Function at 0x14008e284
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x380
mov rax, qword [0x14009e0d0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov r12, r9
mov qword [rsp + 0x48], r8
mov r13, rdx
mov r14, rcx
mov r15, qword [rsp + 0x3e8]
mov qword [rsp + 0x58], r15
lea rcx, [rsp + 0xa0]
call fcn.140015800
xor esi, esi
cmp byte [r14 + 0x162], sil
jne 0x14008e2f7
mov dword [r15], 9
lea rcx, [rsp + 0xa0]
call fcn.1400159a4
xor al, al
jmp 0x14008e5c5
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x14008e5b4
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x68]
xor edx, edx
div rcx
mov ebx, dword [rsp + 0x6c]
cmp rbx, rax
cmovae rbx, rax
xor r9d, r9d
mov r8d, 0x158
lea rdx, [rsp + 0x210]
lea ecx, [r9 + 2]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x14008e5b4
mov r8d, dword [rsp + 0x23c]
cmp r8, rbx
cmovae r8, rbx
xor edx, edx
mov eax, 0x2000000
mov r9d, dword [rsp + 0x68]
div r9d
mov ecx, eax
sub r8, rcx
shr r8, 1
xor edx, edx
mov eax, 0x4000000
div r9d
mov ecx, eax
xor edx, edx
cmp r8, rcx
ja 0x14008e3b2
mov eax, 0x400000
div r9d
mov edi, eax
cmp r8, rdi
cmovb rdi, r8
jmp 0x14008e3c6
mov eax, 0x10000000
div r9d
mov ecx, eax
mov rdi, r8
cmp r8, rcx
cmovae rdi, rcx
mov rax, qword [r14]
lea rdx, [rsp + 0x50]
mov rcx, r14
mov rax, qword [rax + 0x28]
call qword [str._:_t_]
mov rbx, qword [rax]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [str._:_t_]
mov eax, eax
imul rax, rbx
mov ecx, dword [rsp + 0x68]
xor edx, edx
div rcx
test rax, rax
je 0x14008e40c
cmp rdi, rax
cmovb rax, rdi
mov rdi, rax
imul rdi, rcx
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
mov rcx, r14
call qword [str._:_t_]
mov ecx, eax
xor edx, edx
mov rax, rdi
div rcx
mov rbx, rax
test eax, eax
je 0x14008e48b
mov ecx, pe_nt_image_headers64
call fcn.1400076ac
test rax, rax
je 0x14008e44b
mov rcx, rax
call fcn.1400104f0
mov rsi, rax
test rsi, rsi
je 0x14008e4a4
mov r9b, 1
mov r8d, ebx
mov rdx, r14
mov rcx, rsi
call fcn.1400106d4
test al, al
je 0x14008e48b
mov rcx, qword [r14 + 0x188]
test rcx, rcx
je 0x14008e482
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [str._:_t_]
mov qword [r14 + 0x188], rsi
jmp 0x14008e4a4
test rsi, rsi
je 0x14008e4a4
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
mov rax, qword [rax]
call qword [str._:_t_]
mov rcx, r13
call fcn.14008dfb0
movsxd rbx, eax
lea rcx, [rsp + 0xa0]
test eax, eax
js 0x14008e5e9
mov r9b, 1
mov r8, r12
mov rdx, r14
call fcn.140015a10
test al, al
jne 0x14008e4ef
xor r9d, r9d
mov r8, r12
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.140015a10
test al, al
je 0x14008e5ad
mov rdx, r12
lea rcx, [rsp + 0xa0]
call fcn.140018ee0
test al, al
je 0x14008e5ad
lea rdx, [rsp + 0x44]
mov ecx, 0x80000003
call qword [sym.imp.ntdll.dll_NtSetThreadExecutionState]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x50], eax
mov rdx, rbx
add rdx, rdx
lea rax, [0x14009e008]
mov rax, qword [rax + rdx*8]
mov qword [rsp + 0x28], r15
mov edx, dword [rsp + 0x3e0]
mov dword [rsp + 0x20], edx
mov r9, r12
mov r8, qword [rsp + 0x48]
lea rdx, [rsp + 0xa0]
mov rcx, r14
call qword [str._:_t_]
mov bl, al
mov byte [rsp + 0x40], al
test edi, edi
js 0x14008e57c
lea rdx, [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.ntdll.dll_NtSetThreadExecutionState]
nop dword [rax + rax]
jmp 0x14008e5ab
jmp 0x14008e5b6
mov dword [r15], 4
xor bl, bl
lea rcx, [rsp + 0xa0]
call fcn.1400159a4
mov al, bl
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140093530
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r15], 1
jmp 0x14008e2eb