Function at 0x140088799
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov eax, dword [0x1403fb214]
mov edx, dword [0x1403fb218]
lea ebx, [rax - 1]
imul ebx, eax
test bl, 1
sete byte [rbp + 0x27]
cmp edx, 0xa
setl byte [rbp + 0x26]
mov qword [rbp - 0x28], rcx
mov eax, 0xbee6c187
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp eax, 0x77d8ead
jg 0x14008885f
cmp eax, 0xd408862b
jle 0x1400888b3
cmp eax, 0xeee3a2b0
jle 0x14008893d
cmp eax, 0xff02972f
jg 0x140088a54
cmp eax, 0xeee3a2b1
je 0x140088c12
cmp eax, 0xf9502f06
je 0x140088c7a
cmp eax, 0xfc3a2ac8
jne 0x1400887e4
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x68], rax
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.140037744
add rsp, 0x20
mov rax, qword [rbp - 0x50]
test r15d, r15d
mov eax, 0x31455f5b
mov ecx, 0x402462e5
cmove eax, ecx
mov r13, qword [rbp - 0x68]
mov r14d, r15d
jmp 0x1400887e4
cmp eax, 0x52c28646
jle 0x1400888fc
cmp eax, 0x65292a96
jle 0x140088987
cmp eax, 0x6f498e0b
jg 0x140088a7f
cmp eax, 0x65292a97
je 0x140088c98
cmp eax, 0x65fb1f4f
je 0x140088cb8
cmp eax, 0x6b046c16
jne 0x1400887e4
mov rax, qword [rbp]
mov qword [rbp - 0x48], rax
mov eax, 0xbda98fe6
jmp 0x1400887e4
cmp eax, 0xa0de33f5
jg 0x1400889c7
cmp eax, 0x87d4ff13
jg 0x140088aaa
cmp eax, 0x80a853f2
je 0x140088cce
cmp eax, 0x80f9ffd6
je 0x140088cda
cmp eax, 0x8734e94e
jne 0x1400887e4
cmp dword [rbp + 0x14], 0
setns byte [rbp + 0x24]
mov eax, 0x65fb1f4f
jmp 0x1400887e4
cmp eax, 0x31455f5a
jg 0x140088a08
cmp eax, 0xe846eac
jle 0x140088ad6
cmp eax, 0xe846ead
je 0x140088cf0
cmp eax, 0x17494c74
je 0x140088d10
cmp eax, 0x27edaed5
jne 0x1400887e4
mov eax, 0x78b40dc7
jmp 0x1400887e4
cmp eax, 0xdca1dfea
jle 0x140088af6
cmp eax, 0xdca1dfeb
je 0x140088d28
cmp eax, 0xe294f8b4
je 0x140088d52
cmp eax, 0xeb8f70c6
jne 0x1400887e4
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5dc4bc0e
mov ecx, 0xeee3a2b1
jmp 0x140088eed
cmp eax, 0x55ddfed0
jle 0x140088b52
cmp eax, 0x55ddfed1
je 0x140088d66
cmp eax, 0x5dc4bc0e
je 0x140088d8f
cmp eax, 0x5f95fd95
jne 0x1400887e4
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov eax, 0xff029730
jmp 0x1400887e4
cmp eax, 0xbda98fe5
jle 0x140088b86
cmp eax, 0xbda98fe6
je 0x140088ddd
cmp eax, 0xbee6c187
je 0x140088dee
cmp eax, 0xcdefd92b
jne 0x1400887e4
mov eax, 0xfc3a2ac8
xor r15d, r15d
mov rcx, qword [rbp - 0x60]
mov qword [rbp - 0x30], rcx
jmp 0x1400887e4
cmp eax, 0x400f1c9e
jle 0x140088bd0
cmp eax, 0x400f1c9f
je 0x140088e0c
cmp eax, 0x402462e5
je 0x140088e1d
cmp eax, 0x4f12d26b
jne 0x1400887e4
mov rcx, qword [rbp]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0x80a853f2
jmp 0x1400887e4
cmp eax, 0xff029730
je 0x140088e2f
cmp eax, 0x427249a
je 0x140088e57
cmp eax, 0x5e0a226
jne 0x1400887e4
mov eax, 0x557300e1
jmp 0x1400887e4
cmp eax, 0x6f498e0c
je 0x140088e7e
cmp eax, 0x78b40dc7
je 0x140088ea0
cmp eax, 0x7f341b83
jne 0x1400887e4
mov eax, 0xd408862c
jmp 0x1400887e4
cmp eax, 0x915499e6
je 0x140088eff
cmp eax, 0x99afe28a
jne 0x140088faf
cmp byte [rbp + 0x25], 0
mov eax, 0x8734e94e
mov ecx, 0xf9502f06
cmovne eax, ecx
jmp 0x1400887e4
cmp eax, 0x77d8eae
je 0x140088f0f
cmp eax, 0xded3951
jne 0x1400887e4
mov eax, 0xdca1dfeb
jmp 0x1400887e4
cmp eax, 0xd408862c
je 0x140088f1d
cmp eax, 0xd43e51d9
jne 0x1400887e4
mov rax, qword [rbp + 8]
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov ecx, dword [rbp + 0x10]
imul rcx, rcx, 0x128
add rax, rcx
add rax, 8
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x10]
movzx ecx, word [rcx + 0x26]
add rax, rcx
add rax, 0x28
mov qword [rbp - 0x58], rax
mov eax, 0xeb8f70c6
jmp 0x1400887e4
cmp eax, 0x52c28647
je 0x140088f71
cmp eax, 0x557300e1
jne 0x1400887e4
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f95fd95
mov ecx, 0xff029730
jmp 0x140088eed
cmp eax, 0xa0de33f6
je 0x140088f89
cmp eax, 0xb91d9bb8
jne 0x1400887e4
mov rcx, qword [rbp]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x65292a97
mov ecx, 0x7f341b83
jmp 0x140088eed
cmp eax, 0x31455f5b
je 0x140088f96
cmp eax, 0x3680a385
jne 0x1400887e4
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x78], rax
mov rcx, qword [rbp]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0x17494c74
jmp 0x1400887e4
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp - 0x58]
sub rsp, 0x20
call fcn.14001c7ea
mov rcx, qword [rbp - 0x28]
call fcn.1400139cc
add rsp, 0x20
mov rsi, rax
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.1400139cc
mov rcx, rax
mov rdx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.14031e474
add rsp, 0x20
test eax, eax
setne byte [rbp + 0x23]
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5dc4bc0e
mov ecx, 0x80f9ffd6
jmp 0x140088eed
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x65292a97
mov ecx, 0xb91d9bb8
jmp 0x140088eed
mov rcx, qword [rbp]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0xb91d9bb8
jmp 0x1400887e4
cmp byte [rbp + 0x24], 0
mov eax, 0xe846ead
mov ecx, 0x6b046c16
cmovne eax, ecx
jmp 0x1400887e4
mov eax, 0x77d8eae
xor edi, edi
jmp 0x1400887e4
cmp byte [rbp + 0x23], 0
mov eax, 0x3680a385
mov ecx, 0xcdefd92b
cmovne eax, ecx
jmp 0x1400887e4
mov rcx, qword [rbp]
sub rsp, 0x20
xor edx, edx
mov r8d, 0x8000
call rsi
add rsp, 0x20
mov eax, 0x915499e6
jmp 0x1400887e4
mov eax, 0xfc3a2ac8
mov r15d, 1
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x30], rcx
jmp 0x1400887e4
mov r9, qword [rbp + 0x18]
sub rsp, 0x20
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov ebx, eax
mov eax, 0x6f498e0c
xor r12d, r12d
jmp 0x1400887e4
mov eax, 0x31455f5b
mov r14d, 4
mov r13, qword [rbp - 0x60]
jmp 0x1400887e4
mov rax, qword [rbp - 0x70]
mov qword [rbp - 0x60], rax
mov eax, dword [rbp - 4]
mov dword [rbp + 0x10], eax
mov rax, qword [rbp - 0x48]
mov ecx, dword [rbp + 0x10]
cmp ecx, dword [rax]
mov eax, 0xe294f8b4
mov ecx, 0xd43e51d9
cmovb eax, ecx
jmp 0x1400887e4
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp - 0x58]
sub rsp, 0x20
call fcn.14001c7ea
mov rcx, qword [rbp - 0x28]
call fcn.1400139cc
add rsp, 0x20
mov rsi, rax
mov rcx, qword [rbp + 8]
sub rsp, 0x20
call fcn.1400139cc
mov rcx, rax
mov rdx, rsi
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.14031e474
add rsp, 0x20
mov eax, 0xeee3a2b1
jmp 0x1400887e4
mov eax, 0x55ddfed1
mov dword [rbp - 4], 0
jmp 0x1400887e4
mov cl, byte [rbp + 0x27]
cmp byte [rbp + 0x26], 0
mov eax, 0x27edaed5
mov edx, 0x78b40dc7
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x1400887e4
mov r12, qword [rbp - 0x40]
mov eax, 0x6f498e0c
mov ebx, dword [rbp - 0x14]
jmp 0x1400887e4
mov eax, dword [rbp + 0x10]
inc eax
mov dword [rbp - 0x18], eax
mov eax, 0x52c28647
jmp 0x1400887e4
mov rax, qword [rbp + 0x18]
mov dword [rax], 0
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f95fd95
mov ecx, 0xded3951
jmp 0x140088eed
mov eax, dword [rbp + 0x14]
cmp eax, 0xc0000004
sete byte [rbp + 0x25]
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0de33f6
mov ecx, 0x99afe28a
jmp 0x140088eed
mov qword [rbp], r12
mov dword [rbp + 0x14], ebx
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0de33f6
mov ecx, 0x427249a
jmp 0x140088eed
mov eax, reloc.WS2_32.dll_recv
call fcn.1401e5ba0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0x18], rax
mov eax, 0x20
call fcn.1401e5ba0
sub rsp, rax
mov rax, rsp
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x38]
mov eax, dword [0x1403fb214]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x27edaed5
mov ecx, 0x5e0a226
cmove eax, ecx
cmp dword [0x1403fb218], 0xa
cmovl eax, ecx
jmp 0x1400887e4
mov eax, 0x87d4ff14
xor ecx, ecx
mov qword [rbp - 0x20], rcx
jmp 0x1400887e4
mov eax, 0x87d4ff14
mov qword [rbp - 0x20], rdi
jmp 0x1400887e4
mov rax, qword [rbp + 0x18]
mov edx, dword [rax]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x18]
mov r8d, dword [rax]
mov r9, qword [rbp + 0x18]
mov rdx, qword [rbp - 0x40]
sub rsp, 0x20
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
mov dword [rbp - 0x14], eax
mov eax, 0x400f1c9f
jmp 0x1400887e4
mov eax, dword [rbp - 0x18]
mov dword [rbp - 4], eax
mov eax, 0x55ddfed1
mov rcx, qword [rbp - 0x68]
mov qword [rbp - 0x70], rcx
jmp 0x1400887e4
mov eax, dword [rbp + 0x14]
mov eax, 0x427249a
jmp 0x1400887e4
cmp r14d, 4
mov eax, 0x77d8eae
mov ecx, 0x4f12d26b
cmove eax, ecx
mov rdi, r13
jmp 0x1400887e4
cmp eax, 0x87d4ff14
jne 0x1400887e4
mov rax, qword [rbp - 0x38]
mov rax, qword [rbp - 0x20]
lea rsp, [rbp + 0x28]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret