Function at 0x140008b70
Capabilities:
Get system information on windows
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x70
mov rax, qword [0x140012050]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [0x14000cf88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, rax
lea r8, [0x14000cfd8]
lea rcx, [rsp + 0x48]
call fcn.1400085b0
nop
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
sub rdi, r12
mov r15d, 4
mov rax, qword gs:[0x58]
add r15, qword [rax]
mov eax, dword [r15]
cmp dword [0x14001aa6c], eax
jle 0x140008c0b
lea rcx, [0x14001aa6c]
call fcn.140009d48
cmp dword [0x14001aa6c], 0xffffffff
jne 0x140008c0b
mov byte [0x14001aa70], 0
lea rcx, [0x14001aa6c]
call fcn.140009ce8
add edi, 0xffffffd9
xor ebp, ebp
mov r9d, ebp
lea r10, str.xxxxxxxx____xxxxx____xxxxxx____xxx_xxxx
nop word [rax + rax]
movsxd rbx, r9d
add rbx, r12
lea rdx, [0x14000d008]
mov al, 0x78
mov rcx, r10
mov r8, rbx
sub r8, r10
cmp al, 0x78
jne 0x140008c45
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140008c5e
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140008c38
test rbx, rbx
jne 0x140008c68
xor bl, bl
jmp 0x140008dd9
inc r9d
cmp r9d, edi
ja 0x140008c57
jmp 0x140008c20
call fcn.1400083c0
mov ecx, dword [rsp + 0x60]
sub rcx, r12
add rax, rbx
add rcx, rax
mov qword [0x140012010], rcx
mov eax, dword [rbx + 8]
mov dword [section..data], eax
mov eax, dword [rbx + 0x11]
mov dword [0x140012008], eax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rsp + 0x20]
mov ecx, 0xc4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140008dd7
test byte [rsp + 0x20], 1
je 0x140008dd7
lea rcx, [0x14000cf88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, rax
lea r8, str.KVASCODE
lea rcx, [rsp + 0x28]
call fcn.1400085b0
nop
mov rbx, qword [rsp + 0x28]
cmp dword [rsp + 0x40], 0
je 0x140008e19
mov rsi, qword [rsp + 0x30]
cmp rbx, rsi
je 0x140008e19
sub rsi, rbx
mov eax, dword [r15]
cmp dword [0x14001aa6c], eax
jle 0x140008d37
lea rcx, [0x14001aa6c]
call fcn.140009d48
cmp dword [0x14001aa6c], 0xffffffff
jne 0x140008d37
mov byte [0x14001aa70], 0
lea rcx, [0x14001aa6c]
call fcn.140009ce8
add esi, 0xffffffdc
lea r9, str.xxxxxxxx____xxxxx____xxxxx_____xxxxx
movsxd rdi, ebp
add rdi, rbx
lea rdx, [0x14000d068]
mov cl, 0x78
mov rax, r9
mov r8, rdi
sub r8, r9
nop dword [rax]
cmp cl, 0x78
jne 0x140008d72
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140008e0f
inc rdx
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x140008d60
test rdi, rdi
je 0x140008e19
call fcn.1400083c0
mov ecx, dword [rsp + 0x40]
sub rcx, rbx
add rax, rdi
add rcx, rax
mov qword [0x140012010], rcx
test rbx, rbx
je 0x140008dd7
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008dcf
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e47
mov rcx, rbx
call fcn.14000a0e4
mov bl, 1
test r12, r12
je 0x140008e56
mov rdx, qword [rsp + 0x58]
sub rdx, r12
mov rax, r12
cmp rdx, 0x1000
jb 0x140008e4e
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
inc ebp
cmp ebp, esi
jbe 0x140008d41
test rbx, rbx
je 0x140008dd7
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008dcf
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008dcf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r12
call fcn.14000a0e4
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009ba0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret