Function at 0x14008bfb8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
xor r12d, r12d
mov r14, r9
mov qword [rbp - 0x31], r12
mov r15, r8
mov dword [rbp - 0x29], r12d
mov rdi, rdx
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x59], r12
test rdx, rdx
jne 0x14008c00e
mov ecx, 0x80070057
mov ebx, ecx
jmp 0x14008c1e3
test r15, r15
je 0x14008c002
test r14, r14
je 0x14008c002
mov rsi, qword [rbp + 0x77]
test rsi, rsi
je 0x14008c002
lea rdx, [0x140427ba8]
lea rcx, [0x140413940]
call fcn.14006d980
mov r13, qword [rbp + 0x7f]
test r13, r13
je 0x14008c002
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140072fb8
mov rax, qword [rbp - 0x59]
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x14008c06e
mov ebx, 0x8007000e
jmp 0x14008c1e1
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.140081d28
mov ebx, eax
test eax, eax
jns 0x14008c087
mov ecx, eax
jmp 0x14008c1e3
mov rbx, qword [0x14042ae50]
test rbx, rbx
je 0x14008c1dc
lea rdx, [0x140427660]
lea rcx, [0x1404058d0]
call fcn.14006d630
test rbx, rbx
je 0x14008c1dc
lea rdx, [rbx + 8]
lea rcx, [rbp - 0x31]
call fcn.140083630
mov rcx, qword [rbp - 0x49]
lea r8, [rbp + 0x57]
lea rdx, str.Volume:GVLK
call fcn.1401000ec
test eax, eax
jns 0x14008c0e2
mov ecx, 0xc004f306
jmp 0x14008c007
cmp dword [rbp + 0x57], r12d
jne 0x14008c12c
lea rdx, [0x140425934]
lea rcx, [0x140411884]
call fcn.14006cc00
mov rcx, qword [rbp - 0x49]
lea r8, [rbp + 0x57]
lea rdx, str.Volume:CSVLK
call fcn.1401000ec
test eax, eax
js 0x14008c0d8
lea rdx, [0x140425e24]
lea rcx, [0x14040b0f8]
call fcn.14006c510
cmp dword [rbp + 0x57], r12d
je 0x14008c0d8
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1400f3758
mov ebx, eax
test eax, eax
js 0x14008c080
mov rcx, qword [rbp - 0x41]
lea r8, [rbp + 0x57]
lea rdx, [rbp - 0x51]
call fcn.14008ed84
mov ebx, eax
test eax, eax
js 0x14008c080
mov r12, qword [rbp - 0x51]
lea rax, [0x14001cd40]
mov edi, dword [rbp + 0x57]
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x19], rax
xor r9d, r9d
lea rax, [rbp + 0x5f]
mov qword [rbp - 1], r12
mov qword [rbp - 0x11], rax
mov ecx, 0xb9
mov rax, qword [rbp - 0x39]
lea r8d, [r9 + 0x38]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x21], 3
mov dword [rbp - 9], edi
mov dword [rbp + 7], reloc.OLEAUT32.dll_SafeArrayGetDim
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x5f]
test ebx, ebx
js 0x14008c1e1
mov rax, qword [rbp - 0x39]
and qword [rbp - 0x51], 0
and qword [rbp - 0x59], 0
mov qword [r14], r12
mov dword [r15], edi
mov qword [r13], rax
mov dword [rsi], reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x14008c1e8
mov ebx, 0x8000ffff
mov ecx, ebx
call fcn.140075fa0
mov ecx, ebx
call fcn.140083bac
lea rcx, [rbp - 0x59]
call fcn.140093fdc
lea rcx, [rbp - 0x51]
call fcn.140093fdc
lea rcx, [rbp - 0x41]
call fcn.1401c20b8
lea rcx, [rbp - 0x49]
call fcn.140093fdc
lea rdx, [0x140429140]
lea rcx, [0x14040e110]
call fcn.14006c890
lea rcx, [rbp - 0x31]
call fcn.140072004
mov eax, ebx
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret