Function at 0x14009d240
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0x70], rcx
mov rax, qword [0x140143788]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov eax, 0xd58bee5e
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14009d2bd
mov eax, dword [rsp + 0x4c]
cmp eax, 4
sete byte [rsp + 0x25]
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x17ddaeec
mov ecx, 0xedd9f514
nop
cmove eax, ecx
cmp dword [0x140145450], 0xa
cmovl eax, ecx
cmp eax, 0xe67e6ef5
jle 0x14009d320
cmp eax, 0x31612796
jg 0x14009d380
cmp eax, 0xfe064d88
jle 0x14009d485
cmp eax, 0x180268c5
jg 0x14009d5ac
cmp eax, 0x6c8ea88
jle 0x14009d7fa
cmp eax, 0x6c8ea89
je 0x14009db29
cmp eax, 0x902c8b7
je 0x14009d28a
cmp eax, 0x17ddaeec
jne 0x14009d2bd
mov eax, dword [rsp + 0x4c]
mov eax, 0x902c8b7
jmp 0x14009d2bd
cmp eax, 0xbe28757c
jle 0x14009d3f0
cmp eax, 0xd47ccdea
jle 0x14009d4d5
cmp eax, 0xdfea53e7
jg 0x14009d635
cmp eax, 0xd58bee5d
jle 0x14009d81a
cmp eax, 0xd58bee5e
je 0x14009db3e
cmp eax, 0xde6167f4
je 0x14009db6e
cmp eax, 0xdf1c52d2
je 0x14009dac0
jmp 0x14009d2bd
cmp eax, 0x5bc8965c
jle 0x14009d516
cmp eax, 0x6a6d18f8
jle 0x14009d678
cmp eax, 0x70c84979
jle 0x14009d885
cmp eax, 0x70c8497a
je 0x14009db8c
cmp eax, 0x716de4cc
je 0x14009dbaa
cmp eax, 0x798220b2
jne 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf4a4360
mov ecx, 0xb618c2a1
jmp 0x14009d2b0
cmp eax, 0xa7848d66
jg 0x14009d55e
cmp eax, 0x975b201f
jle 0x14009d6b7
cmp eax, 0x9b056b1e
jle 0x14009d8a5
cmp eax, 0x9b056b1f
je 0x14009dbc8
cmp eax, 0xa2cc9c62
je 0x14009dbe6
cmp eax, 0xa41b8469
jne 0x14009d2bd
movzx edx, word [rsp + 0x26]
add rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xc8]
call fcn.14006cab0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, 0x501268e1
nop dword [rax + rax]
cmp ecx, 0xbaf13077
je 0x14009dbf0
cmp ecx, 0x501268e1
jne 0x14009d460
mov rcx, qword [rsp + 0x30]
call fcn.14003af20
mov ecx, 0xbaf13077
jmp 0x14009d460
cmp eax, 0xf4ecd5f0
jle 0x14009d6e7
cmp eax, 0xf924e78b
jle 0x14009d8e8
cmp eax, 0xf924e78c
je 0x14009dc35
cmp eax, 0xfb7debaf
je 0x14009dc3f
cmp eax, 0xfd28fbfc
jne 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, 0xd3ef65d3
jmp 0x14009d2bd
cmp eax, 0xc5517bb6
jle 0x14009d727
cmp eax, 0xcaaebec6
jle 0x14009d915
cmp eax, 0xcaaebec7
je 0x14009dc5d
cmp eax, 0xcb4d287f
je 0x14009dc67
cmp eax, 0xd3ef65d3
jne 0x14009d2bd
mov eax, 0xa7848d67
jmp 0x14009d2bd
cmp eax, 0x4c87465c
jle 0x14009d785
cmp eax, 0x505f0fd1
jle 0x14009d949
cmp eax, 0x505f0fd2
je 0x14009dc9c
cmp eax, 0x512b2ea1
je 0x14009dcb3
cmp eax, 0x54c4b6d8
jne 0x14009d2bd
mov eax, 0x67525ec3
xor ecx, ecx
mov qword [rsp + 0x68], rcx
jmp 0x14009d2bd
cmp eax, 0xb8f23328
jle 0x14009d7bb
cmp eax, 0xb9de4278
jle 0x14009d970
cmp eax, 0xb9de4279
je 0x14009dcd5
cmp eax, 0xba8d1396
je 0x14009dd0b
cmp eax, 0xbd3e4cbf
jne 0x14009d2bd
cmp byte [rsp + 0x23], 0
mov eax, 0xde6167f4
mov ecx, 0x6b5de14c
cmovne eax, ecx
jmp 0x14009d2bd
cmp eax, 0x1fd49ea9
jle 0x14009d990
cmp eax, 0x1fd49eaa
je 0x14009dd1a
cmp eax, 0x24d8e64e
je 0x14009dd24
cmp eax, 0x2d30a33c
jne 0x14009d2bd
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x40]
imul rcx, rcx, 0x128
add rax, rcx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
add rax, 0x28
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x26]
mov word [rsp + 0x26], ax
mov eax, 0x31612797
jmp 0x14009d2bd
cmp eax, 0xe2deacfc
jle 0x14009d9bf
cmp eax, 0xe2deacfd
je 0x14009dd42
cmp eax, 0xe35a889a
je 0x14009dd60
cmp eax, 0xe419316e
jne 0x14009d2bd
cmp byte [rsp + 0x20], 0
mov eax, 0xa7848d67
mov ecx, 0xfd28fbfc
cmovne eax, ecx
jmp 0x14009d2bd
cmp eax, 0x631dca4c
jle 0x14009da08
cmp eax, 0x631dca4d
je 0x14009dda1
cmp eax, 0x683648f0
jne 0x14009e05c
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6a6d18f9
mov ecx, 0x382977fb
jmp 0x14009d2b0
cmp eax, 0x8a7b3444
jg 0x14009da3c
cmp eax, 0x828358e4
je 0x14009ddb3
cmp eax, 0x856a6621
jne 0x14009d2bd
mov eax, 0x67525ec3
mov qword [rsp + 0x68], rdi
jmp 0x14009d2bd
cmp eax, 0xf21d97e4
jg 0x14009da70
cmp eax, 0xe67e6ef6
je 0x14009ddd1
cmp eax, 0xedd9f514
jne 0x14009d2bd
cmp byte [rsp + 0x25], 0
mov eax, 0x856a6621
mov ecx, 0x4c086b32
cmovne eax, ecx
mov rdi, qword [rsp + 0xb8]
jmp 0x14009d2bd
cmp eax, 0xbf4a435f
jg 0x14009daaa
cmp eax, 0xbe28757d
je 0x14009ddef
cmp eax, 0xbefd756d
jne 0x14009d2bd
mov qword [rsp + 0xa0], r12
lea rcx, [rsp + 0xc8]
call fcn.140002200
mov rax, qword [rsp + 0x88]
test r14d, r14d
mov eax, 0xbe28757d
mov ecx, 0x6c8ea89
cmove eax, ecx
mov r13, qword [rsp + 0xa0]
mov ebx, r14d
jmp 0x14009d2bd
cmp eax, 0x38ff1211
jg 0x14009dacc
cmp eax, 0x31612797
je 0x14009de19
cmp eax, 0x382977fb
jne 0x14009d2bd
mov eax, 0xbefd756d
xor r14d, r14d
mov r12, qword [rsp + 0x98]
jmp 0x14009d2bd
cmp eax, 0xb4d30383
jg 0x14009dafb
cmp eax, 0xa7848d67
je 0x14009de37
cmp eax, 0xae2b6e10
jne 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9c92db5
mov ecx, 0xe419316e
jmp 0x14009d2b0
cmp eax, 0xfe064d89
je 0x14009de55
cmp eax, 0x15433d
jne 0x14009d2bd
mov eax, 0xfe064d89
jmp 0x14009d2bd
cmp eax, 0xd47ccdeb
je 0x14009de73
cmp eax, 0xd4e76bfa
jne 0x14009d2bd
movzx edx, word [rsp + 0x26]
add rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0xc8]
call fcn.14006cab0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov ecx, 0x501268e1
nop dword [rax]
cmp ecx, 0xbaf13077
je 0x14009de7d
cmp ecx, 0x501268e1
jne 0x14009d860
mov rcx, qword [rsp + 0x30]
call fcn.14003af20
mov ecx, 0xbaf13077
jmp 0x14009d860
cmp eax, 0x6a6d18f9
je 0x14009dec5
cmp eax, 0x6b5de14c
jne 0x14009d2bd
mov eax, 0x631dca4d
jmp 0x14009d2bd
cmp eax, 0x975b2020
je 0x14009decf
cmp eax, 0x99a7c2fc
jne 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x181cd9a7
mov ecx, 0xb4d30384
jmp 0x14009d2b0
cmp eax, 0xf4ecd5f1
je 0x14009def4
cmp eax, 0xf666904e
jne 0x14009d2bd
cmp byte [rsp + 0x22], 0
mov eax, 0xfb7debaf
mov ecx, 0x70c8497a
cmovne eax, ecx
jmp 0x14009d2bd
cmp eax, 0xc5517bb7
je 0x14009defe
cmp eax, 0xc877ca17
jne 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1fd49eaa
mov ecx, 0x54c4b6d8
jmp 0x14009d2b0
cmp eax, 0x4c87465d
je 0x14009df1c
cmp eax, 0x4d293ce3
jne 0x14009d2bd
mov eax, 0xf221b771
mov ebp, dword [rsp + 0x60]
xor r15d, r15d
jmp 0x14009d2bd
cmp eax, 0xb8f23329
je 0x14009df31
cmp eax, 0xb9c92db5
jne 0x14009d2bd
mov eax, 0xae2b6e10
jmp 0x14009d2bd
cmp eax, 0x180268c6
je 0x14009df46
cmp eax, 0x181cd9a7
jne 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, 0x99a7c2fc
jmp 0x14009d2bd
cmp eax, 0xdfea53e8
je 0x14009df64
cmp eax, 0xe0891727
jne 0x14009d2bd
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
setne byte [rsp + 0x23]
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xba8d1396
mov ecx, 0x15433d
jmp 0x14009d2b0
cmp eax, 0x5bc8965d
je 0x14009df78
cmp eax, 0x5faac6b3
jne 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb9c92db5
mov ecx, 0xae2b6e10
jmp 0x14009d2b0
cmp eax, 0x8a7b3445
je 0x14009df8f
cmp eax, 0x928d3a8f
jne 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xba8d1396
mov ecx, 0xe0891727
jmp 0x14009d2b0
cmp eax, 0xf21d97e5
je 0x14009dfaa
cmp eax, 0xf221b771
jne 0x14009d2bd
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x48], ebp
mov eax, dword [rsp + 0x48]
cmp eax, 0xc0000004
mov eax, 0xdfea53e8
mov ecx, 0xb8f23329
cmove eax, ecx
jmp 0x14009d2bd
cmp eax, 0xbf4a4360
je 0x14009dfc1
cmp eax, 0xbf8437a8
jne 0x14009d2bd
mov eax, 0x856a6621
xor edi, edi
jmp 0x14009d2bd
cmp eax, 0x38ff1212
je 0x14009dfda
cmp eax, 0x4c086b32
jne 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, 0xbf8437a8
jmp 0x14009d2bd
cmp eax, 0xb4d30384
je 0x14009dfe4
cmp eax, 0xb618c2a1
jne 0x14009d2bd
mov eax, 0xbefd756d
mov r14d, 1
mov r12, qword [rsp + 0xb0]
jmp 0x14009d2bd
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x64], eax
mov eax, 0x512b2ea1
jmp 0x14009d2bd
mov dword [rsp + 0xc4], 0
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
lea r9, [rsp + 0xc4]
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x60], eax
mov eax, 0x4d293ce3
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcaaebec7
mov ecx, 0x24d8e64e
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x181cd9a7
mov ecx, 0x99a7c2fc
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd47ccdeb
mov ecx, 0xa2cc9c62
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x38ff1212
mov ecx, 0x180268c6
jmp 0x14009d2b0
mov eax, 0xfb7debaf
jmp 0x14009d2bd
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov ecx, 0x501268e1
nop dword [rax]
cmp ecx, 0xbaf13077
je 0x14009dfee
cmp ecx, 0x501268e1
jne 0x14009dc10
mov rcx, qword [rsp + 0x30]
call fcn.14003af20
mov ecx, 0xbaf13077
jmp 0x14009dc10
mov eax, 0xb9de4279
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x1fd49eaa
mov ecx, 0xc877ca17
jmp 0x14009d2b0
mov eax, 0x24d8e64e
jmp 0x14009d2bd
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x98], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x40]
cmp ecx, dword [rax]
mov eax, 0x505f0fd2
mov ecx, 0x2d30a33c
cmovb eax, ecx
jmp 0x14009d2bd
mov eax, 0xbe28757d
mov ebx, 4
mov r13, qword [rsp + 0x98]
jmp 0x14009d2bd
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x44], eax
mov eax, 0xcb4d287f
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rcx
jmp 0x14009d2bd
mov r8d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x80]
mov ecx, 0xb
lea r9, [rsp + 0xc4]
call sub.ntdll.dll_NtQuerySystemInformation
mov ebp, eax
mov eax, 0xf221b771
mov r15, qword [rsp + 0x80]
jmp 0x14009d2bd
mov rax, qword [rsp + 0x28]
mov eax, 0xe0891727
jmp 0x14009d2bd
mov eax, 0xc877ca17
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcaaebec7
mov ecx, 0xdf1c52d2
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf4a4360
mov ecx, 0x798220b2
jmp 0x14009d2b0
mov edx, dword [rsp + 0xc4]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x80], rax
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x975b2020
mov ecx, 0xf924e78c
jmp 0x14009d2b0
mov eax, 0xcb4d287f
mov dword [rsp + 0x44], 0
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6a6d18f9
mov ecx, 0x683648f0
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd47ccdeb
mov ecx, 0x716de4cc
jmp 0x14009d2b0
mov qword [rsp + 0xb8], r13
mov dword [rsp + 0x4c], ebx
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x17ddaeec
mov ecx, 0x902c8b7
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4e76bfa
mov ecx, 0xa41b8469
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x975b2020
mov ecx, 0xe35a889a
jmp 0x14009d2b0
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf4ecd5f1
mov ecx, 0xc5517bb7
jmp 0x14009d2b0
mov eax, 0x716de4cc
jmp 0x14009d2bd
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov ecx, 0x501268e1
nop dword [rax]
cmp ecx, 0xbaf13077
je 0x14009e039
cmp ecx, 0x501268e1
jne 0x14009dea0
mov rcx, qword [rsp + 0x30]
call fcn.14003af20
mov ecx, 0xbaf13077
jmp 0x14009dea0
mov eax, 0x683648f0
jmp 0x14009d2bd
mov edx, dword [rsp + 0xc4]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, 0xe35a889a
jmp 0x14009d2bd
mov eax, 0xc5517bb7
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf4ecd5f1
mov ecx, 0xbd3e4cbf
jmp 0x14009d2b0
cmp qword [rsp + 0x28], 0
setne byte [rsp + 0x22]
mov eax, 0xf666904e
jmp 0x14009d2bd
cmp qword [rsp + 0x28], 0
setne byte [rsp + 0x20]
mov eax, 0x5faac6b3
jmp 0x14009d2bd
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x38ff1212
mov ecx, 0xf21d97e5
jmp 0x14009d2b0
cmp dword [rsp + 0x48], 0
setns byte [rsp + 0x21]
mov eax, 0x9b056b1f
jmp 0x14009d2bd
cmp byte [rsp + 0x24], 0
mov eax, 0x8a7b3445
mov ecx, 0x828358e4
cmovne eax, ecx
jmp 0x14009d2bd
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xb0], rax
mov eax, 0xe2deacfd
jmp 0x14009d2bd
cmp byte [rsp + 0x21], 0
mov eax, 0x4c87465d
mov ecx, 0x928d3a8f
cmovne eax, ecx
jmp 0x14009d2bd
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call rsi
mov eax, 0x798220b2
jmp 0x14009d2bd
mov eax, 0x180268c6
jmp 0x14009d2bd
mov eax, 0xe67e6ef6
jmp 0x14009d2bd
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1400ce930
test eax, eax
setne byte [rsp + 0x24]
mov eax, dword [0x14014544c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4e76bfa
mov ecx, 0x5bc8965d
cmove eax, ecx
cmp dword [0x140145450], 0xa
cmovl eax, ecx
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14009d2bd
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1400ce930
mov eax, 0xa41b8469
mov rsi, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14009d2bd
cmp eax, 0x67525ec3
jne 0x14009d2bd
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400a74d0
mov rax, qword [rsp + 0x68]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret