Function at 0x1400af740
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r14
sub rsp, 0x40
movsx eax, byte [0x14015f3d8]
xor r9d, r9d
mov r14, rdx
mov qword [rsp + 0x30], r12
mov rdx, qword [0x14015e2b8]
movzx r12d, cl
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movss xmm2, dword [0x140137844]
xor r8d, r8d
mov eax, r8d
mov qword [0x14015e0c0], r8
xor r10d, r10d
mov qword [0x14015e0c8], rax
cmp byte [0x14015f3d8], al
mov ecx, r8d
mov qword [0x14015e0d0], rcx
mov qword [0x14015e0d8], r8
mov qword [0x14015e0e0], r8
mov qword [0x14015e0e8], r8
jbe 0x1400af962
mov r11, qword [0x14015e080]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x14015e140]
mov qword [rsp + 0x58], rbp
mov rbp, qword [0x14015e078]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x14015e0a0]
mov qword [rsp + 0x28], r13
mov r13, qword [0x14015e2b8]
mov qword [rsp + 0x20], r15
mov r15, qword [0x14015e2b0]
nop word [rax + rax]
lea rdx, [r10 + r10*2]
mov r9d, r10d
add r9, r9
shl rdx, 4
add rdx, r13
mov rcx, qword [rdx + 0x18]
mov rax, rcx
sub rax, qword [rdx]
add rax, qword [rdx + 0x20]
add qword [rdx + 8], rax
add qword [0x14015e0d8], rcx
mov rax, qword [rdx]
add qword [0x14015e0c0], rax
mov eax, dword [rdx + 0x28]
add dword [0x14015e0e8], eax
mov rax, qword [rdx + 0x20]
add qword [0x14015e0e0], rax
mov rax, qword [rdx + 8]
add qword [0x14015e0c8], rax
mov rax, qword [rdx + 0x10]
add qword [0x14015e0d0], rax
mov rax, qword [rdx + 8]
sub rax, qword [rbp + r9*8]
mov qword [rbp + r9*8 + 8], rax
mov rax, qword [rdx + 8]
mov qword [rbp + r9*8], rax
mov rax, qword [rdx + 0x10]
sub rax, qword [r11 + r9*8]
mov qword [r11 + r9*8 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [r11 + r9*8], rax
mov rsi, qword [rdx]
sub rsi, qword [r15 + r9*8]
mov qword [r15 + r9*8 + 8], rsi
mov rax, qword [rdx]
mov qword [r15 + r9*8], rax
test r12b, r12b
je 0x1400af91c
mov rcx, qword [rbp + r9*8 + 8]
mov rax, qword [r11 + r9*8 + 8]
add rax, rcx
add rax, rsi
je 0x1400af912
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
test rax, rax
jns 0x1400af8d5
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
test rcx, rcx
jns 0x1400af8e6
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rdi + r10*4], xmm0
xorps xmm0, xmm0
mov rax, qword [r11 + r9*8 + 8]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x1400af906
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rbx + r10*4], xmm0
jmp 0x1400af91c
xor eax, eax
mov dword [rdi + r10*4], eax
mov dword [rbx + r10*4], eax
movsx eax, byte [0x14015f3d8]
inc r10d
cmp r10d, eax
jb 0x1400af810
mov rcx, qword [0x14015e0d0]
mov rax, qword [0x14015e0c8]
mov r8, qword [0x14015e0c0]
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rdx, rax
mov r9, rcx
sub rdx, qword [0x14015e130]
sub r9, qword [0x14015e120]
mov qword [0x14015e130], rax
mov rax, r8
sub rax, qword [0x14015e090]
mov qword [0x14015e120], rcx
mov qword [0x14015e138], rdx
mov qword [0x14015e128], r9
lea rcx, [rax + r9]
mov qword [0x14015e098], rax
add rcx, rdx
mov qword [0x14015e090], r8
test r12b, r12b
mov r12, qword [rsp + 0x30]
je 0x1400afa26
test rcx, rcx
je 0x1400afa12
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
jns 0x1400af9ce
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
test rdx, rdx
jns 0x1400af9df
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [0x14015e074], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, r9
test r9, r9
jns 0x1400af9fc
addss xmm0, xmm2
divss xmm0, xmm1
mov qword [r14], rcx
movss dword [0x14015e070], xmm0
add rsp, 0x40
pop r14
ret
mov dword [0x14015e074], 0
mov dword [0x14015e070], 0
mov qword [r14], rcx
add rsp, 0x40
pop r14
ret