Function at 0x140059bd4
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
xor r15d, r15d
xorps xmm0, xmm0
mov r12, r8
mov dword [rbp + 0xc0], r15d
mov rdi, rcx
movdqa xmmword [rbp], xmm0
xorps xmm1, xmm1
mov qword [rbp + 0x18], r15
lea r8d, [r15 + 0x30]
movdqa xmmword [rbp + 0x20], xmm1
xor edx, edx
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp - 0x30]
mov qword [rbp + 0x40], r15
mov r13d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
call sub.msvcrt.dll_memset
mov qword [rbp - 0x38], r15
mov ebx, r15d
mov qword [rsp + 0x28], r15
mov esi, r15d
mov qword [rbp - 0x68], r15
mov r14d, r15d
test r12, r12
jne 0x140059c88
mov ecx, 0x80070057
mov r15d, ecx
call fcn.1400790f8
jmp 0x14005a2db
cmp qword [rbp + 0xd0], rbx
je 0x140059c76
cmp qword [rbp + 0xd8], rbx
je 0x140059c76
mov rax, qword [0x14042eab0]
mov qword [rbp - 0x40], rax
lea r13, [rax + 8]
mov qword [rsp + 0x20], r13
test r13, r13
je 0x140059cce
mov edx, 1
mov rcx, r13
call fcn.140071b04
mov rax, qword [rbp - 0x40]
mov dword [rbp + 0xc0], 1
cmp qword [rdi + 0x30], r15
jne 0x140059cdb
mov ecx, 0x80070005
jmp 0x140059c7b
cmp qword [rdi + 0x38], r15
je 0x140059cd4
mov r15, qword [rax + 0xd8]
mov r13, qword [0x14042eb20]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x140059d23
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
jmp 0x140059d26
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov ecx, 0x8007000e
test rdi, rdi
jne 0x140059d41
mov r15d, ecx
call fcn.1400790f8
xor r13d, r13d
jmp 0x140059d6d
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.140069b54
xor r13d, r13d
mov r15d, eax
test eax, eax
jns 0x140059d62
mov ecx, eax
call fcn.1400790f8
jmp 0x140059d6d
mov qword [rbp - 0x50], r13
mov rsi, rdi
mov qword [rbp - 0x38], rdi
mov ecx, r15d
call fcn.140079118
lea rcx, [rbp - 0x50]
call fcn.14005a60c
test r15d, r15d
jns 0x140059d8b
mov ecx, r15d
jmp 0x14005a2d1
mov eax, dword [rbp + 0xb8]
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x50], r12
call fcn.14005f858
mov r15d, eax
test eax, eax
jns 0x140059db4
mov ecx, eax
jmp 0x14005a2d1
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403af620]
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call rdi
mov r15d, eax
test eax, eax
js 0x140059dad
mov rax, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x140005278]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
lea r8d, [r9 + 0x40]
mov qword [rsp + 0x58], rax
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x80]
test r15d, r15d
js 0x140059d83
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140059e3f
mov ecx, 0x8000ffff
jmp 0x14005a2ce
mov r12, qword [rbp + 0xb0]
mov rdx, qword [r12 + 0x30]
mov rax, qword [rdx]
cmp rax, qword [rcx]
jne 0x14005a2c9
mov rax, qword [rdx + 8]
cmp rax, qword [rcx + 8]
jne 0x14005a2c9
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140059e35
mov rax, qword [r12 + 0x38]
sub rcx, rax
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x140059e8c
add rax, 2
test r8d, r8d
jne 0x140059e76
test edx, edx
jne 0x14005a2c9
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140059ec1
lea rdx, [rbp - 0x68]
call fcn.140078fc0
mov r15d, eax
test eax, eax
jns 0x140059ebd
mov ecx, eax
call fcn.1400790f8
mov r14, qword [rbp - 0x68]
jmp 0x14005a2d6
mov r14, qword [rbp - 0x68]
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [0x1403af620]
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call rdi
mov r15d, eax
test eax, eax
js 0x140059dad
mov rdi, qword [rbp - 0x28]
mov r15, r14
mov rax, qword [rbp - 0x40]
mov r14, r13
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rax
test rdi, rdi
je 0x140059f21
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
test r15, r15
mov qword [rsp + 0x40], 3
mov rax, r13
lea rdx, [rsp + 0x40]
cmovne rax, r15
xor r9d, r9d
mov qword [rbp - 0x28], rax
lea rax, [0x140002838]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
lea edi, [r9 + 0x40]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x60]
mov r8d, edi
lea ecx, [rdi + 0x79]
mov qword [rsp + 0x60], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x7c]
test r15d, r15d
jns 0x140059f97
lea rdx, [0x140428220]
lea rcx, [0x14041a130]
call fcn.1400e977c
jmp 0x140059d83
mov rax, qword [rbp - 0x60]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x18]
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rax, [0x14001ceb8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x48], rax
mov ecx, 0xb9
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x68], rax
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x78], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x78]
test r15d, r15d
js 0x140059d83
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14005a054
mov qword [rax], 1
lea rdx, [0x14042df98]
mov qword [rax + 8], r13
lea rcx, [0x140410738]
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
call fcn.1400e8db8
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
jmp 0x14005a057
mov rbx, r13
test rbx, rbx
jne 0x14005a066
mov ecx, 0x8007000e
jmp 0x14005a2ce
mov r15d, r13d
cmp qword [rsi + 8], r13
jne 0x14005a07e
mov ecx, 0x80004005
mov r15d, ecx
call fcn.1400790f8
jmp 0x14005a0c5
cmp qword [rsi + 0x10], r13
je 0x14005a06f
lea rax, [0x1400017f8]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbx + 0x10]
mov r8, rdi
mov ecx, 0xb9
mov qword [rsp + 0x58], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, r15d
call fcn.140079118
test r15d, r15d
js 0x140059d83
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x64], rax
mov esi, 3
lea rax, [0x1400014b8]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov r8, rdi
mov eax, dword [rbp - 0x74]
mov ecx, 0xb9
mov dword [rsp + 0x6c], eax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 1
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x70]
test r15d, r15d
js 0x140059d83
mov r9, qword [rbp - 0x58]
lea edx, [rsi - 2]
mov r8d, dword [rbp - 0x6c]
lea rcx, [rsp + 0x30]
call fcn.140053a10
mov r15d, eax
test eax, eax
js 0x140059dad
mov r9, qword [rbp + 0x20]
test r9, r9
je 0x14005a197
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.140077c68
mov r15d, eax
test eax, eax
js 0x140059dad
mov r9, qword [rbp + 0x20]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005a1a1
mov r8d, r13d
mov dword [rbp + 0xc8], r13d
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140053a10
mov r15d, eax
test eax, eax
js 0x140059dad
mov r9, qword [rbp - 0x20]
test r9, r9
je 0x14005a1eb
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.140077c68
mov r15d, eax
test eax, eax
js 0x140059dad
mov r9, qword [rbp - 0x20]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005a1ee
mov r8d, r13d
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140053a10
mov r15d, eax
test eax, eax
js 0x140059dad
mov r8, qword [rbp + 0xd0]
lea rcx, [rsp + 0x30]
mov rdx, qword [rbp + 0xd8]
call fcn.14005396c
mov r15d, eax
test eax, eax
js 0x140059dad
lea rsi, [rbx + 8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x14005a266
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
lea rdx, [0x14042cd60]
lea rcx, [0x1404066ac]
call fcn.1400e9438
mov qword [rsi], r13
mov r13, qword [rbp - 0x18]
xor r15d, r15d
test r13, r13
je 0x14005a29a
mov edi, dword [r13 - 4]
xor ecx, ecx
call fcn.140079118
mov r8, rsi
mov edx, edi
mov rcx, r13
call fcn.140078e54
mov r15d, eax
test eax, eax
jns 0x14005a29d
mov ecx, eax
call fcn.1400790f8
jmp 0x14005a29d
and qword [rsi], r15
mov ecx, r15d
call fcn.140079118
test r15d, r15d
js 0x140059d83
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14005a2bd
call fcn.140066b98
mov rax, rbx
xor ebx, ebx
mov qword [r12 + 0x28], rax
jmp 0x14005a2d6
mov ecx, 0x80070005
mov r15d, ecx
call fcn.1400790f8
mov r13, qword [rsp + 0x20]
mov ecx, r15d
call fcn.140079118
xor r12d, r12d
test r14, r14
je 0x14005a307
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14005a32b
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [0x1403af620]
mov rcx, rdi
call rsi
mov qword [rsp + 0x28], r12
lea rcx, [rbp - 0x38]
call fcn.14005a60c
test rbx, rbx
je 0x14005a341
mov rcx, rbx
call fcn.140066b98
lea rcx, [rbp - 0x30]
call fcn.140057570
lea rcx, [rbp - 0x60]
call fcn.1400574c4
lea rcx, [rbp - 0x58]
call fcn.14005a598
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14005a384
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x14042d3cc]
lea rcx, [0x140406d70]
call fcn.1400e9ac8
mov qword [rsp + 0x38], r12
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14005a3a3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rbx
call rdi
lea rcx, [rbp]
call fcn.14005a3f4
test r13, r13
je 0x14005a3d5
cmp dword [rbp + 0xc0], r12d
je 0x14005a3d5
mov rcx, r13
call fcn.1400719a0
lea rdx, [0x1404265a8]
lea rcx, [0x140418ec0]
call fcn.1400e90f0
mov eax, r15d
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret