Function at 0x140058a40
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x190
xor r13d, r13d
xorps xmm0, xmm0
mov rdi, rcx
mov dword [rsp + 0x50], r13d
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm0
xor eax, eax
mov qword [rbp + 0x38], r13
lea rcx, [rbp - 0x28]
movdqa xmmword [rbp + 0x40], xmm1
mov r12d, r13d
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov ebx, r13d
mov qword [rsp + 0x58], r13
mov esi, r13d
mov qword [rbp - 0x48], r13
mov r14, r8
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x58], r13
movups xmmword [rbp - 0x18], xmm0
mov qword [rsp + 0x48], r13
movups xmmword [rbp - 8], xmm0
mov qword [rbp - 0x60], r13
movups xmmword [rbp + 8], xmm0
mov qword [rbp - 0x28], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140058b09
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140058aeb
mov r15d, 0x80004005
jmp 0x140058afc
movzx r15d, ax
or r15d, 0x80070000
test eax, eax
cmovle r15d, eax
mov ecx, r15d
call fcn.14007ac40
jmp 0x1400591e2
lea rdx, [0x140454c80]
lea rcx, [0x140443698]
call fcn.1400f3d28
test r14, r14
jne 0x140058b2b
mov ecx, 0x80070057
mov r15d, ecx
jmp 0x140058aff
cmp qword [rbp + 0xf0], rbx
je 0x140058b21
cmp qword [rbp + 0xf8], rbx
je 0x140058b21
mov r13, qword [0x14045c980]
mov r15d, 1
test r13, r13
jne 0x140058b5a
lea r12d, [r15 + 7]
mov qword [rsp + 0x40], r12
jmp 0x140058b68
lea r12, [r13 + 8]
mov qword [rsp + 0x40], r12
test r12, r12
je 0x140058b78
mov edx, r15d
mov rcx, r12
call fcn.140073644
mov dword [rsp + 0x50], r15d
cmp qword [rdi + 0x30], rbx
jne 0x140058b90
mov ecx, 0x80070005
mov r15d, ecx
call fcn.14007ac40
jmp 0x1400591df
cmp qword [rdi + 0x38], rbx
je 0x140058b7e
mov r15, qword [r13 + 0xd8]
mov r12, qword [0x14045c9f0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov eax, 0x8007000e
test rdi, rdi
je 0x140058c0a
lea rdx, [0x14045bc64]
lea rcx, [0x1404418b8]
call fcn.1400f43c8
xor eax, eax
mov r8, r15
mov rdx, r12
mov qword [rdi], rax
mov rcx, rdi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
call fcn.14006d7d0
mov r15d, eax
test eax, eax
js 0x140058c0d
mov rsi, rdi
xor edi, edi
jmp 0x140058c14
mov r15d, eax
mov ecx, eax
call fcn.14007ac40
mov ecx, r15d
call fcn.14007ace8
test rdi, rdi
je 0x140058c3d
mov rcx, rdi
call fcn.14006b784
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15d, r15d
jns 0x140058c4a
mov ecx, r15d
jmp 0x1400591d5
mov eax, dword [rbp + 0xd8]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x70]
mov dword [rbp + 0x78], eax
mov qword [rbp + 0x70], r14
call fcn.140063af8
mov r15d, eax
test eax, eax
jns 0x140058c73
mov ecx, eax
jmp 0x1400591d5
mov r14, qword [rsi + 0x18]
lea rdx, [0x140454ed8]
lea rcx, [0x140431a98]
mov rdi, qword [r14]
call fcn.1400f4080
mov rax, qword [0x1403d25b8]
mov rcx, qword [rdi + 0x18]
call rax
mov rax, qword [rdi + 0x18]
mov rcx, r14
mov rdx, qword [rsp + 0x48]
call rax
mov r15d, eax
test eax, eax
js 0x140058c6c
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x80], rax
mov edi, 3
lea rax, [0x140005b9c]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
xor r9d, r9d
lea rax, [rbp - 0x40]
mov qword [rsp + 0x70], rax
lea r8d, [rdi + 0x3d]
lea rax, [rbp + 0x20]
lea ecx, [r8 + 0x79]
mov qword [rsp + 0x78], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x40]
test r15d, r15d
js 0x140058c42
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x1400591cd
mov r12, qword [rbp + 0xd0]
mov rdx, qword [r12 + 0x30]
mov rax, qword [rdx]
cmp rax, qword [rcx]
jne 0x1400591b6
mov rax, qword [rdx + 8]
cmp rax, qword [rcx + 8]
jne 0x1400591b6
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x1400591cd
mov rcx, qword [r12 + 0x38]
sub rax, rcx
movzx edi, word [rcx]
movzx edx, word [rcx + rax]
sub edi, edx
jne 0x140058d5d
add rcx, 2
test edx, edx
jne 0x140058d4a
lea rdx, [0x14045bd48]
lea rcx, [0x140438550]
call fcn.1400f50fc
test edi, edi
je 0x140058d7e
mov ecx, 0x80070005
jmp 0x1400591d2
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140058d9b
lea rdx, [rbp - 0x60]
call fcn.14007ab14
mov r15d, eax
test eax, eax
js 0x140058c6c
mov r14, qword [rsi + 0x18]
mov rax, qword [r14]
mov rdi, qword [rax + 0x20]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rdx, qword [rsp + 0x48]
mov rax, rdi
mov rcx, r14
call rax
mov r15d, eax
test eax, eax
js 0x140058c6c
mov r14, qword [rbp - 0x60]
lea rdx, [0x140455714]
mov qword [rbp + 0x10], r13
lea rcx, [0x1404320f8]
xor r13d, r13d
mov qword [rbp + 8], r12
mov qword [rbp - 0x60], r13
call fcn.1400f3318
mov rdi, qword [rbp - 0x10]
test rdi, rdi
je 0x140058e15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
lea rax, [0x140006bdc]
mov qword [rbp - 0x10], r14
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x3c]
mov edi, 3
mov qword [rsp + 0x70], rax
xor r9d, r9d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x78], rax
lea rax, [rbp - 0x58]
lea r14d, [rdi + 0x3d]
mov qword [rbp - 0x80], rax
mov r8d, r14d
lea ecx, [r14 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x3c]
test r15d, r15d
jns 0x140058e72
mov ecx, r15d
jmp 0x1400591af
mov rax, qword [rbp - 0x58]
lea rdx, [rsp + 0x60]
mov rcx, qword [rbp + 0x38]
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, r14
lea rax, [0x14002431c]
mov qword [rbp - 0x70], rcx
mov qword [rsp + 0x68], rax
mov ecx, 0xb9
lea rax, [rbp - 0x38]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x34]
mov qword [rbp - 0x78], rax
mov eax, dword [rbp + 0x30]
mov dword [rbp - 0x68], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x38]
test r15d, r15d
js 0x140058e6a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1400591a4
lea rdx, [0x14045a780]
mov qword [rax], 1
lea rcx, [0x14042d028]
mov qword [rax + 8], r13
mov r14d, 1
call fcn.1400f39cc
mov qword [rbx + 0x10], r13
mov edi, r13d
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
cmp qword [rsi + 8], r13
jne 0x140058f3e
mov r15d, 0x80004005
mov ecx, r15d
mov edi, r15d
call fcn.14007ac40
jmp 0x140058f87
cmp qword [rsi + 0x10], r13
je 0x140058f2b
lea rax, [0x140002adc]
mov qword [rsp + 0x60], 3
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov qword [rbp - 0x80], rsi
lea rax, [rbp + 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x78], rax
lea r8d, [r9 + 0x40]
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, edi
call fcn.14007ace8
mov r15d, edi
test edi, edi
jns 0x140058f9c
mov ecx, edi
jmp 0x1400591af
mov rax, qword [rbp - 0x48]
lea rdx, [0x14045af14]
mov qword [rbp - 0x7c], rax
lea rcx, [0x14042d78c]
lea rax, [0x14000279c]
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x68], rax
mov edi, 3
lea rax, [rbp - 0x30]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rax
mov eax, dword [rbp - 0x34]
mov dword [rbp - 0x74], eax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x2c]
mov qword [rbp - 0x68], rax
mov dword [rbp - 0x80], r14d
call fcn.1400f4080
lea r8d, [rdi + 0x3d]
xor r9d, r9d
lea rdx, [rsp + 0x60]
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x30]
lea rdx, [0x140455868]
lea rcx, [0x14043b6b0]
call fcn.1400f4a68
test r15d, r15d
js 0x140058e6a
mov r9, qword [rbp - 0x50]
lea rcx, [rsp + 0x58]
mov r8d, dword [rbp - 0x2c]
mov edx, r14d
call fcn.14004f958
mov r15d, eax
test eax, eax
jns 0x14005904d
mov ecx, eax
jmp 0x1400591af
mov r9, qword [rbp + 0x40]
test r9, r9
je 0x140059079
lea rdx, [rbp + 0xe8]
mov rcx, r9
call fcn.140079820
mov r15d, eax
test eax, eax
js 0x140059046
mov r9, qword [rbp + 0x40]
mov r8d, dword [rbp + 0xe8]
jmp 0x140059083
mov r8d, r13d
mov dword [rbp + 0xe8], r13d
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.14004f958
mov r15d, eax
test eax, eax
js 0x140059046
mov r9, qword [rbp - 8]
test r9, r9
je 0x1400590c5
lea rdx, [rbp + 0xe8]
mov rcx, r9
call fcn.140079820
mov r15d, eax
test eax, eax
js 0x140059046
mov r9, qword [rbp - 8]
mov r8d, dword [rbp + 0xe8]
jmp 0x1400590cf
mov r8d, r13d
mov dword [rbp + 0xe8], r13d
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.14004f958
mov r15d, eax
test eax, eax
js 0x140059046
mov r8, qword [rbp + 0xf0]
lea rcx, [rsp + 0x58]
mov rdx, qword [rbp + 0xf8]
call fcn.14004f8b4
mov r15d, eax
test eax, eax
js 0x140059046
lea r14, [rbx + 8]
mov rdi, qword [r14]
test rdi, rdi
je 0x140059134
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov qword [r14], r13
mov r15, qword [rbp]
test r15, r15
jne 0x140059145
mov r15d, r13d
mov qword [r14], r13
jmp 0x14005916b
mov edi, dword [r15 - 4]
xor ecx, ecx
call fcn.14007ace8
mov r8, r14
mov edx, edi
mov rcx, r15
call fcn.14007a9ac
mov r15d, eax
test eax, eax
jns 0x14005916b
mov ecx, eax
call fcn.14007ac40
mov ecx, r15d
call fcn.14007ace8
test r15d, r15d
js 0x140058e6a
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x140059197
or eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140059197
call fcn.14006b690
mov rax, rbx
mov rbx, r13
mov qword [r12 + 0x28], rax
jmp 0x1400591c6
mov ecx, 0x8007000e
mov rbx, r13
mov r15d, ecx
call fcn.14007ac40
jmp 0x1400591c6
mov ecx, 0x80070005
mov r15d, ecx
call fcn.14007ac40
xor r13d, r13d
mov r12, qword [rsp + 0x40]
jmp 0x1400591e2
mov ecx, 0x8000ffff
mov r15d, ecx
call fcn.14007ac40
mov r12, qword [rsp + 0x40]
xor r13d, r13d
cmp dword [0x140451890], 5
jbe 0x140059253
movabs rdx, 0x400000000000
test qword [0x1404518a0], rdx
je 0x140059253
mov rax, qword [0x1404518a8]
and rax, rdx
cmp rax, qword [0x1404518a8]
jne 0x140059253
mov rcx, qword [rbp - 0x28]
call fcn.140079a88
mov qword [rbp + 0x18], rax
lea rdx, [0x140445382]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x20], 0x1000000
call fcn.1400014e0
mov ecx, r15d
call fcn.14007ace8
mov rax, qword [rbp - 0x60]
test rax, rax
je 0x140059283
lea rdi, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1400592c0
mov rax, qword [rdi]
lea rdx, [0x14045717c]
lea rcx, [0x140433564]
mov r14, qword [rax + 0x10]
call fcn.1400f4710
mov rax, qword [0x1403d25b8]
mov rcx, r14
call rax
mov rax, r14
mov rcx, rdi
call rax
mov qword [rsp + 0x48], r13
test rsi, rsi
je 0x1400592f4
lea rdx, [0x1404527dc]
lea rcx, [0x14044223c]
call fcn.1400f3670
mov rcx, rsi
call fcn.14006b784
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14005930d
or eax, 0xffffffff
lock xadd dword [rbx], eax
cmp eax, 1
jne 0x14005930d
mov rcx, rbx
call fcn.14006b690
mov esi, 3
mov qword [rsp + 0x70], r13
lea rax, [0x140002e1c]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x18]
xor r9d, r9d
lea r14d, [rsi + 0x3d]
mov qword [rsp + 0x78], rax
mov r8d, r14d
lea ecx, [r14 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x14005936a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x58], r13
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14005937d
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x50], r13
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140059390
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp - 0x48], r13
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400593b5
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
lea rax, [0x14000315c]
mov qword [rsp + 0x60], rsi
lea rdx, [0x1404565f0]
mov qword [rsp + 0x68], rax
lea rcx, [0x140432cfc]
mov qword [rsp + 0x70], r13
call fcn.1400f4dac
lea rax, [rbp + 0x20]
xor r9d, r9d
mov r8, r14
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0x60]
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
test r12, r12
je 0x140059410
cmp dword [rsp + 0x50], r13d
je 0x140059410
mov rcx, r12
call fcn.1400734c0
mov rbx, qword [rsp + 0x1e0]
mov eax, r15d
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret