Function at 0x1405b5628
Capabilities:
Get system information on windows
Load ntoskrnl
Make suspicious ntquerysysteminformation call
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1406df080]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r13d, 4
mov rax, qword gs:[0x58]
mov rsi, qword [rax]
mov eax, dword [rsi + r13]
cmp dword [0x1406e0910], eax
jle 0x1405b57d3
lea rcx, [0x1406e0910]
call fcn.140668208
cmp dword [0x1406e0910], 0xffffffff
jne 0x1405b57d3
xor ebx, ebx
and dword [rbp - 0x39], ebx
lea r9, [rbp - 0x39]
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, 0xc0000004
jmp 0x1405b56ed
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x39]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp - 0x39]
mov r8d, dword [rbp - 0x39]
mov rdx, rax
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, r14d
je 0x1405b56b1
test eax, eax
js 0x1405b57ad
xor edi, edi
cmp dword [rbx], edi
jbe 0x1405b57ad
mov eax, edi
imul r14, rax, 0x128
movzx edx, word [r14 + rbx + 0x2e]
add rdx, 0x30
add rdx, r14
add rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
and qword [rbp - 0x21], 0
and qword [rbp - 0x19], 0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1405b5732
lea rcx, [rbp - 0x31]
call fcn.1405bbfdc
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
lea rdx, [0x14067ba98]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1405b599e
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1405b57a3
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1405b579e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1405b59ea
call fcn.140668354
inc edi
cmp edi, dword [rbx]
jb 0x1405b5704
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
mov qword [0x1406e07f8], rdi
lea rcx, [0x1406e0910]
call fcn.1406681a8
movups xmm0, xmmword [0x14067bae8]
movups xmmword [rbp + 0x1f], xmm0
movsd xmm0, qword [0x14067baf8]
movsd qword [rbp + 0x2f], xmm0
mov al, byte [0x14067bb00]
mov byte [rbp + 0x37], al
movups xmm0, xmmword [str.xxxxxx____xx________xxxx]
movups xmmword [rbp - 0x31], xmm0
movsd xmm0, qword [0x14067bb18]
movsd qword [rbp - 0x21], xmm0
mov al, byte [0x14067bb20]
mov byte [rbp - 0x19], al
mov eax, dword [rsi + r13]
cmp dword [0x1406e08b8], eax
jle 0x1405b585c
lea rcx, [0x1406e08b8]
call fcn.140668208
cmp dword [0x1406e08b8], 0xffffffff
jne 0x1405b585c
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14067ba98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1406e0810], rax
lea rcx, [0x1406e08b8]
call fcn.1406681a8
mov eax, dword [rsi + r13]
cmp dword [0x1406e08c8], eax
jle 0x1405b5897
lea rcx, [0x1406e08c8]
call fcn.140668208
cmp dword [0x1406e08c8], 0xffffffff
jne 0x1405b5897
mov rax, qword [0x1406e0810]
mov qword [0x1406e08e0], rax
lea rcx, [0x1406e08c8]
call fcn.1406681a8
mov ecx, 0x5a4d
mov rax, qword [0x1406e08e0]
cmp word [rax], cx
jne 0x1405b5a08
mov eax, dword [rsi + r13]
cmp dword [0x1406e08f4], eax
jle 0x1405b58f2
lea rcx, [0x1406e08f4]
call fcn.140668208
cmp dword [0x1406e08f4], 0xffffffff
jne 0x1405b58f2
mov rax, qword [0x1406e08e0]
movsxd rdx, dword [rax + 0x3c]
add rdx, qword [0x1406e0810]
mov qword [0x1406e0818], rdx
lea rcx, [0x1406e08f4]
call fcn.1406681a8
mov rax, qword [0x1406e0818]
cmp dword [rax], 0x4550
jne 0x1405b5a08
mov rbx, qword [0x1406e0810]
mov r8d, dword [rax + 0x50]
xor eax, eax
and word [rbp + rax*2 - 0x11], 0
inc rax
cmp rax, 0x18
jb 0x1405b5912
xor edx, edx
mov al, byte [rbp + rdx + 0x1f]
mov cl, byte [rbp + rdx - 0x31]
mov byte [rbp + rdx*2 - 0x11], al
mov byte [rbp + rdx*2 - 0x10], cl
inc rdx
cmp rdx, 0x18
jb 0x1405b5923
lea r10, [rbx + r8]
mov rax, r10
cmp r8, 0x18
jb 0x1405b5983
lea rdi, [r10 - 0x18]
mov r8, rbx
mov r11, r8
lea r9, [rbp - 0x11]
movzx ecx, word [r9]
movzx edx, cx
shr dx, 8
cmp dl, 0x3f
je 0x1405b5970
cmp byte [r11], cl
jne 0x1405b59fb
inc r11
add r9, 2
lea rcx, [rbp + 0x1f]
cmp r9, rcx
jne 0x1405b5957
mov rax, r8
xor ecx, ecx
cmp rax, r10
cmovne rcx, rax
mov eax, ecx
sub eax, ebx
test rcx, rcx
je 0x1405b5a08
add rax, qword [0x1406e07f8]
jmp 0x1405b5a0a
mov rdi, qword [r14 + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1405b57c0
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1405b59f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1405b59f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140668354
jmp 0x1405b57c0
cmp r8, rdi
je 0x1405b5983
inc r8
jmp 0x1405b5950
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140668060
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret