Function at 0x1400041a0
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rsi
push rdi
sub rsp, 0x268
lea rcx, [0x1400091f9]
call fcn.140001000
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 0x1c
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 0x20
lea rdx, [rsp + 0x80]
mov ecx, 0x5a
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14000420e
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemBootEnvironmentInformation:_error__08X_n_n
call fcn.1400025a0
jmp 0x14000428b
lea rcx, str.SystemBootEnvironmentInformation:_n_t__BootIdentifier:
call fcn.1400025a0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x80]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0xd0]
call fcn.140004060
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x68], rax
cmp dword [rsp + 0x90], 2
jne 0x140004269
lea rax, str.UEFI
mov qword [rsp + 0x60], rax
jmp 0x140004275
lea rax, str.BIOS
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
lea rcx, str._n_t__FirmwareType:__s_n_t__BootFlags:_0x_p_n_n
call fcn.1400025a0
mov dword [rsp + 0x48], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
je 0x1400042cb
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemModuleInformation:__08X_n_n
call fcn.1400025a0
jmp 0x1400043a3
mov eax, dword [rsp + 0x48]
shl eax, 1
mov eax, eax
mov qword [rsp + 0x70], rax
call fcn.140002580
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x78], rax
mov r8, qword [rsp + 0x70]
mov edx, 8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x48]
shl eax, 1
xor r9d, r9d
mov r8d, eax
mov rdx, qword [rsp + 0x50]
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x14000433d
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemModuleInformation:__08X_n_n
call fcn.1400025a0
jmp 0x140004389
mov eax, 0x128
imul rax, rax, 0
lea rcx, [rsp + 0x130]
mov rdx, qword [rsp + 0x50]
mov rdi, rcx
lea rsi, [rdx + rax + 8]
mov ecx, 0x128
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rsp + 0x156]
lea rax, [rsp + rax + 0x158]
lea r8, [rsp + 0x158]
mov rdx, rax
lea rcx, str.SystemModuleInformation:_n_t__Kernel:__S___S__n_n
call fcn.1400025a0
call fcn.140002580
mov rax, qword [rax + 0x60]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [rsp + 0x58], 8
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 8
lea rdx, [rsp + 0x58]
mov ecx, 0x67
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400043f2
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemCodeIntegrityInformation:_error__08X_n_n
call fcn.1400025a0
jmp 0x140004402
mov edx, dword [rsp + 0x5c]
lea rcx, str.SystemCodeIntegrityInformation:_n_t__IntegrityOptions:_0x_04X_n_n
call fcn.1400025a0
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 2
lea rdx, [rsp + 0x38]
mov ecx, 0x23
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004449
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemKernelDebuggerInformation:_error__08X_n_n
call fcn.1400025a0
jmp 0x140004464
movzx eax, byte [rsp + 0x39]
movzx ecx, byte [rsp + 0x38]
mov r8d, eax
mov edx, ecx
lea rcx, str.SystemKernelDebuggerInformation:_n_t__KernelDebuggerEnabled:__u_n_t__KernelDebuggerNotPresent:__u_n_n
call fcn.1400025a0
call fcn.140004760
cmp eax, 6
jb 0x140004478
call fcn.140004780
cmp eax, 3
jae 0x140004482
call fcn.140004760
cmp eax, 6
jbe 0x1400044ea
lea rax, [rsp + 0x3c]
mov rdi, rax
xor eax, eax
mov ecx, 3
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 3
lea rdx, [rsp + 0x3c]
mov ecx, 0x95
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400044c9
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemKernelDebuggerInformationEx:_error__08X_n_n
call fcn.1400025a0
jmp 0x1400044ea
movzx eax, byte [rsp + 0x3e]
movzx ecx, byte [rsp + 0x3d]
movzx edx, byte [rsp + 0x3c]
mov r9d, eax
mov r8d, ecx
lea rcx, str.SystemKernelDebuggerInformationEx:_n_t__DebuggerAllowed:__u_n_t__DebuggerEnabled:__u_n_t__DebuggerPresent:__u_n_n
call fcn.1400025a0
mov eax, 0x2d4
add rax, 0x7ffe0000
movzx eax, byte [rax]
mov byte [rsp + 0x36], al
movzx eax, byte [rsp + 0x36]
mov edx, eax
lea rcx, str.SharedUserData__KdDebuggerEnabled:_0x_02X_n_n
call fcn.1400025a0
call fcn.140004760
cmp eax, 6
jbe 0x140004741
mov byte [rsp + 0x34], 0
xor r9d, r9d
mov r8d, 1
lea rdx, [rsp + 0x34]
mov ecx, 0xa3
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140004558
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemKernelDebuggerFlags:_error__08X_n_n
call fcn.1400025a0
jmp 0x14000456b
movzx eax, byte [rsp + 0x34]
mov edx, eax
lea rcx, str.SystemKernelDebuggerFlags:_0x_02X_n_n
call fcn.1400025a0
lea rax, [rsp + 0xe0]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, 0x20
lea rdx, [rsp + 0xe0]
mov ecx, 0xa4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400045b8
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemCodeIntegrityPolicyInformation:_error__08X_n_n
call fcn.1400025a0
jmp 0x1400045d3
mov r8d, dword [rsp + 0xe4]
mov edx, dword [rsp + 0xe0]
lea rcx, str.SystemCodeIntegrityPolicyInformation:_n_t__Options:_0x_04X_n_t__HVCIOptions:_0x_04X_n_n
call fcn.1400025a0
mov byte [rsp + 0x35], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x35]
mov ecx, 0xba
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x80430006
jne 0x14000460a
lea rcx, str.SystemKernelDebuggingAllowed:_STATUS_SECUREBOOT_NOT_ENABLED_n_n
call fcn.1400025a0
jmp 0x140004636
cmp dword [rsp + 0x30], 0
jge 0x140004623
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemKernelDebuggingAllowed:_error__08X_n_n
call fcn.1400025a0
jmp 0x140004636
movzx eax, byte [rsp + 0x35]
mov edx, eax
lea rcx, str.SystemKernelDebuggingAllowed:__u_n_n
call fcn.1400025a0
mov dword [rsp + 0xa0], 0
lea rax, [rsp + 0xa4]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rsp + 0x100]
mov rdi, rax
xor eax, eax
mov ecx, 0x24
rep stosb byte [rdi], al
mov eax, 4
imul rax, rax, 0
lea rax, [rsp + rax + 0xa0]
xor r9d, r9d
mov r8d, 0x24
mov rdx, rax
mov ecx, 0xbe
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x1400046b1
mov edx, dword [rsp + 0x30]
lea rcx, str.SystemCodeIntegrityUnlockInformation:_error__08X_n_n
call fcn.1400025a0
jmp 0x140004741
mov r8d, 0x24
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xa0]
call sub.ntdll.dll_memcmp
test eax, eax
jne 0x1400046de
lea rcx, str.SystemCodeIntegrityUnlockInformation:_0_n_n
call fcn.1400025a0
jmp 0x140004741
mov dword [rsp + 0x40], 0
jmp 0x1400046f2
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
cmp rax, 9
jae 0x140004741
mov eax, dword [rsp + 0x40]
mov eax, dword [rsp + rax*4 + 0xa0]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
shr eax, 2
and eax, 1
mov ecx, dword [rsp + 0x44]
shr ecx, 1
and ecx, 1
mov edx, dword [rsp + 0x44]
and edx, 1
mov edi, dword [rsp + 0x44]
mov dword [rsp + 0x20], edi
mov r9d, eax
mov r8d, ecx
lea rcx, str.SystemCodeIntegrityUnlockInformation:_n_t__Locked:__u_n_t__Unlockable:__u_n_t__UnlockApplied:__u_n_t__Flags:__04X_n_n
call fcn.1400025a0
jmp 0x1400046e8
lea rcx, str.Press_any_key_to_exit._n
call fcn.1400025a0
call fcn.1400047a0
mov eax, dword [rsp + 0x30]
add rsp, 0x268
pop rdi
pop rsi
ret