Function at 0x1400bba30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rdi
sub rsp, 0x40
movsx eax, byte [0x140141098]
mov eax, eax
imul rax, rax, 0x30
xor r9d, r9d
mov r8d, eax
mov rdx, qword [0x140140420]
mov ecx, 8
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rax, [0x140140720]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
jmp 0x1400bba8a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsx eax, byte [0x140141098]
cmp dword [rsp + 0x20], eax
jae 0x1400bbdbb
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x30
mov rcx, qword [0x140140420]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx]
mov rax, qword [rax + 8]
sub rax, rcx
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx + 8]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x18]
mov rcx, qword [0x140140738]
add rcx, rax
mov rax, rcx
mov qword [0x140140738], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov rcx, qword [0x140140720]
add rcx, rax
mov rax, rcx
mov qword [0x140140720], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x28]
mov ecx, dword [0x140140748]
add ecx, eax
mov eax, ecx
mov dword [0x140140748], eax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
mov rcx, qword [0x140140740]
add rcx, rax
mov rax, rcx
mov qword [0x140140740], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov rcx, qword [0x140140728]
add rcx, rax
mov rax, rcx
mov qword [0x140140728], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov rcx, qword [0x140140730]
add rcx, rax
mov rax, rcx
mov qword [0x140140730], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x28]
mov rdx, qword [0x140140710]
mov rax, qword [rdx + rax]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x10
mov rdx, qword [0x140140710]
mov qword [rdx + rcx + 8], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [0x140140710]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 8]
mov qword [rcx + rax], rdx
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x28]
mov rdx, qword [0x1401403d0]
mov rax, qword [rdx + rax]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x10
mov rdx, qword [0x1401403d0]
mov qword [rdx + rcx + 8], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [0x1401403d0]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + 0x10]
mov qword [rcx + rax], rdx
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x28]
mov rdx, qword [0x140140418]
mov rax, qword [rdx + rax]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x10
mov rdx, qword [0x140140418]
mov qword [rdx + rcx + 8], rax
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [0x140140418]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
mov qword [rcx + rax], rdx
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x1400bbdb6
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x10
mov rdx, qword [0x140140710]
mov rax, qword [rdx + rax + 8]
mov rdx, qword [0x1401403d0]
add rax, qword [rdx + rcx + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x10
mov rdx, qword [0x140140418]
add rax, qword [rdx + rcx + 8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400bbd90
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [0x140140710]
mov rax, qword [rcx + rax + 8]
cvtsi2ss xmm0, rax
test rax, rax
jge 0x1400bbd12
addss xmm0, dword [0x140125160]
mov rax, qword [rsp + 0x30]
cvtsi2ss xmm1, rax
test rax, rax
jge 0x1400bbd29
addss xmm1, dword [0x140125160]
divss xmm0, xmm1
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x140140428]
movss dword [rcx + rax*4], xmm0
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x10
mov rcx, qword [0x1401403d0]
mov rax, qword [rcx + rax + 8]
cvtsi2ss xmm0, rax
test rax, rax
jge 0x1400bbd63
addss xmm0, dword [0x140125160]
mov rax, qword [rsp + 0x30]
cvtsi2ss xmm1, rax
test rax, rax
jge 0x1400bbd7a
addss xmm1, dword [0x140125160]
divss xmm0, xmm1
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x1401405a0]
movss dword [rcx + rax*4], xmm0
jmp 0x1400bbdb6
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x140140428]
xorps xmm0, xmm0
movss dword [rcx + rax*4], xmm0
mov eax, dword [rsp + 0x20]
mov rcx, qword [0x1401405a0]
xorps xmm0, xmm0
movss dword [rcx + rax*4], xmm0
jmp 0x1400bba80
mov rax, qword [0x140140400]
mov rcx, qword [0x140140728]
sub rcx, rax
mov rax, rcx
mov qword [0x140140408], rax
mov rax, qword [0x140140728]
mov qword [0x140140400], rax
mov rax, qword [0x140140590]
mov rcx, qword [0x140140730]
sub rcx, rax
mov rax, rcx
mov qword [0x140140598], rax
mov rax, qword [0x140140730]
mov qword [0x140140590], rax
mov rax, qword [0x1401403c0]
mov rcx, qword [0x140140720]
sub rcx, rax
mov rax, rcx
mov qword [0x1401403c8], rax
mov rax, qword [0x140140720]
mov qword [0x1401403c0], rax
mov rax, qword [0x140140598]
mov rcx, qword [0x140140408]
add rcx, rax
mov rax, rcx
add rax, qword [0x1401403c8]
mov qword [rsp + 0x30], rax
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x1400bbefb
cmp qword [rsp + 0x30], 0
je 0x1400bbee5
mov rax, qword [0x140140408]
cvtsi2ss xmm0, rax
test rax, rax
jge 0x1400bbe84
addss xmm0, dword [0x140125160]
mov rax, qword [rsp + 0x30]
cvtsi2ss xmm1, rax
test rax, rax
jge 0x1400bbe9b
addss xmm1, dword [0x140125160]
divss xmm0, xmm1
movss dword [0x1401409b8], xmm0
mov rax, qword [0x140140598]
cvtsi2ss xmm0, rax
test rax, rax
jge 0x1400bbec0
addss xmm0, dword [0x140125160]
mov rax, qword [rsp + 0x30]
cvtsi2ss xmm1, rax
test rax, rax
jge 0x1400bbed7
addss xmm1, dword [0x140125160]
divss xmm0, xmm1
movss dword [0x1401409f8], xmm0
jmp 0x1400bbefb
xorps xmm0, xmm0
movss dword [0x1401409b8], xmm0
xorps xmm0, xmm0
movss dword [0x1401409f8], xmm0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
add rsp, 0x40
pop rdi
ret