Function at 0x1400bbcc0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push r12
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r8d, dword [0x140113040]
xor r12d, r12d
mov rax, qword gs:[0x58]
mov r15d, edx
mov ecx, 4
mov dword [rbp + 0x77], r12d
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1401125b8], eax
jg 0x1400bc2a5
cmp qword [0x1401125b0], r12
jne 0x1400bbd24
xor eax, eax
add rsp, 0x100
pop r15
pop r12
pop rbp
ret
mov qword [rsp + 0xf8], rbx
mov ecx, 0x20
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xd8], r14
call fcn.1400ca714
xor edx, edx
mov qword [rbp - 0x51], rax
mov r8d, r15d
mov rbx, rax
lea ecx, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400bc1fd
mov r8d, 0x20
lea r9, [rbp + 0x77]
mov rdx, rbx
lea ecx, [r8 - 0x10]
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400bbdc2
mov edx, dword [rbp + 0x77]
mov rcx, rbx
call fcn.1400ca71c
mov r8d, dword [rbp + 0x77]
lea r9, [rbp + 0x77]
mov rdx, rax
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rax
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400bbd94
mov qword [rbp - 0x51], rbx
test eax, eax
js 0x1400bc1fd
mov eax, r12d
mov dword [rbp + 0x7f], eax
cmp dword [rbx], r12d
jbe 0x1400bc1fd
movzx esi, byte [rbp + 0x77]
movzx r14d, byte [rbp + 0x77]
lea rcx, [rax + rax*2]
mov qword [rbp - 0x69], r12
movups xmm2, xmmword [rbx + rcx*8 + 8]
mov qword [rbp - 0x61], send
xorps xmm1, xmm1
movd eax, xmm2
movups xmmword [rbp - 0x79], xmm1
mov byte [rbp - 0x79], 0
movups xmmword [rbp - 0x11], xmm2
cmp eax, r15d
jne 0x1400bc1ed
mov ecx, 0x68
mov r15d, ecx
call fcn.1400ca714
mov rbx, qword [0x1401125b0]
mov r13, rax
mov qword [rbp - 0x59], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
movups xmm0, xmmword [rbp - 0x11]
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x59]
mov r8, rax
mov dword [rsp + 0x28], r12d
pextrw edx, xmm0, 3
mov rcx, rdi
mov dword [rsp + 0x20], r12d
call rbx
nop dword [rax + rax]
mov rcx, qword [rbp - 0x59]
lea rax, [rbp + 0x77]
mov r9d, r15d
mov qword [rsp + 0x20], rax
mov r8, r13
mov edx, 2
call qword [sym.imp.ntdll.dll_NtQueryObject]
mov r15d, dword [rbp + 0x77]
mov rcx, r13
mov edx, r15d
mov ebx, eax
call fcn.1400ca71c
mov r13, rax
cmp ebx, 0xc0000004
je 0x1400bbe60
test ebx, ebx
js 0x1400bc18e
mov rdx, qword [r13 + 8]
lea r8, str.File
mov rax, r12
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x1400bc18e
cmp rax, 5
jne 0x1400bbeb0
mov rcx, qword [rbp - 0x69]
cmp rcx, 0x104
jb 0x1400bbef5
cmp qword [rbp - 0x61], 0x10
lea rax, [rbp - 0x79]
mov qword [rbp - 0x69], 0x104
cmovae rax, qword [rbp - 0x79]
mov byte [rax + 0x104], 0
jmp 0x1400bbf51
mov rdx, qword [rbp - 0x61]
mov r15d, 0x104
mov rax, rdx
sub r15, rcx
sub rax, rcx
cmp r15, rax
ja 0x1400bbf39
cmp rdx, 0x10
mov qword [rbp - 0x69], 0x104
lea rbx, [rbp - 0x79]
mov r8, r15
cmovae rbx, qword [rbp - 0x79]
xor edx, edx
add rbx, rcx
mov rcx, rbx
call fcn.1400e5340
mov byte [rbx + r15], 0
jmp 0x1400bbf51
mov r9, r15
mov byte [rsp + 0x20], 0
movzx r8d, sil
lea rcx, [rbp - 0x79]
mov rdx, r15
call fcn.1400232f0
cmp qword [rbp - 0x61], 0x10
lea rdx, [rbp - 0x79]
mov rcx, qword [rbp - 0x59]
mov r8d, 0x104
cmovae rdx, qword [rbp - 0x79]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleA]
mov r8, qword [rbp - 0x61]
lea r10, [rbp - 0x79]
mov r9, qword [rbp - 0x79]
lea rcx, [rbp - 0x79]
mov rbx, qword [rbp - 0x69]
lea rax, [rbp - 0x79]
cmp r8, 0x10
cmovae r10, r9
add r10, 4
cmp r8, 0x10
cmovae rcx, r9
cmovae rax, r9
sub r10, rcx
mov rdx, rcx
sub rdx, rax
lea rcx, [rbp - 0x79]
mov rax, rbx
sub rax, rdx
cmp rax, r10
cmovb r10, rax
cmp r8, 0x10
cmovae rcx, r9
sub rbx, r10
add rcx, rdx
mov r8, rbx
sub r8, rdx
inc r8
lea rdx, [rcx + r10]
call fcn.1400e4ca0
mov rax, qword [rbp + 0x67]
mov qword [rbp - 0x69], rbx
mov r15, rax
mov qword [rbp - 0x19], rax
cmp qword [rax + 0x18], 8
jb 0x1400bbff9
mov r15, qword [rax]
mov qword [rbp - 0x19], r15
mov rbx, qword [rax + 0x10]
mov qword [rbp - 0x21], rbx
call fcn.1400e98a4
mov dword [rbp - 0x29], eax
xorps xmm0, xmm0
mov qword [rbp - 0x39], r12
mov r8d, send
mov qword [rbp - 0x31], r8
movups xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x49], 0
test rbx, rbx
je 0x1400bc115
cmp rbx, 0x7fffffff
ja 0x1400bc305
xor r9d, r9d
mov dword [rsp + 0x20], r12d
mov r8d, ebx
mov rdx, r15
mov ecx, eax
call fcn.1400e9914
mov rbx, rax
mov qword [rbp - 0x11], rax
shr rax, 0x20
test eax, eax
jne 0x1400bc2fc
mov rdx, qword [rbp - 0x39]
movsxd rcx, ebx
cmp rcx, rdx
ja 0x1400bc084
cmp qword [rbp - 0x31], 0x10
lea rax, [rbp - 0x49]
mov qword [rbp - 0x39], rcx
cmovae rax, qword [rbp - 0x49]
mov byte [rax + rcx], 0
jmp 0x1400bc0e0
mov r8, qword [rbp - 0x31]
mov r12, rcx
mov rax, r8
sub r12, rdx
sub rax, rdx
cmp r12, rax
ja 0x1400bc0c5
cmp r8, 0x10
mov qword [rbp - 0x39], rcx
lea r15, [rbp - 0x49]
mov r8, r12
cmovae r15, qword [rbp - 0x49]
add r15, rdx
xor edx, edx
mov rcx, r15
call fcn.1400e5340
mov byte [r15 + r12], 0
mov r15, qword [rbp - 0x19]
jmp 0x1400bc0dd
mov r9, r12
mov byte [rsp + 0x20], 0
movzx r8d, r14b
lea rcx, [rbp - 0x49]
mov rdx, r12
call fcn.1400232f0
xor r12d, r12d
cmp qword [rbp - 0x31], 0x10
lea r9, [rbp - 0x49]
mov r8d, dword [rbp - 0x21]
mov rdx, r15
cmovae r9, qword [rbp - 0x49]
mov ecx, dword [rbp - 0x29]
mov dword [rsp + 0x20], ebx
call fcn.1400e9914
mov qword [rbp - 0x21], rax
shr rax, 0x20
test eax, eax
jne 0x1400bc2f3
mov r8, qword [rbp - 0x31]
mov r9, qword [rbp - 0x49]
lea rdx, [rbp - 0x49]
cmp r8, 0x10
lea rax, [rbp - 0x79]
cmovae rdx, r9
cmp qword [rbp - 0x61], 0x10
cmovae rax, qword [rbp - 0x79]
sub rdx, rax
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1400bc14a
inc rax
test cl, cl
jne 0x1400bc136
mov ebx, r12d
jmp 0x1400bc14f
sbb ebx, ebx
or ebx, 1
cmp r8, 0x10
jb 0x1400bc186
lea rdx, [r8 + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x1400bc17e
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bc299
mov rcx, r9
call fcn.1400e2ce8
test ebx, ebx
je 0x1400bc251
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x1400bc19d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r13, r13
je 0x1400bc1aa
mov rcx, r13
call fcn.1400c7c34
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400bc1e5
mov rcx, qword [rbp - 0x79]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bc1e0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bc29f
call fcn.1400e2ce8
mov r15d, dword [rbp + 0x6f]
mov rbx, qword [rbp - 0x51]
mov eax, dword [rbp + 0x7f]
inc eax
mov dword [rbp + 0x7f], eax
cmp eax, dword [rbx]
jb 0x1400bbde2
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x1400bc20b
call fcn.1400c7c34
test rdi, rdi
je 0x1400bc219
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0xe0]
mov rax, r12
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
mov r14, qword [rsp + 0xd8]
add rsp, 0x100
pop r15
pop r12
pop rbp
ret
mov r12, qword [rbp - 0x59]
mov rcx, r13
call fcn.1400c7c34
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x1400bc1fd
mov rcx, qword [rbp - 0x79]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bc28f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400bc29f
call fcn.1400e2ce8
jmp 0x1400bc1fd
call fcn.1400c4dd4
int3
call fcn.1400c4dd4
int3
lea rcx, [0x1401125b8]
call fcn.1400e2fac
cmp dword [0x1401125b8], 0xffffffff
jne 0x1400bbd0c
lea rcx, [0x1400f1f88]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtDuplicateObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1401125b8]
mov qword [0x1401125b0], rax
call fcn.1400e2f40
jmp 0x1400bbd0c
mov ecx, dword [rbp - 0x1d]
call fcn.140027a20
int3
mov ecx, dword [rbp - 0xd]
call fcn.140027a20
int3
mov ecx, socket
call fcn.1400279e0
int3