Function at 0x180005304
Capabilities:
Access peb ldr_data
Get ntdll base address
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r14
push r15
sub rsp, 0xa0
xor r14d, r14d
mov edi, r8d
mov ebx, r14d
test edx, edx
je 0x18000533d
test byte [0x180024cf0], 1
je 0x18000567a
cmp edi, dword [0x180024ce0]
jb 0x18000567a
mov rax, qword [0x180024ce4]
cmp eax, 0xffffffff
je 0x18000535d
cmp edi, eax
ja 0x18000567a
lea r15, [0x1800052e8]
cmp qword [0x180024d48], r15
je 0x18000567a
cmp qword [0x180024d50], r15
je 0x18000567a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor edx, edx
lea rcx, str.drv64.dll
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x18000567a
mov ecx, 0x14
call fcn.1800069c4
test eax, eax
js 0x18000567a
mov ecx, 0xa
call fcn.1800069c4
test eax, eax
js 0x18000567a
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x458
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
je 0x18000567a
lea rax, [0x180024ce0]
mov qword [rbx + 0x38], rax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov rbp, qword [rdx + 0x20]
mov rdx, qword [str.RTCore64]
mov rcx, rdx
test rdx, rdx
jne 0x180005427
mov rcx, r14
jmp 0x18000543d
cmp word [rdx], r14w
je 0x180005437
add rcx, 2
cmp word [rcx], r14w
jne 0x18000542d
sub rcx, rdx
sar rcx, 1
movzx eax, word [rbp + 0x38]
lea rcx, [rcx + 0x20]
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x18000565b
mov dword [rbx + 4], edi
mov rdi, r14
mov dword [rbx + 8], 3
mov qword [rbx + 0x10], rsi
call fcn.180006fa0
test rax, rax
je 0x1800054ad
mov rcx, qword gs:[0x30]
mov r8, rax
mov rdi, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor eax, eax
mov qword [rbx + 0x18], rdi
lea rdi, [rsp + 0x60]
mov dword [rsp + 0xd8], r14d
lea r9, [rsp + 0xd8]
lea edx, [rax + 0x40]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
xor ecx, ecx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1800054ed
mov rax, qword [rsp + 0x88]
jmp 0x180005509
xor eax, eax
lea rdi, [rsp + 0x28]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x38]
mov ecx, 0x16
mov qword [rbx + 0x30], rax
mov esi, 0x20206f49
call fcn.180006eb8
mov r8, rax
test rax, rax
je 0x18000556e
mov rcx, r14
cmp dword [rax], r14d
jbe 0x180005555
mov edi, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov r9, rcx
cmp rdx, rcx
jbe 0x180005541
mov esi, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, r9
cmovbe rcx, r9
sub rdi, 1
jne 0x180005533
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbx + 0x28]
mov dword [rbx + 0xc], esi
movzx edx, word [rbp + 0x38]
mov r8, qword [rbp + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.18000103c
mov rcx, qword [rbx + 0x28]
lea rdx, [0x180020ba8]
call section..text
mov rdx, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x28]
mov rdx, qword [rdx + 0x20]
call section..text
mov rcx, qword [rbx + 0x28]
lea rdx, str..sys
call section..text
mov rax, qword [rbx + 0x38]
mov qword [rsp + 0x20], r14
mov rdi, qword [rax + 0x28]
mov rdx, rdi
call fcn.180007634
test al, al
jne 0x1800055de
mov rcx, rbx
call fcn.180005104
test eax, eax
je 0x180005621
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax + 0x48]
cmp rdx, r15
je 0x1800055f0
mov rcx, rbx
call rdx
lea r8, [rsp + 0x20]
mov edx, 0xc0040000
mov rcx, rdi
call fcn.180006dc0
test eax, eax
js 0x180005621
mov rax, qword [rsp + 0x20]
mov qword [rbx + 0x20], rax
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax + 0x50]
cmp rdx, r15
je 0x180005621
mov rcx, rbx
call rdx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18000563e
mov rax, qword [rbx + 0x38]
mov rdi, qword [rax + 0x38]
cmp rdi, r15
je 0x18000567a
mov edx, dword [rax + 8]
call rdi
jmp 0x18000567a
mov rax, qword gs:[0x30]
xor edx, edx
mov r8, qword [rbx + 0x28]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, r14
lea r11, [rsp + 0xa0]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret