Function at 0x14000d4e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xe0
xor r14d, r14d
mov r13d, r9d
mov r12d, edx
mov r15d, ecx
mov esi, r14d
cmp ecx, 0x34
jb 0x14000d52f
mov r8d, ecx
lea rdx, str.___Pprovider_with_id__lu_is_not_supported__will_be_using_default_provider__0__r_n
lea ecx, [r14 + 2]
call fcn.140011c88
mov r15d, r14d
xor eax, eax
mov dword [rbp + 0x5f], r14d
lea rdi, [rbp - 0x51]
lea r9, [rbp + 0x5f]
lea edx, [rax + 0x70]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
mov ecx, 0x9f
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000d5a5
mov r8d, 0xc
lea rdx, [rbp - 0x4d]
lea rcx, str.Microsoft_Hv
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0xc
jne 0x14000d58b
lea rdx, str.___MSFT_hypervisor_present_r_n
lea ecx, [rax - 0xa]
call fcn.140011c88
jmp 0x14000d60c
movsd xmm0, qword [rbp - 0x4d]
lea rdi, [rsp + 0x30]
xor eax, eax
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov eax, dword [rbp - 0x45]
mov dword [rsp + 0x38], eax
jmp 0x14000d5f0
or eax, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], eax
mov eax, 1
cpuid
sar ecx, 0x1f
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], ebx
test cl, 1
je 0x14000d60c
xor ecx, ecx
lea rdi, [rsp + 0x30]
mov eax, 0x40000000
cpuid
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor eax, eax
mov dword [rsp + 0x24], ebx
movsd xmm0, qword [rsp + 0x24]
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
mov dword [rsp + 0x38], edx
lea r8, [rsp + 0x30]
movsd qword [rsp + 0x30], xmm0
lea rdx, str.___The___s__hypervisor_present_r_n
mov ecx, 2
call fcn.140011c88
call fcn.14000d44c
mov qword [rbp - 0x61], rax
test rax, rax
je 0x14000d65a
mov rdx, qword [0x140052050]
test rdx, rdx
je 0x14000d649
mov ebx, dword [rdx]
mov ecx, r14d
test ebx, ebx
je 0x14000d649
mov rdx, qword [rdx + 8]
mov r14d, ecx
shl r14, 6
add r14, rdx
cmp dword [r14 + 0xc], r15d
je 0x14000d678
inc ecx
cmp ecx, ebx
jb 0x14000d633
lea rdx, str.____Requested_provider_data_was_not_found_in_database__abort_r_n
mov ecx, 1
call fcn.140011c88
mov rbx, qword [rsp + 0x128]
mov rax, rsi
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r14, r14
je 0x14000d649
mov eax, r15d
imul rbx, rax, 0x88
lea rax, [0x14004efc0]
add rbx, rax
mov qword [rbx], r14
test r13d, r13d
je 0x14000d6f2
mov eax, r13d
sub eax, 1
je 0x14000d6cb
sub eax, 1
je 0x14000d6c4
sub eax, 1
je 0x14000d6bd
cmp eax, 1
je 0x14000d6b6
mov r9d, dword [r14 + 0x1c]
jmp 0x14000d6d9
mov eax, 8
jmp 0x14000d6d0
mov eax, 4
jmp 0x14000d6d0
mov eax, 2
jmp 0x14000d6d0
mov eax, 1
mov r9d, dword [r14 + 0x1c]
test eax, r9d
ja 0x14000d6f2
mov r8d, r13d
lea rdx, str.____Selected_shellcode__lu_is_not_supported_by_this_provider__supported_mask:_0x_08x___abort_r_n
mov ecx, 1
call fcn.140011c88
jmp 0x14000d65a
xor eax, eax
lea rdi, [rsp + 0x30]
xor r13d, r13d
lea r9, [rbp + 0x5f]
mov dword [rbp + 0x5f], r13d
lea edx, [rax + 0x20]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
lea ecx, [rax + 0x5a]
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000d75b
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x14000d744
sub ecx, 1
je 0x14000d73b
cmp ecx, 1
jne 0x14000d744
lea r8, str.FirmwareTypeUefi
jmp 0x14000d74b
lea r8, str.FirmwareTypeBios
jmp 0x14000d74b
lea r8, str.FirmwareTypeUnknown
lea rdx, str.___Firmware_type___s__r_n
xor ecx, ecx
call fcn.140011c88
jmp 0x14000d769
mov edx, eax
lea rcx, str.____Failed_to_query_firmware_type
call fcn.140012b18
mov r8, qword [r14 + 0x20]
lea rdi, [r14 + 0x28]
mov r9, qword [rdi]
lea rdx, str.___Provider:___ws___Name___ws__r_n
mov ecx, 2
mov qword [rsp + 0x20], rdi
call fcn.140011c88
test r12d, r12d
mov r12d, 1
je 0x14000d7aa
test byte [r14 + 0x18], r12b
jne 0x14000d7aa
lea rdx, str.____Abort:_selected_provider_does_not_support_HVCI_r_n
mov ecx, r12d
jmp 0x14000d655
mov r15d, dword [rbp + 0x6f]
cmp r15d, dword [r14]
jae 0x14000d7bc
lea rdx, str.____Abort:_selected_provider_require_newer_Windows_NT_version_r_n
jmp 0x14000d7a2
cmp dword [r14 + 4], 0xffffffff
je 0x14000d7d8
cmp r15d, dword [r14 + 4]
jbe 0x14000d7d8
lea rdx, str.____Warning:_selected_provider_may_not_work_on_this_Windows_NT_version_r_n
mov ecx, r12d
call fcn.140011c88
mov ecx, dword [rbp + 0x7f]
mov edx, ecx
test ecx, ecx
je 0x14000d806
sub edx, 1
je 0x14000d806
sub edx, 1
je 0x14000d806
cmp edx, 1
jne 0x14000d860
cmp qword [rbx + 0x80], r13
jne 0x14000d8c4
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_process_handle_acquisition_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x14000d7a2
mov rax, qword [rbx]
mov edx, dword [rax + 0x18]
test dl, 0x20
je 0x14000d820
cmp qword [rbx + 0x58], r13
jne 0x14000d820
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000d7a2
test edx, 0x180
je 0x14000d860
mov eax, r12d
mov edx, r12d
cmp qword [rbx + 0x68], r13
je 0x14000d83a
cmp qword [rbx + 0x70], r13
jne 0x14000d83d
mov eax, r13d
cmp qword [rbx + 0x48], r13
je 0x14000d849
cmp qword [rbx + 0x50], r13
jne 0x14000d84c
mov edx, r13d
test eax, eax
jne 0x14000d860
test edx, edx
jne 0x14000d860
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000d7a2
test ecx, ecx
je 0x14000d92f
sub ecx, 1
je 0x14000d881
cmp ecx, 1
jne 0x14000d8c4
cmp qword [rbx + 0x40], r13
jne 0x14000d8c4
lea rdx, str.____Abort:_selected_provider_does_not_support_changing_DSE_values_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x14000d8b1
mov rax, qword [rbx]
test dword [rax + 0x18], 0x100
je 0x14000d89e
cmp qword [rbx + 0x68], r13
je 0x14000d8aa
cmp qword [rbx + 0x70], r13
je 0x14000d8aa
mov eax, r12d
jmp 0x14000d8bc
cmp qword [rbx + 0x48], r13
je 0x14000d8aa
cmp qword [rbx + 0x50], r13
jne 0x14000d8c4
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r12d
call fcn.140011c88
mov eax, r13d
test eax, eax
je 0x14000d65a
mov dl, r12b
mov ecx, 0x14
call fcn.140001838
mov dl, r12b
mov ecx, 0xa
call fcn.140001838
lea r12, [r14 + 0x18]
test dword [r12], 0x800
je 0x14000d8f9
call fcn.140014184
test eax, eax
je 0x14000d65a
mov rax, qword gs:[0x30]
mov edx, 8
mov r8d, 0x478
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
jne 0x14000d941
lea rdx, str.____Abort:_could_not_allocate_provider_context_r_n
jmp 0x14000d650
cmp qword [rbx + 0x38], r13
jne 0x14000d8c4
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000d7a2
mov qword [rax + 0x40], rbx
mov rax, qword [rbx + 0x78]
test rax, rax
je 0x14000d982
mov rcx, rsi
call rax
test eax, eax
jne 0x14000d982
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rdx, str.____Abort:_provider_prerequisites_are_not_meet_r_n
mov rsi, r13
jmp 0x14000d650
test byte [r12], 0x40
je 0x14000d98e
mov rax, r13
jmp 0x14000d9b6
mov rax, qword [rbx]
cmp dword [rax + 0x10], 2
jb 0x14000d9a1
mov dword [rax + 0x10], 1
mov rax, qword [rbx]
mov eax, dword [rax + 0x10]
lea rcx, str.PROCEXP152
lea rax, [rax + rax*4]
shl rax, 4
add rax, rcx
mov qword [rsi + 0x48], rax
xor ebx, ebx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r13, qword [rcx + 0x20]
mov rcx, qword [rdi]
mov rax, rcx
test rcx, rcx
jne 0x14000d9e0
mov ecx, ebx
jmp 0x14000d9eb
add rcx, 2
cmp word [rcx], bx
jne 0x14000d9dc
sub rcx, rax
sar rcx, 1
movzx eax, word [r13 + 0x38]
lea rcx, [rcx + 0x20]
mov edx, 8
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rsi + 0x30], rax
test rax, rax
je 0x14000dbd8
mov eax, dword [rbp + 0x77]
mov dword [rsi + 8], eax
mov rax, qword [rbp - 0x61]
mov qword [rsi + 0x10], rax
mov dword [rsi + 4], r15d
call fcn.1400116b4
mov qword [rsi + 0x18], rax
lea rdi, [rbp - 0x51]
xor eax, eax
mov dword [rbp + 0x5f], ebx
lea r9, [rbp + 0x5f]
lea edx, [rax + 0x40]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
xor ecx, ecx
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000da69
mov rax, qword [rbp - 0x29]
jmp 0x14000da85
xor eax, eax
lea rdi, [rsp + 0x30]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x40]
mov ecx, 0x16
mov qword [rsi + 0x38], rax
mov r15d, 0x20206f49
call fcn.1400019f8
mov r8, rax
test rax, rax
je 0x14000daeb
mov rcx, rbx
cmp dword [rax], ebx
jbe 0x14000dad2
mov ebx, dword [r8]
add rax, 8
mov rdx, qword [rax + 0x20]
mov rdi, rcx
cmp rdx, rcx
jbe 0x14000dabe
mov r15d, dword [rax]
add rax, 0x28
mov rcx, rdx
cmp rdx, rdi
cmovbe rcx, rdi
sub rbx, 1
jne 0x14000daaf
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rsi + 0x30]
mov dword [rsi + 0xc], r15d
movzx edx, word [r13 + 0x38]
mov r8, qword [r13 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.1400014a4
mov rcx, qword [rsi + 0x30]
lea rdx, [0x14004504c]
call fcn.140001400
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsi + 0x30]
mov rdx, qword [rdx]
call fcn.140001400
mov rcx, qword [rsi + 0x30]
lea rdx, str..sys
call fcn.140001400
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 8]
test eax, eax
je 0x14000dbbb
mov rax, qword [rsi + 0x40]
mov dword [rsi + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x14000d65a
test byte [r12], 0x40
mov rdx, rsi
jne 0x14000db6c
mov edx, dword [r14 + 8]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x14000d65a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_register_provider_driver
call fcn.140012be4
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14000db9d
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 0x10]
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14000dbd8
mov rax, qword gs:[0x30]
jmp 0x14000dbc8
mov rax, qword gs:[0x30]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, rbx
jmp 0x14000d65a