Function at 0x140098240
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb0
mov rdx, qword [0x140159170]
mov rsi, rcx
mov ecx, 0x48
mov r15d, r8d
call fcn.1400601a0
mov rcx, qword [0x140159238]
lea r12, [0x1400580c0]
lea r14, [0x1400580d0]
mov edx, 4
mov r8d, 0x200
mov rbx, rax
mov dword [rax], 8
mov qword [rax + 8], r12
mov qword [rax + 0x10], r14
mov dword [rax + 0x18], 0x80
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbx + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rbx + 0x20], rax
call fcn.1400e6910
mov eax, dword [rbx + 0x18]
mov edx, 4
mov rcx, qword [0x140159238]
mov dword [rbx + 0x28], eax
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdx, qword [0x140159170]
xor r13d, r13d
mov ecx, 0x48
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], r13d
mov dword [rbx + 0x40], r13d
mov dword [rbx + 0x3c], 0xffffffff
call fcn.1400601a0
mov rcx, qword [0x140159238]
mov edx, 4
mov r8d, 0x200
mov rdi, rax
mov dword [rax], 8
mov qword [rax + 8], r12
mov qword [rax + 0x10], r14
mov dword [rax + 0x18], 0x80
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword ds:[rdi + 0x18]
mov edx, 0xff
shl r8, 2
mov rcx, rax
mov qword [rdi + 0x20], rax
call fcn.1400e6910
mov eax, dword [rdi + 0x18]
mov edx, 4
mov r14, qword [0x140159238]
mov rcx, r14
mov dword [rdi + 0x28], eax
lea r8, [rax + rax*2]
shl r8, 3
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword ds:[rdi + 0x38], r13d
mov qword [rdi + 0x30], rax
mov dword [rdi + 0x3c], 0xffffffff
mov dword [rdi + 0x40], r13d
cmp rsi, 4
jne 0x14009851c
mov ebx, dword [0x1401570c8]
mov edx, esi
mov r8d, ebx
mov dword [rbp + 0x77], ebx
mov rcx, r14
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rbp + 0x77]
mov r8d, ebx
mov rdx, rax
mov ecx, 0x4d
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x14009842a
mov rcx, qword [0x140159238]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x77]
mov edx, 4
mov rcx, qword [0x140159238]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x77]
lea r9, [rbp + 0x77]
mov rdx, rax
mov ecx, 0x4d
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test ebx, ebx
js 0x140098455
mov eax, dword [rbp + 0x77]
cmp eax, 0x100000
ja 0x14009843e
mov dword [0x1401570c8], eax
lfence
mov r9, qword [rbp + 0x7f]
mov r8, rdi
mov rcx, rsi
call fcn.140097a40
jmp 0x140098505
mov ebx, dword [0x140157090]
mov edx, 4
mov rcx, qword [0x140159238]
mov r8d, ebx
mov dword [rbp + 0x5f], ebx
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
lea r9, [rbp + 0x5f]
mov r8d, ebx
mov rdx, rax
mov ecx, 0xb
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x1400984d7
mov rcx, qword [0x140159238]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x5f]
mov edx, 4
mov rcx, qword [0x140159238]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x5f]
lea r9, [rbp + 0x5f]
mov rdx, rax
mov ecx, 0xb
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test ebx, ebx
js 0x1400986a9
mov eax, dword [rbp + 0x5f]
cmp eax, 0x100000
ja 0x1400984ef
mov dword [0x140157090], eax
lfence
mov r9, qword [rbp + 0x7f]
mov r8, rdi
mov rcx, rsi
call fcn.140097780
mov rcx, qword [0x140159238]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400986a9
mov rcx, qword [rbp + 0x67]
xor r14b, r14b
test rcx, rcx
jne 0x1400985ef
cmp dword [0x1401596fc], 3
lea rcx, [rbp + 0x67]
mov qword [rbp - 0x61], rsi
mov edx, 0x410
mov qword [rbp - 0x59], r13
jl 0x140098551
lea r8, [rbp - 0x61]
call fcn.14007a560
jmp 0x140098587
xorps xmm0, xmm0
mov dword [rbp - 0x19], 0x30
lea r9, [rbp - 0x61]
mov qword [rbp - 0x11], r13
lea r8, [rbp - 0x19]
mov dword [rbp - 1], r13d
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp - 9], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
nop word [rax + rax]
cmp eax, 0xc0000022
je 0x14009858b
test eax, eax
jns 0x1400985e8
cmp dword [0x1401596fc], 3
lea rcx, [rbp + 0x67]
mov qword [rbp - 0x61], rsi
mov edx, 0x1010
mov qword [rbp - 0x59], r13
jl 0x1400985b0
lea r8, [rbp - 0x61]
call fcn.14007a560
jmp 0x1400985d9
xorps xmm0, xmm0
mov dword [rbp - 0x19], 0x30
lea r9, [rbp - 0x61]
mov qword [rbp - 0x11], r13
lea r8, [rbp - 0x19]
mov dword [rbp - 1], r13d
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp - 9], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
test eax, eax
js 0x1400986a9
mov rcx, qword [rbp + 0x67]
mov r14b, 1
mov rsi, qword [rbp + 0x7f]
lea rax, [0x1400974e0]
mov qword [rbp - 0x51], rax
lea r12, [0x14006c180]
lea rax, [rbp - 0x39]
mov qword [rbp - 0x31], r12
lea r8, [rbp - 0x51]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], 1
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x41], 2
call fcn.1400968e0
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 0x77]
mov r9d, 8
mov qword [rsp + 0x20], r13
mov edx, 0x1a
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14009867e
cmp qword [rbp + 0x77], r13
je 0x14009867e
mov rcx, qword [rbp + 0x67]
lea r8, [rbp - 0x51]
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], 3
mov qword [rbp - 0x39], rdi
call fcn.140096da0
mov ebx, eax
nop
test r15b, 3
je 0x14009869a
mov rcx, qword [rbp + 0x67]
mov r9, rdi
mov edx, r15d
mov qword [rsp + 0x20], rsi
call fcn.140097de0
test r14b, r14b
je 0x1400986a9
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rdi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400986c5
nop dword [rax]
call fcn.1400602c0
mov eax, ebx
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret