Function at 0x14005dbb8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x88
xor r12d, r12d
mov rax, r9
mov dword [rbp + 0x57], r12d
mov ebx, r12d
mov qword [rbp + 0x5f], rbx
mov r15, rdx
mov qword [rbp - 0x41], r12
mov r13d, r12d
mov qword [rbp - 0x39], r12
mov r14d, r12d
mov edi, r12d
mov esi, r12d
test rdx, rdx
jne 0x14005dc1d
mov ecx, 0x80070057
mov r12d, ecx
call fcn.140079c40
jmp 0x14005de91
test r8, r8
je 0x14005dc0b
test rax, rax
je 0x14005dc0b
cmp qword [rbp + 0x77], r12
je 0x14005dc0b
cmp qword [rbp + 0x7f], r12
je 0x14005dc0b
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
jne 0x14005dc54
mov r12d, 0x8007000e
mov ecx, r12d
jmp 0x14005dc13
lea rdx, [rbp + 0x5f]
mov rcx, r15
call fcn.14005216c
mov r12d, eax
test eax, eax
jns 0x14005dc73
mov ecx, eax
call fcn.140079c40
jmp 0x14005de8d
mov r14, qword [0x14043f520]
xor r12d, r12d
test r14, r14
je 0x14005de7c
lea r13, [r14 + 8]
test r13, r13
je 0x14005dca1
lea eax, [r12 + 1]
mov rcx, r13
mov edx, eax
mov dword [rbp + 0x57], eax
call fcn.140072570
mov rbx, qword [rbp + 0x5f]
lea r8, [rbp + 0x5f]
mov rcx, rbx
lea rdx, str.Volume:GVLK
call fcn.1400eb6a4
test eax, eax
jns 0x14005dcd2
mov ecx, 0xc004f306
mov r12d, ecx
call fcn.140079c40
mov r14d, dword [rbp + 0x57]
jmp 0x14005de91
lea rdx, [0x14043a50c]
lea rcx, [0x14041d268]
call fcn.1400ed8ec
cmp dword [rbp + 0x5f], r12d
jne 0x14005dd08
lea r8, [rbp + 0x5f]
mov rcx, rbx
lea rdx, str.Volume:CSVLK
call fcn.1400eb6a4
test eax, eax
js 0x14005dcbc
cmp dword [rbp + 0x5f], r12d
je 0x14005dcbc
lea r9, [rbp - 0x41]
mov qword [rsp + 0x20], r12
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call fcn.1400deaa0
mov r12d, eax
test eax, eax
jns 0x14005dd2a
mov ecx, eax
jmp 0x14005dcc4
mov r15, qword [rbp - 0x41]
lea rdx, [0x140439fd4]
and qword [rbp + 0x5f], rdi
lea rcx, [0x140424be4]
call fcn.1400ed5b8
lea r8, [rbp + 0x5f]
xor edx, edx
lea rcx, [0x1403cad70]
call fcn.1400f4880
mov r14, qword [rbp + 0x5f]
mov r12d, eax
test eax, eax
jns 0x14005dd6b
mov ecx, eax
call fcn.140079c40
jmp 0x14005dd90
lea r9, [rbp + 0x5f]
mov rdx, r14
lea r8, [rbp - 0x39]
mov rcx, r15
call fcn.14006aaac
mov r12d, eax
test eax, eax
jns 0x14005dd8c
mov ecx, eax
call fcn.140079c40
mov rdi, qword [rbp - 0x39]
mov ecx, r12d
call fcn.140079c60
test r14, r14
je 0x14005ddb8
mov rax, qword [r14]
mov r15, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, r15
call rax
mov rax, r15
mov rcx, r14
call rax
test r12d, r12d
jns 0x14005ddd8
lea rdx, [0x14043c8cc]
lea rcx, [0x140427190]
call fcn.1400ee2b8
mov ecx, r12d
jmp 0x14005dcc4
lea rdx, [0x14043c260]
mov qword [rbp - 0x15], rdi
lea rcx, [0x140416da8]
call fcn.1400edc30
mov r14d, dword [rbp + 0x5f]
lea rax, [0x140002f58]
xor r9d, r9d
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 0x31], 3
lea rdx, [rbp - 0x31]
mov qword [rbp - 0x21], rax
mov ecx, 0xb9
mov dword [rbp - 0x19], r14d
lea r8d, [r9 + 0x30]
mov dword [rbp - 0xd], reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rbp - 9], rsi
call sub.ntdll.dll_NtQuerySystemInformation
mov r12d, dword [rbp - 0x49]
test r12d, r12d
js 0x14005ddd0
mov rcx, qword [rbp + 0x6f]
lea rdx, [0x14043e2a0]
mov rax, rdi
xor edi, edi
mov qword [rcx], rax
lea rcx, [0x140420d08]
call fcn.1400edf70
mov rax, qword [rbp + 0x67]
mov rcx, qword [rbp + 0x7f]
mov dword [rax], r14d
mov rax, rsi
mov qword [rcx], rax
xor esi, esi
mov rax, qword [rbp + 0x77]
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x14005dcc9
mov r12d, 0x8000ffff
mov ecx, r12d
call fcn.140079c40
mov r14d, edi
mov rbx, qword [rbp + 0x5f]
mov ecx, r12d
call fcn.140079c60
test rsi, rsi
je 0x14005dea7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14005deb5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rdi, qword [rbp - 0x41]
test rdi, rdi
je 0x14005dede
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rdi
call rax
and qword [rbp - 0x41], 0
test rbx, rbx
je 0x14005deec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r13, r13
je 0x14005defe
test r14d, r14d
je 0x14005defe
mov rcx, r13
call fcn.14007240c
mov eax, r12d
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret