Function at 0x1402d3740
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov qword [rsp + 0x60], rcx
mov rax, qword [0x14035bae8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov eax, 0x26129ef9
lea rdi, [rsp + 0x7c]
mov rbp, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, 0x3c24f2c8
jmp 0x1402d37c0
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x54], eax
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0ad928e
mov ecx, 0x4f6dabbe
cmove eax, ecx
cmp dword [0x14035ce24], 0xa
cmovl eax, ecx
nop word cs:[rax + rax]
nop
cmp eax, 0xf156e49d
jg 0x1402d3810
cmp eax, 0xa4d17bd4
jle 0x1402d38a0
cmp eax, 0xc1c46734
jg 0x1402d3933
cmp eax, 0xb3b2b96f
jg 0x1402d3a60
cmp eax, 0xa4d17bd5
je 0x1402d3bad
cmp eax, 0xa4dd6f36
jne 0x1402d37c0
mov eax, 0xc1c46735
mov esi, dword [rsp + 0x54]
jmp 0x1402d37c0
cmp eax, 0x3c24f2c7
jle 0x1402d38f0
cmp eax, 0x62d37bcb
jg 0x1402d3972
cmp eax, 0x4f6dabbd
jg 0x1402d3a88
cmp eax, 0x3c24f2c8
je 0x1402d3bb7
cmp eax, 0x4a5d888e
jne 0x1402d37c0
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x2c]
imul rcx, rcx, 0x128
add rax, rcx
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + 0x26]
add rcx, rax
add rcx, 0x28
mov rdx, qword [rsp + 0x60]
call fcn.1402fad0c
test eax, eax
sete byte [rsp + 0x33]
mov eax, 0x33bc0964
jmp 0x1402d37c0
cmp eax, 0x95a1e78b
jg 0x1402d39d6
cmp eax, 0x858167d7
jg 0x1402d3abc
cmp eax, 0x814fd054
je 0x1402d3bc1
cmp eax, 0x82d08cfa
jne 0x1402d37c0
cmp byte [rsp + 0x31], 0
mov eax, 0x723d4c32
mov ecx, 0xa4d17bd5
cmovne eax, ecx
xor r15d, r15d
jmp 0x1402d37c0
cmp eax, 0x26129ef8
jle 0x1402d3a25
cmp eax, 0x362a301c
jg 0x1402d3b04
cmp eax, 0x26129ef9
je 0x1402d3bcd
cmp eax, 0x33bc0964
jne 0x1402d37c0
cmp byte [rsp + 0x33], 0
mov eax, 0xdb7c9037
mov ecx, 0xf156e49e
cmovne eax, ecx
jmp 0x1402d37c0
cmp eax, 0xda78bffc
jg 0x1402d3b31
cmp eax, 0xc1c46735
je 0x1402d3be9
cmp eax, 0xc22f313a
jne 0x1402d37c0
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov ecx, 0xb
mov r9, rdi
call rbp
mov eax, 0x6def5660
jmp 0x1402d37c0
cmp eax, 0x723d4c31
jg 0x1402d3b65
cmp eax, 0x62d37bcc
je 0x1402d3c0b
cmp eax, 0x6def5660
jne 0x1402d37c0
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x34]
mov ecx, 0xb
mov r9, rdi
call rbp
test eax, eax
sete byte [rsp + 0x31]
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc22f313a
cmove eax, r14d
cmp dword [0x14035ce24], 0xa
cmovl eax, r14d
jmp 0x1402d37c0
cmp eax, 0xa0233cb4
jg 0x1402d3b88
cmp eax, 0x95a1e78c
je 0x1402d3c1d
cmp eax, 0x9e1c9140
jne 0x1402d37c0
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x2c]
cmp ecx, dword [rax]
setb byte [rsp + 0x32]
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x362a301d
mov ecx, 0x39657019
jmp 0x1402d37a7
cmp eax, 0xf156e49e
je 0x1402d3c2a
cmp eax, 0xc4f9c04
je 0x1402d3c42
cmp eax, 0x16577e5e
jne 0x1402d37c0
cmp qword [rsp + 0x40], 0
mov eax, 0xbd8c7dc4
mov ecx, 0x7918e093
cmove eax, ecx
xor ebx, ebx
jmp 0x1402d37c0
cmp eax, 0xb3b2b970
je 0x1402d3783
cmp eax, 0xbd8c7dc4
jne 0x1402d37c0
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x34], eax
mov eax, 0x4fe32f03
jmp 0x1402d37c0
cmp eax, 0x4f6dabbe
je 0x1402d3c4f
cmp eax, 0x4fe32f03
jne 0x1402d37c0
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc22f313a
mov ecx, 0x6def5660
jmp 0x1402d37a7
cmp eax, 0x858167d8
je 0x1402d3c59
cmp eax, 0x921c73db
jne 0x1402d37c0
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 0x16577e5e
jmp 0x1402d37c0
cmp eax, 0x362a301d
je 0x1402d3c82
cmp eax, 0x39657019
jne 0x1402d37c0
cmp byte [rsp + 0x32], 0
mov eax, 0x95a1e78c
mov ecx, 0x4a5d888e
cmovne eax, ecx
jmp 0x1402d37c0
cmp eax, 0xda78bffd
je 0x1402d3c95
cmp eax, 0xdb7c9037
jne 0x1402d37c0
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa0ad928e
mov ecx, 0xb3b2b970
jmp 0x1402d37a7
cmp eax, 0x723d4c32
je 0x1402d3ca8
cmp eax, 0x7918e093
jne 0x1402d37c0
mov eax, 0xa0233cb5
mov r13, rbx
jmp 0x1402d37c0
cmp eax, 0xa0ad928e
jne 0x1402d3cc8
mov eax, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x2c]
mov eax, 0xb3b2b970
jmp 0x1402d37c0
mov eax, 0x814fd054
jmp 0x1402d37c0
mov eax, 0x82d08cfa
jmp 0x1402d37c0
mov eax, 0xc1c46735
xor esi, esi
jmp 0x1402d37c0
mov qword [rsp + 0x58], rdi
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x7c], 0
mov eax, 0x858167d8
jmp 0x1402d37c0
mov dword [rsp + 0x2c], esi
mov eax, dword [0x14035ce20]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x362a301d
mov ecx, 0x9e1c9140
jmp 0x1402d37a7
mov rax, qword [rsp + 0x70]
mov r12, qword [rax]
mov eax, 0xc4f9c04
jmp 0x1402d37c0
mov eax, 0xc4f9c04
xor r12d, r12d
jmp 0x1402d37c0
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x70], rax
mov eax, 0x62d37bcc
jmp 0x1402d37c0
mov eax, 0x723d4c32
mov r15, r12
jmp 0x1402d37c0
mov eax, 0xa4dd6f36
jmp 0x1402d37c0
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
mov r9, rdi
call rbp
cmp eax, 0xc0000004
mov eax, 0xa0233cb5
mov ecx, 0xda78bffd
cmove eax, ecx
xor r13d, r13d
jmp 0x1402d37c0
mov rax, qword [rsp + 0x40]
mov eax, dword [rsp + 0x2c]
mov eax, 0x9e1c9140
jmp 0x1402d37c0
mov eax, dword [rsp + 0x7c]
mov qword [rsp + 0x68], rax
mov eax, 0x921c73db
jmp 0x1402d37c0
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0x7918e093
mov rbx, r15
jmp 0x1402d37c0
cmp eax, 0xa0233cb5
jne 0x1402d37c0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402e6030
mov rax, r13
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret