Function at 0x14007f6e0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r14
sub rsp, 0x40
movsx eax, byte [0x1401967d8]
xor r9d, r9d
mov r14, rdx
mov qword [rsp + 0x28], r13
mov rdx, qword [0x140197380]
mov qword [rsp + 0x20], r15
movzx r15d, cl
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movss xmm2, dword [0x14016e724]
xor r8d, r8d
mov eax, r8d
mov qword [0x1401972e0], r8
xor r13d, r13d
mov qword [0x1401972e8], rax
cmp byte [0x1401967d8], al
mov ecx, r8d
mov qword [0x1401972f0], rcx
mov r9d, r13d
mov qword [0x1401972f8], r8
mov qword [0x140197300], r8
mov qword [0x140197308], r8
jbe 0x14007f8f6
mov r10, qword [0x1401972a8]
mov r11, qword [0x140197360]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x1401972c0]
mov qword [rsp + 0x58], rbp
mov rbp, qword [0x140197378]
mov qword [rsp + 0x60], rsi
mov rsi, qword [0x1401972a0]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov r12, qword [0x140197380]
nop word [rax + rax]
mov edx, r9d
mov r8d, r9d
add r8, r8
lea rcx, [rdx + rdx*2]
shl rcx, 4
add rcx, r12
mov rax, qword [rcx]
sub qword [rcx + 8], rax
mov rax, qword [rcx + 0x18]
add qword [0x1401972f8], rax
mov rax, qword [rcx]
add qword [0x1401972e0], rax
mov eax, dword [rcx + 0x28]
add dword [0x140197308], eax
mov rax, qword [rcx + 0x20]
add qword [0x140197300], rax
mov rax, qword [rcx + 8]
add qword [0x1401972e8], rax
mov rax, qword [rcx + 0x10]
add qword [0x1401972f0], rax
mov rax, qword [rcx + 8]
sub rax, qword [rsi + r8*8]
mov qword [rsi + r8*8 + 8], rax
mov rax, qword [rcx + 8]
mov qword [rsi + r8*8], rax
mov rax, qword [rcx + 0x10]
sub rax, qword [r10 + r8*8]
mov qword [r10 + r8*8 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r10 + r8*8], rax
mov rdi, qword [rcx]
sub rdi, qword [rbp + r8*8]
mov qword [rbp + r8*8 + 8], rdi
mov rax, qword [rcx]
mov qword [rbp + r8*8], rax
test r15b, r15b
je 0x14007f8b5
mov rcx, qword [rsi + r8*8 + 8]
mov rax, qword [r10 + r8*8 + 8]
add rax, rcx
add rax, rdi
je 0x14007f8ad
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
test rax, rax
jns 0x14007f871
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rcx
test rcx, rcx
jns 0x14007f882
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rbx + rdx*4], xmm0
xorps xmm0, xmm0
mov rax, qword [r10 + r8*8 + 8]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x14007f8a1
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [r11 + rdx*4], xmm0
jmp 0x14007f8b5
mov dword [rbx + rdx*4], r13d
mov dword [r11 + rdx*4], r13d
movsx eax, byte [0x1401967d8]
inc r9d
cmp r9d, eax
jb 0x14007f7b0
mov rcx, qword [0x1401972f0]
mov rax, qword [0x1401972e8]
mov r8, qword [0x1401972e0]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x28]
mov rdx, rax
sub rdx, qword [0x140197350]
mov r9, rcx
sub r9, qword [0x140197340]
mov qword [0x140197350], rax
mov rax, r8
sub rax, qword [0x1401972b0]
mov qword [0x140197340], rcx
mov qword [0x140197358], rdx
mov qword [0x140197348], r9
lea rcx, [rax + r9]
mov qword [0x1401972b8], rax
add rcx, rdx
mov qword [0x1401972b0], r8
test r15b, r15b
mov r15, qword [rsp + 0x20]
je 0x14007f9bf
test rcx, rcx
je 0x14007f9ab
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
jns 0x14007f967
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
test rdx, rdx
jns 0x14007f978
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [0x140197534], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, r9
test r9, r9
jns 0x14007f995
addss xmm0, xmm2
divss xmm0, xmm1
mov qword [r14], rcx
movss dword [0x140197530], xmm0
add rsp, 0x40
pop r14
ret
mov dword [0x140197534], 0
mov dword [0x140197530], 0
mov qword [r14], rcx
add rsp, 0x40
pop r14
ret