Function at 0x1800053a8
Capabilities:
Access peb ldr_data
Get ntdll base address
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r14
push r15
sub rsp, 0xa0
xor r14d, r14d
mov edi, r8d
mov ebx, r14d
test edx, edx
je 0x1800053e1
test byte [0x180028050], 1
je 0x18000571e
cmp edi, dword [0x180028040]
jb 0x18000571e
mov rax, qword [0x180028044]
cmp eax, 0xffffffff
je 0x180005401
cmp edi, eax
ja 0x18000571e
lea r15, [0x18000538c]
cmp qword [0x1800280a8], r15
je 0x18000571e
cmp qword [0x1800280b0], r15
je 0x18000571e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor edx, edx
lea rcx, str.drv64.dll
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x18000571e
mov ecx, 0x14
call fcn.180006ae8
test eax, eax
js 0x18000571e
mov ecx, 0xa
call fcn.180006ae8
test eax, eax
js 0x18000571e
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x458
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x18000571e
lea rax, [0x180028040]
mov qword [rbx + 0x38], rax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rbp, qword [rdx + 0x20]
mov rdx, qword [str.EneIo64]
mov rcx, rdx
test rdx, rdx
jne 0x1800054cb
mov rcx, r14
jmp 0x1800054e1
cmp word [rdx], r14w
je 0x1800054db
add rcx, 2
cmp word [rcx], r14w
jne 0x1800054d1
sub rcx, rdx
sar rcx, 1
movzx eax, word [rbp + 0x38]
lea rcx, [rcx + 0x20]
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1800056ff
mov dword [rbx + 4], edi
mov rdi, r14
mov dword [rbx + 8], 3
mov qword [rbx + 0x10], rsi
call fcn.1800070c4
test rax, rax
je 0x180005551
mov rcx, qword gs:[0x30]
mov r8, rax
mov rdi, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov qword [rbx + 0x18], rdi
lea rdi, [rsp + 0x60]
mov dword [rsp + 0xd8], r14d
lea r9, [rsp + 0xd8]
lea edx, [rax + 0x40]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
xor ecx, ecx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x180005591
mov rax, qword [rsp + 0x88]
jmp 0x1800055ad
xor eax, eax
lea rdi, [rsp + 0x28]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov ecx, 0x16
mov qword [rbx + 0x30], rax
mov esi, 0x20206f49
call fcn.180006fdc
mov r8, rax
test rax, rax
je 0x180005612
mov rcx, r14
cmp dword [rax], r14d
jbe 0x1800055f9
mov edi, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov r9, rcx
cmp rdx, rcx
jbe 0x1800055e5
mov esi, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, r9
cmovbe rcx, r9
sub rdi, 1
jne 0x1800055d7
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0xc], esi
movzx edx, word [rbp + 0x38]
mov r8, qword [rbp + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.18000103c
mov rcx, qword [rbx + 0x28]
lea rdx, [0x1800230a8]
call section..text
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rdx + 0x20]
call section..text
mov rcx, qword [rbx + 0x28]
lea rdx, str..sys
call section..text
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x20], r14
mov rdi, qword [rax + 0x28]
mov rdx, rdi
call fcn.180007758
test al, al
jne 0x180005682
mov rcx, rbx
call fcn.1800051a8
test eax, eax
je 0x1800056c5
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax + 0x48]
cmp rdx, r15
je 0x180005694
mov rcx, rbx
call rdx
lea r8, [rsp + 0x20]
mov edx, 0xc0040000
mov rcx, rdi
call fcn.180006ee4
test eax, eax
js 0x1800056c5
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0x20], rax
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax + 0x50]
cmp rdx, r15
je 0x1800056c5
mov rcx, rbx
call rdx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1800056e2
mov rax, qword [rbx + 0x38]
mov rdi, qword [rax + 0x38]
cmp rdi, r15
je 0x18000571e
mov edx, dword [rax + 8]
call rdi
jmp 0x18000571e
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbx + 0x28]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, r14
lea r11, [rsp + 0xa0]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret