Function at 0x14000d6e8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
xor r15d, r15d
mov r13d, r9d
mov r12d, edx
mov r14d, ecx
mov esi, r15d
cmp ecx, 0x34
jb 0x14000d733
mov r8d, ecx
lea rdx, str.___Pprovider_with_id__lu_is_not_supported__will_be_using_default_provider__0__r_n
lea ecx, [r15 + 2]
call fcn.140011090
mov r14d, r15d
xor eax, eax
mov dword [rbp + 0x5f], r15d
lea rdi, [rbp - 0x51]
lea r9, [rbp + 0x5f]
lea rdx, [rbp - 0x51]
lea r8d, [rax + 0x70]
mov ecx, r8d
rep stosb byte [rdi], al
lea ecx, [r8 + 0x2f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000d7a3
mov r8d, 0xc
lea rdx, [rbp - 0x4d]
lea rcx, str.Microsoft_Hv
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0xc
jne 0x14000d78a
lea rdx, str.___MSFT_hypervisor_present_r_n
lea ecx, [rax - 0xa]
call fcn.140011090
jmp 0x14000d809
movsd xmm0, qword [rbp - 0x4d]
lea rdi, [rsp + 0x30]
xor eax, eax
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov eax, dword [rbp - 0x45]
mov dword [rbp - 0x79], eax
jmp 0x14000d7ed
or eax, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov eax, 1
cpuid
sar ecx, 0x1f
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
test cl, 1
je 0x14000d809
xor ecx, ecx
lea rdi, [rsp + 0x30]
mov eax, 0x40000000
cpuid
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor eax, eax
mov dword [rsp + 0x24], ebx
movsd xmm0, qword [rsp + 0x24]
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov dword [rbp - 0x79], edx
lea r8, [rsp + 0x30]
movsd qword [rsp + 0x30], xmm0
lea rdx, str.___The___s__hypervisor_present_r_n
mov ecx, 2
call fcn.140011090
call fcn.14000d654
mov qword [rsp + 0x20], rax
test rax, rax
je 0x14000d858
mov rdx, qword [0x1400480a0]
test rdx, rdx
je 0x14000d847
mov ebx, dword [rdx]
mov ecx, r15d
test ebx, ebx
je 0x14000d847
mov rdx, qword [rdx + 8]
mov r15d, ecx
shl r15, 6
add r15, rdx
cmp dword [r15 + 0xc], r14d
je 0x14000d876
inc ecx
cmp ecx, ebx
jb 0x14000d831
lea rdx, str.____Requested_provider_data_was_not_found_in_database__abort_r_n
mov ecx, 1
call fcn.140011090
mov rbx, qword [rsp + 0x118]
mov rax, rsi
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r15, r15
je 0x14000d847
mov eax, r14d
xor r14d, r14d
imul rbx, rax, 0x88
lea rax, [0x140045020]
add rbx, rax
mov qword [rbx], r15
test r13d, r13d
je 0x14000d8f7
mov eax, r13d
sub eax, 1
je 0x14000d8cc
sub eax, 1
je 0x14000d8c5
sub eax, 1
je 0x14000d8be
cmp eax, 1
je 0x14000d8b7
lea r9, [r15 + 0x1c]
jmp 0x14000d8db
mov ecx, 8
jmp 0x14000d8d1
mov ecx, 4
jmp 0x14000d8d1
mov ecx, 2
jmp 0x14000d8d1
mov ecx, 1
lea r9, [r15 + 0x1c]
test dword [r15 + 0x1c], ecx
ja 0x14000d8f7
mov r9d, dword [r9]
lea rdx, str.____Selected_shellcode__lu_is_not_supported_by_this_provider__supported_mask:_0x_08x___abort_r_n
mov r8d, r13d
mov ecx, 1
call fcn.140011090
jmp 0x14000d858
xor eax, eax
mov dword [rbp + 0x5f], r14d
lea rdi, [rsp + 0x30]
lea r9, [rbp + 0x5f]
lea edx, [rax + 0x20]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
lea ecx, [rax + 0x5a]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000d95c
mov ecx, dword [rbp - 0x71]
test ecx, ecx
je 0x14000d945
sub ecx, 1
je 0x14000d93c
cmp ecx, 1
jne 0x14000d945
lea r8, str.FirmwareTypeUefi
jmp 0x14000d94c
lea r8, str.FirmwareTypeBios
jmp 0x14000d94c
lea r8, str.FirmwareTypeUnknown
lea rdx, str.___Firmware_type___s__r_n
xor ecx, ecx
call fcn.140011090
jmp 0x14000d96a
mov edx, eax
lea rcx, str.____Failed_to_query_firmware_type
call fcn.140011f18
mov r9, qword [r15 + 0x28]
lea rdx, str.___Provider:___ws___Name___ws__r_n
mov r8, qword [r15 + 0x20]
mov ecx, 2
call fcn.140011090
xor r8d, r8d
test r12d, r12d
je 0x14000d99e
test byte [r15 + 0x18], 1
jne 0x14000d99e
lea rdx, str.____Abort:_selected_provider_does_not_support_HVCI_r_n
jmp 0x14000d84e
mov r12d, dword [rbp + 0x6f]
cmp r12d, dword [r15]
jae 0x14000d9b3
lea rdx, str.____Abort:_selected_provider_require_newer_Windows_NT_version_r_n
jmp 0x14000d84e
cmp dword [r15 + 4], 0xffffffff
je 0x14000d9d4
cmp r12d, dword [r15 + 4]
jbe 0x14000d9d4
lea rdx, str.____Warning:_selected_provider_may_not_work_on_this_Windows_NT_version_r_n
mov ecx, 1
call fcn.140011090
xor r8d, r8d
mov edx, dword [rbp + 0x7f]
mov r9d, 1
mov edi, r9d
mov ecx, edx
test edx, edx
je 0x14000da15
sub ecx, r9d
je 0x14000da15
sub ecx, r9d
je 0x14000da15
cmp ecx, r9d
jne 0x14000da6c
cmp qword [rbx + 0x80], r8
jne 0x14000da0d
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_process_handle_acquisition_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
mov ecx, r9d
jmp 0x14000d853
mov r14, r15
jmp 0x14000dad4
mov rax, qword [rbx]
mov ecx, dword [rax + 0x18]
test cl, 0x20
je 0x14000da2f
cmp qword [rbx + 0x58], r8
jne 0x14000da2f
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000da05
test ecx, 0x180
je 0x14000da6c
mov eax, r9d
mov ecx, r9d
cmp qword [rbx + 0x68], r8
je 0x14000da49
cmp qword [rbx + 0x70], r8
jne 0x14000da4c
mov eax, r8d
cmp qword [rbx + 0x48], r8
je 0x14000da58
cmp qword [rbx + 0x50], r8
jne 0x14000da5b
mov ecx, r8d
test eax, eax
jne 0x14000da6c
test ecx, ecx
jne 0x14000da6c
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000da05
mov r14, r15
test edx, edx
je 0x14000dab9
sub edx, r9d
je 0x14000da8c
cmp edx, r9d
jne 0x14000dad4
cmp qword [rbx + 0x40], r8
jne 0x14000dad4
lea rdx, str.____Abort:_selected_provider_does_not_support_changing_DSE_values_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x14000dac6
mov rax, qword [rbx]
test dword [rax + 0x18], 0x100
je 0x14000daa4
cmp qword [rbx + 0x68], r8
je 0x14000dab0
cmp qword [rbx + 0x70], r8
jmp 0x14000daae
cmp qword [rbx + 0x48], r8
je 0x14000dab0
cmp qword [rbx + 0x50], r8
jne 0x14000dad4
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000dac6
cmp qword [rbx + 0x38], r8
jne 0x14000dad4
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r9d
call fcn.140011090
xor r9d, r9d
mov edi, r9d
test edi, edi
je 0x14000d858
mov dl, 1
mov ecx, 0x14
call fcn.140001800
mov dl, 1
mov ecx, 0xa
call fcn.140001800
test dword [r14 + 0x18], 0x800
je 0x14000db0f
call fcn.14001357c
xor edi, edi
test eax, eax
je 0x14000d858
jmp 0x14000db11
xor edi, edi
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x478
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x14000db47
lea rdx, str.____Abort:_could_not_allocate_provider_context_r_n
jmp 0x14000d84e
mov qword [rax + 0x40], rbx
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x14000db88
mov rcx, rsi
call rax
test eax, eax
jne 0x14000db88
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rdx, str.____Abort:_provider_prerequisites_are_not_meet_r_n
mov rsi, rdi
jmp 0x14000d84e
test byte [r14 + 0x18], 0x40
je 0x14000db95
xor ebx, ebx
mov eax, ebx
jmp 0x14000dbbf
mov rax, qword [rbx]
cmp dword [rax + 0x10], 2
jb 0x14000dba5
mov dword [rax + 0x10], 1
mov rax, qword [rbx]
mov ecx, dword [rax + 0x10]
lea rax, [rcx + rcx*4]
shl rax, 4
lea rcx, str.PROCEXP152
add rax, rcx
xor ebx, ebx
mov qword [rsi + 0x48], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r15, qword [rcx + 0x20]
mov rcx, qword [r14 + 0x28]
mov rax, rcx
test rcx, rcx
jne 0x14000dbe9
mov rcx, rbx
jmp 0x14000dbf4
add rcx, 2
cmp word [rcx], bx
jne 0x14000dbe5
sub rcx, rax
sar rcx, 1
movzx eax, word [r15 + 0x38]
lea rcx, [rcx + 0x20]
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14000dddc
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x10], rax
mov dword [rsi + 8], r13d
mov dword [rsi + 4], r12d
call fcn.140010abc
mov qword [rsi + 0x18], rax
lea rdi, [rbp - 0x51]
xor eax, eax
mov dword [rbp + 0x5f], ebx
lea r9, [rbp + 0x5f]
lea rdx, [rbp - 0x51]
lea r13d, [rax + 0x40]
mov ecx, r13d
mov r8d, r13d
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000dc73
mov rax, qword [rbp - 0x29]
jmp 0x14000dc8e
xor eax, eax
lea rdi, [rsp + 0x30]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp - 0x71]
mov ecx, 0x16
mov qword [rsi + 0x38], rax
mov r12d, 0x20206f49
call fcn.1400019c0
mov r8, rax
test rax, rax
je 0x14000dcf4
mov rcx, rbx
cmp dword [rax], ebx
jbe 0x14000dcdb
mov ebx, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov rdi, rcx
cmp rdx, rcx
jbe 0x14000dcc7
mov r12d, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, rdi
cmovbe rcx, rdi
sub rbx, 1
jne 0x14000dcb8
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsi + 0x30]
mov dword [rsi + 0xc], r12d
movzx edx, word [r15 + 0x38]
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.14000148c
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14003b64c]
call fcn.1400013e8
mov rdx, qword [r14 + 0x28]
mov rcx, qword [rsi + 0x30]
call fcn.1400013e8
mov rcx, qword [rsi + 0x30]
lea rdx, str..sys
call fcn.1400013e8
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 8]
test eax, eax
je 0x14000ddbf
mov rax, qword [rsi + 0x40]
mov dword [rsi + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x14000d858
mov rdx, rsi
test byte [r14 + 0x18], r13b
jne 0x14000dd70
mov edx, dword [r14 + 8]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x14000d858
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_register_provider_driver
call fcn.140011fe4
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14000dda1
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 0x10]
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14000dddc
mov rax, qword gs:[0x30]
jmp 0x14000ddcc
mov rax, qword gs:[0x30]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbx
jmp 0x14000d858