Function at 0x14005e680
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xb8
xor eax, eax
lea rcx, [rbp - 0x41]
mov r15d, eax
mov dword [rbp - 0x61], eax
mov edi, eax
mov qword [rbp + 0x57], rax
mov qword [rbp - 0x51], rax
mov r14d, eax
mov qword [rbp - 0x59], rax
mov ebx, eax
mov qword [rbp - 0x41], rax
mov rsi, r9
mov r12, r8
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14005e717
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r13d, r13d
test eax, eax
jne 0x14005e6f5
mov r12d, 0x80004005
jmp 0x14005e706
movzx r12d, ax
or r12d, 0x80070000
test eax, eax
cmovle r12d, eax
mov ecx, r12d
call fcn.14007ac40
mov rsi, qword [rbp + 0x5f]
jmp 0x14005ea48
test r13, r13
jne 0x14005e747
mov esi, 0x80070057
lea rdx, [0x14045ab9c]
lea rcx, [0x14042d3ac]
mov r12d, esi
call fcn.1400f4dac
mov ecx, esi
call fcn.14007ac40
mov rsi, qword [rbp + 0x5f]
jmp 0x14005ea48
xor r13d, r13d
test r12, r12
jne 0x14005e76e
lea rdx, [0x14045a140]
lea rcx, [0x140437f4c]
call fcn.1400f3318
mov esi, 0x80070057
mov r12d, esi
mov ecx, esi
jmp 0x14005e709
test rsi, rsi
je 0x14005e762
lea rdx, [0x14045a628]
lea rcx, [0x14043636c]
call fcn.1400f470c
cmp qword [rbp + 0x77], r13
jne 0x14005e7b3
mov esi, 0x80070057
mov ecx, esi
mov r12d, esi
call fcn.14007ac40
lea rdx, [0x1404537c0]
lea rcx, [0x14043043c]
call fcn.1400f406c
jmp 0x14005e70e
cmp qword [rbp + 0x7f], r13
je 0x14005e762
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
jne 0x14005e7d4
mov rbx, r13
jmp 0x14005e7d9
test rbx, rbx
jne 0x14005e7e4
mov r12d, 0x8007000e
jmp 0x14005e706
mov rsi, qword [rbp + 0x5f]
lea rdx, [rbp + 0x57]
mov rcx, rsi
call fcn.14004df1c
mov r12d, eax
test eax, eax
jns 0x14005e807
mov ecx, eax
call fcn.14007ac40
jmp 0x14005ea44
mov r15, qword [0x14045c980]
xor r12d, r12d
test r15, r15
je 0x14005ea33
lea rdi, [r15 + 8]
lea rdx, [0x1404523cc]
mov qword [rbp - 0x69], rdi
lea rcx, [0x140434f70]
call fcn.1400f4a64
lea rdx, [0x14045b49c]
mov dword [rbp - 0x61], r12d
lea rcx, [0x140436fec]
call fcn.1400f3d14
test rdi, rdi
je 0x14005e869
mov r12d, 1
mov rcx, rdi
mov edx, r12d
mov dword [rbp - 0x61], r12d
call fcn.140073644
xor r12d, r12d
mov rdi, qword [rbp + 0x57]
lea r8, [rbp + 0x57]
mov rcx, rdi
lea rdx, str.Volume:GVLK
call fcn.1400f1000
lea rdx, [0x14045600c]
mov esi, eax
lea rcx, [0x14043bd7c]
call fcn.1400f50f4
test esi, esi
jns 0x14005e8af
mov ecx, 0xc004f306
mov r12d, ecx
call fcn.14007ac40
mov r15, qword [rbp - 0x69]
jmp 0x14005e70e
cmp dword [rbp + 0x57], r12d
jne 0x14005e8d2
lea r8, [rbp + 0x57]
mov rcx, rdi
lea rdx, str.Volume:CSVLK
call fcn.1400f1000
test eax, eax
js 0x14005e899
cmp dword [rbp + 0x57], r12d
je 0x14005e899
mov rsi, qword [rbp + 0x5f]
lea r9, [rbp - 0x51]
mov rdx, rsi
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rcx, r15
call fcn.1400e24f8
mov r12d, eax
xor eax, eax
test r12d, r12d
jns 0x14005e91b
mov ecx, r12d
call fcn.14007ac40
lea rdx, [0x140458be4]
lea rcx, [0x14042b518]
call fcn.1400f39c8
mov r15, qword [rbp - 0x69]
jmp 0x14005ea48
mov r15, qword [rbp - 0x51]
lea r8, [rbp + 0x57]
xor edx, edx
mov qword [rbp + 0x57], rax
lea rcx, [0x1403dd7f0]
call fcn.1400fbd7c
mov rsi, qword [rbp + 0x57]
mov r12d, eax
test eax, eax
jns 0x14005e949
mov ecx, eax
call fcn.14007ac40
jmp 0x14005e96e
lea r9, [rbp + 0x57]
mov rdx, rsi
lea r8, [rbp - 0x59]
mov rcx, r15
call fcn.14006f1a8
mov r12d, eax
test eax, eax
jns 0x14005e96a
mov ecx, eax
call fcn.14007ac40
mov r14, qword [rbp - 0x59]
mov ecx, r12d
call fcn.14007ace8
test rsi, rsi
je 0x14005e996
mov rax, qword [rsi]
mov r15, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, r15
call rax
mov rax, r15
mov rcx, rsi
call rax
test r12d, r12d
jns 0x14005e9a3
mov ecx, r12d
jmp 0x14005e8a1
mov esi, dword [rbp + 0x57]
lea rax, [0x140035ddc]
xor r9d, r9d
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x15], r14
lea rdx, [rbp - 0x31]
mov dword [rbp - 0x19], esi
mov ecx, 0xb9
mov qword [rbp - 0x31], 3
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x21], rax
mov dword [rbp - 0xd], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rbp - 9], rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov r12d, dword [rbp - 0x49]
test r12d, r12d
js 0x14005e99b
mov rcx, qword [rbp + 0x6f]
lea rdx, [0x14045b95c]
mov rax, r14
mov r14, r13
mov qword [rcx], rax
lea rcx, [0x1404416a0]
call fcn.1400f43c0
mov rax, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x7f]
mov dword [rax], esi
mov rax, rbx
mov qword [rcx], rax
mov rbx, r13
mov rax, qword [rbp + 0x77]
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x14005e8a6
mov r12d, 0x8000ffff
mov ecx, r12d
call fcn.14007ac40
mov r15, r13
mov rdi, qword [rbp + 0x57]
cmp dword [0x140451890], 5
jbe 0x14005eac4
movabs rdx, 0x400000000000
test qword [0x1404518a0], rdx
je 0x14005eac4
mov rax, qword [0x1404518a8]
and rax, rdx
cmp rax, qword [0x1404518a8]
jne 0x14005eac4
mov rcx, qword [rbp - 0x41]
call fcn.140079a88
mov qword [rbp - 0x59], rax
lea rdx, [0x140444bd6]
lea rax, [rbp - 0x59]
mov dword [rbp + 0x57], r12d
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x57]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x39], 0x1000000
call fcn.140001008
mov ecx, r12d
call fcn.14007ace8
test rbx, rbx
je 0x14005eada
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x1404593bc]
lea rcx, [0x14043ea38]
call fcn.1400f406c
test r14, r14
je 0x14005eafb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x1404566c4]
lea rcx, [0x140432d38]
call fcn.1400f3670
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x14005eb36
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
mov qword [rbp - 0x51], r13
test rdi, rdi
je 0x14005eb44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x14005eb57
cmp dword [rbp - 0x61], r13d
je 0x14005eb57
mov rcx, r15
call fcn.1400734c0
mov eax, r12d
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret