
movabs rax, 0x526d65747379535c
cmp qword [rbx], rax
jne 0x14001fce4
cmp dword [rbx + 8], 0x5c746f6f
je 0x14001fcf4
inc rbx
lea r8, [r12 - 0xb]
sub r8, rbx
mov rcx, rbx
jmp 0x14001fcba
sub rbx, r14
xor r12d, r12d
jmp 0x14001fd02
xor r12d, r12d
mov rbx, rsi
cmp rbx, 0xffffffffffffffff
je 0x14001fe6a
lea rcx, str.SYSTEMROOT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001fd30
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140002e60
nop
mov r8d, 1
lea rdx, [0x14007c248]
lea rcx, [rbp - 0x59]
call fcn.14000ec20
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x69], xmm0
movups xmm1, xmmword [rax]
movups xmmword [rbp - 0x79], xmm1
movups xmm2, xmmword [rax + 0x10]
movdqu xmmword [rbp - 0x69], xmm2
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov esi, dword [rsp + 0x34]
or esi, 2
mov dword [rsp + 0x30], esi
lea r9, [rbp - 0x79]
movq rcx, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova r9, rcx
movq qword [rsp + 0x20], xmm2
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.14001ffe0
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x14001fe08
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fe03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fe03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400728d4
movdqa xmm0, xmmword [0x1400898c0]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x14001fe5f
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fe52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fe52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400728d4
movdqa xmm0, xmmword [0x1400898c0]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
jmp 0x14001fe6e
mov esi, dword [rsp + 0x34]
mov rax, qword [r13 + 0x18]
mov rcx, qword [rsp + 0x38]
mov qword [rcx + 0x30], rax
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
movups xmm0, xmmword [rbp - 9]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [r15 + 0x10], xmm1
mov qword [rbp + 7], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
or esi, 1
mov dword [rsp + 0x30], esi
mov qword [rbp + 7], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rbp - 9], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14001ff02
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fefd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001fefd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400728d4
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x29], 0
jmp 0x14001fc2c