Function at 0x140008ab0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
movaps xmmword [rsp + 0x140], xmm6
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x2c], 0
xor r15d, r15d
lea r9, [rsp + 0x2c]
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140008b2d
mov r12d, dword [rsp + 0x2c]
test r12, r12
je 0x140008d16
cmp r12d, 0x1000
jb 0x140008d1c
lea rcx, [r12 + 0x27]
call fcn.14001387c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140008d27
mov edi, eax
movabs rax, 0x64ad60031a2b166c
mov qword [rsp + 0x30], rax
movabs rax, 0x5acc4b58ad88643a
mov qword [rsp + 0x38], rax
movabs rax, 0xb4416a2f57078dc8
mov qword [rsp + 0x40], rax
movabs rax, 0x3897d97fbcd54111
mov qword [rsp + 0x48], rax
movabs rax, 0x7957c264fca711eb
mov qword [rsp + 0x50], rax
movabs rax, 0x5db23fec6417fb3c
mov qword [rsp + 0x58], rax
movabs rax, 0x751c0ccc2205070
mov qword [rsp + 0x60], rax
movabs rax, 0x988f173eed2f1d88
mov qword [rsp + 0x68], rax
movabs rax, 0x3017f85163cc370c
mov qword [rsp + 0x70], rax
movabs rax, 0xf55bd1b54d4717bc
mov qword [rsp + 0x78], rax
movabs rcx, 0x44f0126c68595337
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x9b5393dd8d91074
mov qword [rsp + 0xb8], rcx
movabs rcx, 0xd22f23423273feb1
mov qword [rsp + 0xc0], rcx
movabs rcx, 0x56f8b00bddb8337e
mov qword [rsp + 0xc8], rcx
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0xd0], rcx
movabs rcx, 0x3f924b8903379448
mov qword [rsp + 0xd8], rcx
movabs rcx, 0x6e22e0bea7463605
mov qword [rsp + 0xe0], rcx
movabs rcx, 0xb8e763579a0f78f2
mov qword [rsp + 0xe8], rcx
movabs rcx, 0x102d8b2417ad437f
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0xb0]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [0x140051b70]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, edi
call fcn.1400095c0
mov rcx, rax
mov dl, 0xa
call fcn.140001550
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x14000958b
xor ebx, ebx
xor edi, edi
jmp 0x140008d3d
mov rcx, r12
call fcn.14001387c
mov rdi, rax
lea rbx, [rdi + r12]
mov rcx, rdi
xor edx, edx
mov r8, r12
call fcn.14003c050
mov r15d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
mov ecx, 0xb
mov rdx, rdi
mov r8d, r15d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140008f9f
mov ebp, eax
movabs rax, 0x64ad60031a2b166c
mov qword [rsp + 0x30], rax
movabs rax, 0x5acc4b58ad88643a
mov qword [rsp + 0x38], rax
movabs rax, 0xb4416a2f57078dc8
mov qword [rsp + 0x40], rax
movabs rax, 0x3897d97fbcd54111
mov qword [rsp + 0x48], rax
movabs rax, 0x7957c264fca711eb
mov qword [rsp + 0x50], rax
movabs rax, 0x46e02efc7217fb3c
mov qword [rsp + 0x58], rax
movabs rax, 0x4e4f85cad43f4525
mov qword [rsp + 0x60], rax
movabs rax, 0xcc860e25f569169b
mov qword [rsp + 0x68], rax
movabs rax, 0x7859e25337c32c16
mov qword [rsp + 0x70], rax
movabs rax, 0xcf28a4c12c33649c
mov qword [rsp + 0x78], rax
movabs rax, 0x4d1603da29320a19
mov qword [rsp + 0x80], rax
movabs rax, 0xb5d8826395ee27c6
mov qword [rsp + 0x88], rax
movabs rcx, 0x44f0126c68595337
mov qword [rsp + 0xb0], rcx
movabs rcx, 0x9b5393dd8d91074
mov qword [rsp + 0xb8], rcx
movabs rcx, 0xd22f23423273feb1
mov qword [rsp + 0xc0], rcx
movabs rcx, 0x56f8b00bddb8337e
mov qword [rsp + 0xc8], rcx
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0xd0], rcx
movabs rcx, 0x3f924b8903379448
mov qword [rsp + 0xd8], rcx
movabs rcx, 0x6e22e0bea7463605
mov qword [rsp + 0xe0], rcx
movabs rcx, 0xb8e763579a0f78f2
mov qword [rsp + 0xe8], rcx
movabs rcx, 0x102d8b2417ad437f
mov qword [rsp + 0xf0], rcx
movabs rcx, 0xf55bd1b54d4717bc
mov qword [rsp + 0xf8], rcx
movabs rcx, 0x4d1603da29320a39
mov qword [rsp + 0x100], rcx
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0xb0]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [0x140051b70]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, ebp
call fcn.1400095c0
mov rcx, rax
mov dl, 0xa
call fcn.140001550
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x140009440
mov qword [rsp + 0x138], r14
mov qword [rsp + 0x110], rbx
movabs rax, 0xad04f030e371a6c
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x30], rax
movabs rax, 0x6fda194fbdbb7d01
mov qword [rsp + 0x38], rax
movabs rax, 0xa14a4f37561c9391
mov qword [rsp + 0x40], rax
movabs rax, 0x76c2d465a8d7555e
mov qword [rsp + 0x48], rax
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0x50], rcx
movabs rdx, 0x3f924b8903379448
mov qword [rsp + 0x58], rdx
movabs rbx, 0x44f0126c68595337
mov qword [rsp + 0xb0], rbx
movabs rax, 0x9b5393dd8d91074
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], rax
movabs rax, 0xd22f23423273feb1
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xc0], rax
movabs rax, 0x56f8b00bddb8337e
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0xd8], rdx
lea r12, [rsp + 0xb0]
mov rax, r12
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [0x140051dd0]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov edx, dword [rdi]
mov rcx, rax
call fcn.140009770
mov rcx, rax
mov dl, 0xa
call fcn.140001550
cmp dword [rdi], 0
je 0x14000944e
xor r14d, r14d
xorps xmm6, xmm6
mov qword [rsp + 0x130], rbx
jmp 0x140009133
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400138c0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
inc r14
mov eax, dword [rdi]
cmp r14, rax
jae 0x14000944e
imul rax, r14, 0x128
lea rbp, [rdi + rax]
add rbp, 0x30
movups xmmword [rsi + 0x10], xmm6
movups xmmword [rsi], xmm6
mov rcx, rbp
call fcn.14003c3f0
test rax, rax
js 0x1400095aa
mov r13, rax
cmp rax, 0xf
ja 0x140009190
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov rcx, rsi
mov rdx, rbp
mov r8, r13
call fcn.14003b9b0
add r13, rsi
jmp 0x1400091fc
mov rbx, r12
mov r12, r13
or r12, 0xf
cmp r12, 0x17
mov eax, 0x16
cmovb r12, rax
cmp r12, 0xfff
jb 0x1400091c8
lea rcx, [r12 + 0x28]
call fcn.14001387c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400091d5
lea rcx, [r12 + 1]
call fcn.14001387c
mov r15, rax
mov qword [rsi], r15
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r12
mov rcx, r15
mov rdx, rbp
mov r8, r13
call fcn.14003b9b0
add r13, r15
mov r12, rbx
mov rbx, qword [rsp + 0x130]
mov byte [r13], 0
cmp qword [rsi + 0x10], 0
je 0x140009246
mov rax, qword [rsp + 0x138]
mov r13, qword [rax]
mov r15, qword [rax + 8]
cmp r13, r15
je 0x140009335
mov rcx, rsi
mov rdx, r13
xor r8d, r8d
call fcn.140009920
cmp rax, 0xffffffffffffffff
jne 0x140009371
add r13, 0x20
cmp r13, r15
jne 0x140009220
jmp 0x140009335
movabs rax, 0x239e7b021a38046c
mov qword [rsp + 0x30], rax
movabs rax, 0x29cc4d4db59c3029
mov qword [rsp + 0x38], rax
movabs rax, 0xbc0f5127441a8cd5
mov qword [rsp + 0x40], rax
movabs rax, 0x399bde6efddd5e1f
mov qword [rsp + 0x48], rax
movabs rax, 0x5957c27af0b219be
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x118]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0xb0], rbx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rcx
mov rax, r12
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [0x140051b70]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov rcx, rax
mov dl, 0xa
call fcn.140001550
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x140009112
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000910d
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x140009103
jmp 0x1400095af
movabs rax, 0x5d04f030e371a6c
mov qword [rsp + 0x30], rax
movabs rax, 0x7dd45c55bbb0641a
mov qword [rsp + 0x38], rax
movabs rax, 0xf25d46345b019a91
mov qword [rsp + 0x40], rax
movabs rax, 0x56d88a6fb3cd5c18
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xb0], rbx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [r12 + 0x10]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [0x140051dd0]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x140009426
mov rdx, qword [rsi]
mov rcx, rax
call fcn.140007c10
mov rcx, rax
mov dl, 0xa
call fcn.140001550
mov rbx, qword [rsp + 0x110]
test rdi, rdi
jne 0x14000955c
jmp 0x14000958b
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x30], rax
movabs rax, 0x61d65049b6b8301b
mov qword [rsp + 0x38], rax
movabs rax, 0xa446512612079fd4
mov qword [rsp + 0x40], rax
movabs rax, 0x3296c564bb98411b
mov qword [rsp + 0x48], rax
movabs rax, 0x5933a70895c677e5
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x118]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0xb0], rbx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rcx
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [r12 + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [r12 + 0x20]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [0x140051dd0]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov rcx, rax
mov dl, 0xa
call fcn.140001550
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rbx, qword [rsp + 0x110]
sub rbx, rdi
cmp rbx, 0x1000
jb 0x140009580
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x1400095af
add rbx, 0x27
mov rdi, rax
mov rcx, rdi
mov rdx, rbx
call fcn.1400138c0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x140]
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140002120
call fcn.140020300
int3