Function at 0x14000b8b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov r9d, dword [rcx]
lea rdi, [0x1401b2860]
mov qword [rbp - 0x68], rdi
mov r13, r8
mov qword [rbp - 0x78], rcx
mov r15, rdx
mov qword [rsp + 0x38], rcx
mov r12, rcx
mov r14d, 0xc0000135
mov ebx, 1
test r9d, r9d
je 0x14000bef7
sub r9d, ebx
je 0x14000bb36
sub r9d, ebx
je 0x14000ba36
cmp r9d, ebx
je 0x14000b92a
mov r14d, 0xc0000002
jmp 0x14000c194
mov esi, 0x1000
mov r14d, 0xc0000004
nop word [rax + rax]
mov edx, esi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000b988
lea r9, [rbp + 0x160]
mov r8d, esi
mov rdx, rax
mov ecx, reloc.Cabinet.dll_FCIAddFile
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, eax
test eax, eax
jns 0x14000b97d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
add esi, esi
cmp r14d, 0xc0000004
je 0x14000b940
test r14d, r14d
js 0x14000c194
xor esi, esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov r15d, esi
cmp dword [rdi], esi
jbe 0x14000c194
test ebx, ebx
je 0x14000c194
mov eax, r15d
imul rcx, rax, 0x128
mov rax, qword [rcx + rdi + 0x18]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + rdi + 0x20]
mov dword [rsp + 0x40], eax
movzx eax, word [rcx + rdi + 0x2e]
add rax, rcx
lea rcx, [rdi + 0x30]
add rcx, rax
je 0x14000ba25
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], sil
jne 0x14000b9e4
call fcn.140012170
mov r12, rax
test rax, rax
je 0x14000ba25
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, r13
mov dword [rsp + 0x44], esi
lea rcx, [rsp + 0x30]
call qword [rbp + 0x168]
mov rcx, r12
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc r15d
cmp r15d, dword [rdi]
jb 0x14000b9a8
jmp 0x14000c194
lea rax, [rsp + 0x50]
xor esi, esi
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 8]
mov rcx, qword [rax]
mov eax, esi
mov r9, qword [rcx + 8]
mov r8d, dword [r9 + 0xc]
mov edx, dword [r9 + 8]
add r8, r9
test edx, edx
je 0x14000c194
mov rcx, r8
cmp dword [rcx], 4
je 0x14000ba79
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x14000ba65
jmp 0x14000c194
lea rcx, [rax + rax*2]
mov r15d, dword [r8 + rcx*4 + 8]
add r15, r9
je 0x14000c194
mov edi, esi
cmp dword [r15], esi
jbe 0x14000c191
test ebx, ebx
je 0x14000c191
mov eax, edi
imul rcx, rax, 0x6c
mov rax, qword [rcx + r15 + 4]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + r15 + 0xc]
mov dword [rsp + 0x40], eax
mov r8d, dword [rcx + r15 + 0x18]
mov rax, qword [r12 + 8]
mov rcx, qword [rax]
add r8, qword [rcx + 8]
je 0x14000bb26
mov edx, Ordinal_96
lea rcx, [r8 + 4]
call fcn.14011a6e0
lea rcx, [rsp + 0x50]
lea rdx, [rax + 2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.14000c430
test eax, eax
je 0x14000bb12
mov rcx, qword [rbp + 0x160]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000bb16
mov dword [rsp + 0x44], esi
mov rdx, r13
lea rcx, [rsp + 0x30]
call qword [rbp + 0x168]
mov ebx, eax
inc edi
cmp edi, dword [r15]
jb 0x14000ba96
jmp 0x14000c191
lea rax, [rsp + 0x50]
mov r9d, 0x30
mov qword [rsp + 0x48], rax
lea r8, [rbp - 0x30]
mov rax, qword [rcx + 8]
xor edx, edx
mov rcx, qword [rax]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r12
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14000c194
cmp dword [rbp + 0x160], 0x30
jne 0x14000c194
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14000c194
mov r8d, Ordinal_36
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000a6f0
test eax, eax
je 0x14000c194
lea rax, [rbp + 0xe0]
mov r8d, Ordinal_69
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x80]
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x80], rax
call fcn.14000a6f0
test eax, eax
je 0x14000c194
mov rcx, qword [rbp + 0x100]
xor esi, esi
mov rdi, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff0
add rdi, 0x10
cmp rcx, rdi
je 0x14000bcf7
test ebx, ebx
je 0x14000bcf7
lea rax, [rbp + 0x40]
mov qword [rbp - 0x80], rcx
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rax
mov r8d, 0x68
lea rdx, [rbp - 0x80]
call fcn.14000a6f0
mov ebx, eax
test eax, eax
je 0x14000bce6
mov rax, qword [rbp + 0x70]
mov ecx, 0x40
movups xmm0, xmmword [rbp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x80]
mov dword [rsp + 0x40], eax
movq rax, xmm0
shr rax, 0x10
movzx edx, ax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000bce6
movzx r8d, word [rsp + 0x52]
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
mov rax, qword [rbp + 0xa0]
mov qword [rbp - 0x80], rax
call fcn.14000a6f0
test eax, eax
je 0x14000bcdb
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.14000c430
test eax, eax
je 0x14000bcca
mov rcx, qword [rbp + 0x160]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000bcce
mov dword [rsp + 0x44], esi
mov rdx, r13
lea rcx, [rsp + 0x30]
call r15
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x50]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
jne 0x14000bc08
mov r14d, esi
test ebx, ebx
je 0x14000c194
cmp dword [r12], 1
jne 0x14000bd2d
mov rax, qword [r12 + 8]
mov rcx, qword [rax]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rax, [0x1401b2860]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r12
jmp 0x14000bd61
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [r12]
mov rcx, rax
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
lea rax, [0x1401b2860]
mov qword [rsp + 0x68], rax
test edx, edx
je 0x14000bd61
cmp edx, 1
jne 0x14000c194
mov r9d, 8
lea rax, [rbp + 0x160]
lea r8, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14000c194
cmp dword [rbp + 0x160], 8
jne 0x14000c194
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14000c194
mov r8d, 0x10
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000a6f0
test eax, eax
je 0x14000c194
lea rax, [rbp + 0xb0]
mov r8d, reloc.WLDAP32.dll_Ordinal_36
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x80]
mov eax, dword [rbp - 0x54]
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x80], rax
mov r14d, 0x8000000d
call fcn.14000a6f0
test eax, eax
je 0x14000c194
mov eax, dword [rbp + 0xc4]
mov edi, dword [rbp - 0x54]
sub rax, 8
add rdi, 0xc
cmp rax, rdi
je 0x14000c191
test ebx, ebx
je 0x14000c191
lea rcx, [rbp]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rcx
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
mov r8d, 0x34
call fcn.14000a6f0
test eax, eax
je 0x14000bee2
mov eax, dword [rbp + 0x18]
mov ecx, 0x40
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x20]
mov dword [rsp + 0x40], eax
movzx eax, word [rbp + 0x2c]
mov word [rsp + 0x50], ax
movzx eax, word [rbp + 0x2e]
mov edx, eax
mov word [rsp + 0x52], ax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14000bee2
movzx r8d, word [rsp + 0x52]
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
mov eax, dword [rbp + 0x30]
mov qword [rbp - 0x80], rax
call fcn.14000a6f0
test eax, eax
je 0x14000bed7
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.14000c430
test eax, eax
je 0x14000bec6
mov rcx, qword [rbp + 0x160]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000beca
mov dword [rsp + 0x44], esi
mov rdx, r13
lea rcx, [rsp + 0x30]
call r15
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 8]
sub rax, 8
cmp rax, rdi
jne 0x14000be12
jmp 0x14000c191
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [r12]
xor esi, esi
mov qword [rsp + 0x68], rdi
mov r10, rax
mov qword [rsp + 0x78], r12
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
test ecx, ecx
je 0x14000bf88
cmp ecx, ebx
jne 0x14000c02a
lea rax, [rbp + 0x160]
xor edx, edx
lea r9d, [rsi + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov rcx, r10
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14000c02a
cmp dword [rbp + 0x160], 0x30
jne 0x14000c02a
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14000c02a
lea r8d, [rsi + 0x20]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000a6f0
test eax, eax
je 0x14000c02a
jmp 0x14000bf9d
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov rax, qword [rbp - 0x38]
mov rdi, qword [rax + 0x20]
add rax, 0x10
sub rdi, 0x10
cmp rdi, rax
je 0x14000c020
test ebx, ebx
je 0x14000c020
mov rax, qword [rdi + 0x30]
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov eax, dword [rdi + 0x40]
mov dword [rsp + 0x40], eax
lea rax, [rdi + 0x58]
mov qword [rsp + 0x48], rax
call fcn.14000c430
test eax, eax
je 0x14000bffa
mov rcx, qword [rbp + 0x160]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000bffe
mov dword [rsp + 0x44], esi
mov rdx, r13
lea rcx, [rsp + 0x30]
call r15
mov rdi, qword [rdi + 0x10]
mov ebx, eax
mov rax, qword [rbp - 0x38]
sub rdi, 0x10
add rax, 0x10
cmp rdi, rax
jne 0x14000bfb2
mov r14d, esi
lea rdi, [0x1401b2860]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
test ebx, ebx
je 0x14000c194
test r14d, r14d
js 0x14000c194
cmp dword [r12], 1
jne 0x14000c069
mov rax, qword [r12 + 8]
mov rcx, qword [rax]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r12
jmp 0x14000c096
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [r12]
mov rcx, rax
mov qword [rsp + 0x68], rdi
lea rax, [rbp - 0x60]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], r12
test edx, edx
je 0x14000c096
cmp edx, 1
jne 0x14000c194
mov r9d, 8
lea rax, [rbp + 0x160]
lea r8, [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x14000c194
cmp dword [rbp + 0x160], 8
jne 0x14000c194
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x14000c194
mov r8d, 0x10
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000a6f0
test eax, eax
je 0x14000c194
mov eax, dword [rbp - 0x54]
mov edi, dword [rax + 0x14]
add rax, 0x10
sub rdi, 8
cmp rdi, rax
je 0x14000c191
test ebx, ebx
je 0x14000c191
mov eax, dword [rdi + 0x18]
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x40], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x50], ax
movzx eax, word [rdi + 0x2e]
mov word [rsp + 0x52], ax
mov eax, dword [rdi + 0x30]
mov qword [rsp + 0x58], rax
call fcn.14000c430
test eax, eax
je 0x14000c16d
mov rcx, qword [rbp + 0x160]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000c171
mov dword [rsp + 0x44], esi
mov rdx, r13
lea rcx, [rsp + 0x30]
call r15
mov edi, dword [rdi + 8]
mov ebx, eax
mov eax, dword [rbp - 0x54]
sub rdi, 8
add rax, 0x10
cmp rdi, rax
jne 0x14000c111
mov r14d, esi
mov rbx, qword [rsp + 0x270]
mov eax, r14d
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret