Function at 0x14019a578
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov r12, r8
mov r15, rdx
mov rdi, rcx
xor r14d, r14d
xor r13d, r13d
call fcn.140199e88
mov ebx, eax
test eax, eax
jns 0x14019a5bc
mov ecx, eax
jmp 0x14019a7ad
lea r14, [rdi + 0x60]
test r14, r14
je 0x14019a5d3
mov rcx, r14
call fcn.14006f734
mov r13d, 1
mov rcx, qword [rdi]
mov edx, dword [rcx + 4]
sub edx, 1
je 0x14019a5ee
cmp edx, 1
je 0x14019a5e7
xor esi, esi
jmp 0x14019a5f3
mov esi, 1
jmp 0x14019a5f3
mov esi, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, dword [rdi + 8]
test ecx, ecx
je 0x14019a798
cmp ecx, 1
jne 0x14019a7b2
cmp dword [r12], esi
jb 0x14019a780
cmp qword [r15], 0
je 0x14019a780
cmp dword [rdi + 0x38], esi
jae 0x14019a659
mov r8d, dword [rdi + 0x38]
mov r9d, esi
sub r9d, dword [rdi + 0x38]
movzx ecx, byte [rdi + 0x37]
test ecx, ecx
je 0x14019a642
cmp ecx, 1
je 0x14019a63c
xor ecx, ecx
jmp 0x14019a646
mov rcx, qword [rdi + 0x10]
jmp 0x14019a646
lea rcx, [rdi + 0x10]
mov al, sil
sub al, byte [rdi + 0x38]
mov byte [r8 + rcx], al
inc r8
sub r9, 1
jne 0x14019a62b
test esi, esi
je 0x14019a6aa
xor r8d, r8d
mov r11d, esi
movzx ecx, byte [rdi + 0x37]
test ecx, ecx
je 0x14019a67a
cmp ecx, 1
je 0x14019a674
xor edx, edx
jmp 0x14019a67e
mov rdx, qword [rdi + 0x10]
jmp 0x14019a67e
lea rdx, [rdi + 0x10]
movzx ecx, byte [rdi + 0x57]
test ecx, ecx
je 0x14019a695
cmp ecx, 1
je 0x14019a68f
xor eax, eax
jmp 0x14019a699
mov rax, qword [rdi + 0x40]
jmp 0x14019a699
lea rax, [rdi + 0x40]
mov al, byte [r8 + rax]
xor byte [r8 + rdx], al
inc r8
sub r11, 1
jne 0x14019a663
movaps xmm0, xmmword [r15]
lea rcx, [rdi + 0x10]
movzx edx, byte [rcx + 0x27]
movdqa xmmword [rbp - 0x19], xmm0
test edx, edx
je 0x14019a6cb
cmp edx, 1
je 0x14019a6c8
xor ecx, ecx
jmp 0x14019a6cb
mov rcx, qword [rcx]
and dword [rbp - 0x31], 0
mov qword [rbp - 0x39], rcx
test rcx, rcx
jne 0x14019a6dc
xor eax, eax
jmp 0x14019a6ec
mov rax, qword [0x140440198]
mov ecx, dword [rax]
lea rax, [rbp - 0x39]
add rax, rcx
and dword [rbp - 0x21], 0
lea rdx, [rbp - 9]
mov qword [rbp - 0x29], rax
xor r9d, r9d
movaps xmm0, xmmword [rbp - 0x29]
lea rax, [0x140040e98]
mov qword [rbp - 1], rax
lea rax, [rbp + 0x7f]
mov qword [rbp + 7], rax
mov rax, qword [rdi]
lea r8d, [r9 + 0x40]
mov qword [rbp + 0xf], rax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp + 0x1b], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov qword [rbp - 9], 3
mov dword [rbp + 0x17], 0x80
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], r12
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
js 0x14019a7ab
and dword [rdi + 0x38], 0
lea rcx, [rdi + 0x40]
movzx edx, byte [rcx + 0x17]
test edx, edx
je 0x14019a774
cmp edx, 1
je 0x14019a771
xor ecx, ecx
jmp 0x14019a774
mov rcx, qword [rcx]
mov r8d, esi
xor edx, edx
call sub.msvcrt.dll_memset
jmp 0x14019a7b2
mov rax, qword [r15]
neg rax
mov dword [r12], esi
sbb ebx, ebx
and ebx, 0xc004d107
cmp qword [r15], 0
jmp 0x14019a7a9
mov eax, dword [rdi + 0x38]
neg eax
sbb ebx, ebx
and ebx, 0x80004005
cmp dword [rdi + 0x38], 0
je 0x14019a7b2
mov ecx, ebx
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test r14, r14
je 0x14019a7cb
test r13d, r13d
je 0x14019a7cb
mov rcx, r14
call fcn.14007240c
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret