Function at 0x140013344
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1403111c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 1], r12d
mov ebx, r12d
lea r9, [rbp - 1]
xor r8d, r8d
xor edx, edx
lea esi, [rdx + 0x40]
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
mov r14d, 0xc0000004
jmp 0x1400133d8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 1]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp - 1]
mov r8d, dword [rbp - 1]
mov rdx, rax
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, r14d
je 0x14001339d
test eax, eax
js 0x1400135af
test rbx, rbx
je 0x1400135c5
mov r15, r12
mov r14d, r12d
mov esi, 1
cmp qword [rbx], r12
jbe 0x14001344e
mov rax, r12
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp + 0x2f], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp + 0x2f]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14001343c
cmp qword [rbp - 0x39], rdi
je 0x140013449
add r14d, esi
mov eax, r14d
cmp rax, qword [rbx]
jb 0x140013401
jmp 0x14001344e
movq r15, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15, r15
je 0x1400135c5
mov qword [rbp + 0x1f], r12
lea rdx, [r15 + 8]
mov ebx, 8
mov r9d, ebx
lea r8, [rbp + 0x1f]
mov rcx, rdi
call fcn.140015808
test al, al
je 0x1400135c5
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
je 0x1400135c5
mov qword [rbp + 0x27], r12
add rdx, rbx
mov r9d, ebx
lea r8, [rbp + 0x27]
mov rcx, rdi
call fcn.140015808
test al, al
je 0x1400135c5
mov rdx, qword [rbp + 0x27]
test rdx, rdx
je 0x1400135c5
mov qword [rbp + 0x17], r12
add rdx, 0x28
mov r9d, ebx
lea r8, [rbp + 0x17]
mov rcx, rdi
call fcn.140015808
test al, al
je 0x1400135c5
mov rdx, qword [rbp + 0x17]
test rdx, rdx
je 0x1400135c5
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
add rdx, 0x58
lea r15d, [rbx + 8]
mov r9d, r15d
lea r8, [rbp + 7]
mov rcx, rdi
call fcn.140015808
test al, al
je 0x1400135c5
movzx eax, word [rbp + 7]
test ax, ax
je 0x1400135c5
mov ecx, eax
shr rcx, 1
add rcx, rsi
lea eax, [rbx - 6]
mul rcx
mov r14, rax
lea rax, [rbx - 9]
cmovb r14, rax
mov rcx, r14
call fcn.14017fd2c
mov rbx, rax
test rax, rax
je 0x14001355b
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14001355e
mov rbx, r12
mov qword [rbp + 0x2f], rbx
movzx r9d, word [rbp + 7]
mov r8, rbx
mov rdx, qword [rbp + 0xf]
mov rcx, rdi
call fcn.140015808
test al, al
je 0x14001359a
mov word [rbp + 7], r12w
mov rdx, qword [rbp + 0x17]
add rdx, 0x58
mov r9, r15
lea r8, [rbp + 7]
mov rcx, rdi
call fcn.140015cc4
test al, al
jne 0x14001359d
mov sil, r12b
test rbx, rbx
je 0x1400135aa
mov rcx, rbx
call fcn.14017fd24
mov al, sil
jmp 0x1400135c7
test rbx, rbx
je 0x1400135c5
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140180200
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret