Function at 0x18000cb54
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xe0
xor r12d, r12d
mov r13d, r8d
mov r15d, edx
mov r14d, ecx
mov esi, r12d
cmp ecx, 0x35
jb 0x18000cba6
mov r8d, ecx
lea rdx, str.___Pprovider_with_id__lu_is_not_supported__will_be_using_default_provider__0__r_n
lea ecx, [r12 + 2]
call fcn.18000fb6c
mov r14d, r12d
xor eax, eax
mov dword [rbp + 0x77], r12d
lea rdi, [rbp - 0x41]
lea r9, [rbp + 0x77]
lea edx, [rax + 0x70]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
mov ecx, 0x9f
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x18000cc18
mov r8d, 0xc
lea rdx, [rbp - 0x3d]
lea rcx, str.Microsoft_Hv
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0xc
jne 0x18000cbff
lea rdx, str.___MSFT_hypervisor_present_r_n
lea ecx, [rax - 0xa]
call fcn.18000fb6c
jmp 0x18000cc7e
movsd xmm0, qword [rbp - 0x3d]
lea rdi, [rsp + 0x30]
xor eax, eax
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov eax, dword [rbp - 0x35]
mov dword [rbp - 0x79], eax
jmp 0x18000cc62
or eax, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov eax, 1
cpuid
sar ecx, 0x1f
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
test cl, 1
je 0x18000cc7e
xor ecx, ecx
lea rdi, [rsp + 0x30]
mov eax, 0x40000000
cpuid
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor eax, eax
mov dword [rsp + 0x24], ebx
movsd xmm0, qword [rsp + 0x24]
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov dword [rbp - 0x79], edx
lea r8, [rsp + 0x30]
movsd qword [rsp + 0x30], xmm0
lea rdx, str.___The___s__hypervisor_present_r_n
mov ecx, 2
call fcn.18000fb6c
call fcn.18000ca14
mov qword [rbp - 0x51], rax
test rax, rax
je 0x18000cccb
mov rdx, qword [0x1800400b0]
test rdx, rdx
je 0x18000ccba
mov edi, dword [rdx]
mov ecx, r12d
test edi, edi
je 0x18000ccba
mov r8, qword [rdx + 8]
mov ebx, ecx
shl rbx, 6
add rbx, r8
cmp dword [rbx + 0xc], r14d
je 0x18000ccef
inc ecx
cmp ecx, edi
jb 0x18000cca5
lea rdx, str.____Requested_provider_data_was_not_found_in_database__abort_r_n
mov ecx, 1
call fcn.18000fb6c
lea r11, [rsp + 0xe0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test rbx, rbx
je 0x18000ccba
mov eax, r14d
imul r14, rax, 0x88
lea rax, [0x18003cfb0]
add r14, rax
mov qword [r14], rbx
mov r9d, dword [rbx + 0x1c]
test r9b, 4
ja 0x18000cd2d
mov r8d, 3
lea rdx, str.____Selected_shellcode__lu_is_not_supported_by_this_provider__supported_mask:_0x_08x___abort_r_n
lea ecx, [r8 - 2]
call fcn.18000fb6c
jmp 0x18000cccb
xor eax, eax
mov dword [rbp + 0x77], r12d
lea rdi, [rsp + 0x30]
lea r9, [rbp + 0x77]
lea edx, [rax + 0x20]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
lea ecx, [rax + 0x5a]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x18000cd92
mov ecx, dword [rbp - 0x71]
test ecx, ecx
je 0x18000cd7b
sub ecx, 1
je 0x18000cd72
cmp ecx, 1
jne 0x18000cd7b
lea r8, str.FirmwareTypeUefi
jmp 0x18000cd82
lea r8, str.FirmwareTypeBios
jmp 0x18000cd82
lea r8, str.FirmwareTypeUnknown
lea rdx, str.___Firmware_type___s__r_n
xor ecx, ecx
call fcn.18000fb6c
jmp 0x18000cda0
mov edx, eax
lea rcx, str.____Failed_to_query_firmware_type
call fcn.18001097c
mov r8, qword [rbx + 0x20]
lea rdi, [rbx + 0x28]
mov r9, qword [rdi]
lea rdx, str.___Provider:___ws___Name___ws__r_n
mov ecx, 2
mov qword [rsp + 0x20], rdi
call fcn.18000fb6c
test r15d, r15d
mov r15d, 1
je 0x18000cde1
test byte [rbx + 0x18], r15b
jne 0x18000cde1
lea rdx, str.____Abort:_selected_provider_does_not_support_HVCI_r_n
mov ecx, r15d
jmp 0x18000ccc6
cmp r13d, dword [rbx]
jae 0x18000cdef
lea rdx, str.____Abort:_selected_provider_require_newer_Windows_NT_version_r_n
jmp 0x18000cdd9
cmp dword [rbx + 4], 0xffffffff
je 0x18000ce0a
cmp r13d, dword [rbx + 4]
jbe 0x18000ce0a
lea rdx, str.____Warning:_selected_provider_may_not_work_on_this_Windows_NT_version_r_n
mov ecx, r15d
call fcn.18000fb6c
mov rax, qword [r14]
mov edx, r15d
mov ecx, dword [rax + 0x18]
test cl, 0x20
je 0x18000ce27
cmp qword [r14 + 0x58], r12
jne 0x18000ce27
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x18000cdd9
test ecx, 0x180
je 0x18000ce67
mov eax, r15d
mov ecx, r15d
cmp qword [r14 + 0x68], r12
je 0x18000ce41
cmp qword [r14 + 0x70], r12
jne 0x18000ce44
mov eax, r12d
cmp qword [r14 + 0x48], r12
je 0x18000ce50
cmp qword [r14 + 0x50], r12
jne 0x18000ce53
mov ecx, r12d
test eax, eax
jne 0x18000ce67
test ecx, ecx
jne 0x18000ce67
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x18000cdd9
cmp qword [r14 + 0x38], r12
jne 0x18000ce7f
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r15d
call fcn.18000fb6c
mov edx, r12d
test edx, edx
je 0x18000cccb
mov dl, r15b
mov ecx, 0x14
call fcn.1800016a4
mov dl, r15b
mov ecx, 0xa
call fcn.1800016a4
lea r12, [rbx + 0x18]
test dword [r12], 0x800
je 0x18000cebc
call fcn.180010d80
test eax, eax
je 0x18000cccb
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x478
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edx, edx
mov rsi, rax
test rax, rax
jne 0x18000cef4
lea rdx, str.____Abort:_could_not_allocate_provider_context_r_n
jmp 0x18000cdd9
mov qword [rax + 0x40], r14
mov rax, qword [r14 + 0x78]
test rax, rax
je 0x18000cf34
mov rcx, rsi
call rax
xor edx, edx
test eax, eax
jne 0x18000cf34
mov rax, qword gs:[0x30]
mov r8, rsi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
lea rdx, str.____Abort:_provider_prerequisites_are_not_meet_r_n
jmp 0x18000cdd9
test byte [r12], 0x40
je 0x18000cf40
mov rax, rdx
jmp 0x18000cf65
mov rax, qword [r14]
cmp dword [rax + 0x10], 2
jb 0x18000cf4d
mov dword [rax + 0x10], r15d
mov rax, qword [r14]
mov ecx, dword [rax + 0x10]
lea rax, [rcx + rcx*4]
shl rax, 4
lea rcx, str.PROCEXP152
add rax, rcx
mov qword [rsi + 0x48], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r15, qword [rcx + 0x20]
mov rcx, qword [rdi]
mov rax, rcx
test rcx, rcx
jne 0x18000cf8e
mov rcx, rdx
jmp 0x18000cf99
add rcx, 2
cmp word [rcx], dx
jne 0x18000cf8a
sub rcx, rax
sar rcx, 1
movzx eax, word [r15 + 0x38]
lea rcx, [rcx + 0x20]
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
xor edi, edi
mov qword [rsi + 0x30], rax
test rax, rax
jne 0x18000cff0
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, edi
jmp 0x18000cccb
mov rax, qword [rbp - 0x51]
mov qword [rsi + 0x10], rax
mov dword [rsi + 8], 3
mov dword [rsi + 4], r13d
call fcn.18000f6b4
mov qword [rsi + 0x18], rax
lea rdi, [rbp - 0x41]
xor eax, eax
lea r9, [rbp + 0x77]
xor r13d, r13d
mov dword [rbp + 0x77], r13d
lea edx, [rax + 0x40]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
xor ecx, ecx
lea rdx, [rbp - 0x41]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x18000d03d
mov rax, qword [rbp - 0x19]
jmp 0x18000d058
xor eax, eax
lea rdi, [rsp + 0x30]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp - 0x71]
mov ecx, 0x16
mov qword [rsi + 0x38], rax
mov r14d, 0x20206f49
call fcn.180001864
mov r8, rax
test rax, rax
je 0x18000d0bf
mov rcx, r13
cmp dword [rax], r13d
jbe 0x18000d0a6
mov edi, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov r9, rcx
cmp rdx, rcx
jbe 0x18000d092
mov r14d, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, r9
cmovbe rcx, r9
sub rdi, 1
jne 0x18000d083
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsi + 0x30]
mov dword [rsi + 0xc], r14d
movzx edx, word [r15 + 0x38]
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.180001350
mov rcx, qword [rsi + 0x30]
lea rdx, [0x18003557c]
call fcn.1800012ac
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsi + 0x30]
mov rdx, qword [rdx]
call fcn.1800012ac
mov rcx, qword [rsi + 0x30]
lea rdx, str..sys
call fcn.1800012ac
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 8]
test eax, eax
je 0x18000d18e
mov rax, qword [rsi + 0x40]
mov dword [rsi + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x18000cccb
test byte [r12], 0x40
mov rdx, rsi
jne 0x18000d13f
mov edx, dword [rbx + 8]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x18000cccb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_register_provider_driver
call fcn.180010a48
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x18000d170
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 0x10]
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x18000d1ab
mov rax, qword gs:[0x30]
jmp 0x18000d19b
mov rax, qword gs:[0x30]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, r13
jmp 0x18000cccb