Function at 0x14001b590
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, rcx
xor r14d, r14d
mov edi, r14d
mov dword [rsp + 0x68], r14d
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001b619
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
lea r9, [rsp + 0x68]
mov r8d, dword [rsp + 0x68]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14001b5d0
test eax, eax
jns 0x14001b63c
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rcx, rbx
call fcn.140002910
jmp 0x14001b764
mov esi, r14d
cmp dword [rdi], r14d
jbe 0x14001b709
nop dword [rax + rax]
mov ebp, esi
imul rax, rbp, 0x128
movzx ecx, word [rax + rdi + 0x2e]
add rcx, rax
lea rdx, [rdi + 0x30]
add rdx, rcx
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14001b682
lea rcx, [rsp + 0x20]
call fcn.140019ea0
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001b6a3
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14001b779
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001b6ff
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b6fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b7ca
call fcn.14005f878
inc esi
cmp esi, dword [rdi]
jb 0x14001b650
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001b755
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001b750
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b83d
mov rcx, r8
call fcn.14005f878
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
imul rax, rbp, 0x128
mov rsi, qword [rax + rdi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001b7d6
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b7d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b7d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005f878
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001b81f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001b81a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b836
mov rcx, r8
call fcn.14005f878
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rsi
jmp 0x14001b766
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3