Function at 0x140059fec
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
xor r15d, r15d
xorps xmm0, xmm0
mov dword [rbp + 0xc0], r15d
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm0
mov r12, r8
mov qword [rbp + 0x18], r15
mov rdi, rcx
movdqa xmmword [rbp + 0x20], xmm1
mov r13d, r15d
movdqa xmmword [rbp + 0x30], xmm0
mov ebx, r15d
mov qword [rbp + 0x40], r15
mov esi, r15d
mov qword [rsp + 0x30], r15
mov r14d, r15d
mov qword [rsp + 0x38], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x38], r15
mov qword [rsp + 0x28], r15
mov qword [rbp - 0x68], r15
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test r8, r8
jne 0x14005a08d
mov ecx, 0x80070057
mov r15d, ecx
call fcn.140079c40
jmp 0x14005a6ec
cmp qword [rbp + 0xd0], rbx
je 0x14005a07b
cmp qword [rbp + 0xd8], rbx
je 0x14005a07b
mov rax, qword [0x14043f520]
mov qword [rbp - 0x40], rax
lea r13, [rax + 8]
mov qword [rsp + 0x20], r13
test r13, r13
je 0x14005a0d3
mov edx, 1
mov rcx, r13
call fcn.140072570
mov rax, qword [rbp - 0x40]
mov dword [rbp + 0xc0], 1
cmp qword [rdi + 0x30], r15
jne 0x14005a0e0
mov ecx, 0x80070005
jmp 0x14005a080
cmp qword [rdi + 0x38], r15
je 0x14005a0d9
mov r15, qword [rax + 0xd8]
mov r13, qword [0x14043f590]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x14005a128
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
jmp 0x14005a12b
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov ecx, 0x8007000e
test rdi, rdi
jne 0x14005a146
mov r15d, ecx
call fcn.140079c40
xor r13d, r13d
jmp 0x14005a172
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.14006a4f4
xor r13d, r13d
mov r15d, eax
test eax, eax
jns 0x14005a167
mov ecx, eax
call fcn.140079c40
jmp 0x14005a172
mov qword [rbp - 0x50], r13
mov rsi, rdi
mov qword [rbp - 0x38], rdi
mov ecx, r15d
call fcn.140079c60
lea rcx, [rbp - 0x50]
call fcn.14005aa2c
test r15d, r15d
jns 0x14005a190
mov ecx, r15d
jmp 0x14005a6e2
mov eax, dword [rbp + 0xb8]
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x48], eax
mov qword [rbp - 0x50], r12
call fcn.1400601d8
mov r15d, eax
test eax, eax
jns 0x14005a1b9
mov ecx, eax
jmp 0x14005a6e2
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rsp + 0x28]
mov rax, rdi
mov rcx, r15
call rax
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov rax, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x140005318]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, [rbp]
lea r8d, [r9 + 0x40]
mov qword [rsp + 0x58], rax
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x80]
test r15d, r15d
js 0x14005a188
mov rcx, qword [rbp]
test rcx, rcx
jne 0x14005a24a
mov ecx, 0x8000ffff
jmp 0x14005a6df
mov r12, qword [rbp + 0xb0]
mov rdx, qword [r12 + 0x30]
mov rax, qword [rdx]
cmp rax, qword [rcx]
jne 0x14005a6da
mov rax, qword [rdx + 8]
cmp rax, qword [rcx + 8]
jne 0x14005a6da
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14005a240
mov rax, qword [r12 + 0x38]
sub rcx, rax
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x14005a297
add rax, 2
test r8d, r8d
jne 0x14005a281
test edx, edx
jne 0x14005a6da
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x14005a2cc
lea rdx, [rbp - 0x68]
call fcn.140079b08
mov r15d, eax
test eax, eax
jns 0x14005a2c8
mov ecx, eax
call fcn.140079c40
mov r14, qword [rbp - 0x68]
jmp 0x14005a6e7
mov r14, qword [rbp - 0x68]
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x20]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rsp + 0x28]
mov rax, rdi
mov rcx, r15
call rax
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov rdi, qword [rbp - 0x28]
mov r15, r14
mov rax, qword [rbp - 0x40]
mov r14, r13
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rax
test rdi, rdi
je 0x14005a332
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
test r15, r15
mov qword [rsp + 0x40], 3
mov rax, r13
lea rdx, [rsp + 0x40]
cmovne rax, r15
xor r9d, r9d
mov qword [rbp - 0x28], rax
lea rax, [0x140002598]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
lea edi, [r9 + 0x40]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x60]
mov r8d, edi
lea ecx, [rdi + 0x79]
mov qword [rsp + 0x60], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x7c]
test r15d, r15d
jns 0x14005a3a8
lea rdx, [0x140438ff8]
lea rcx, [0x14042b0b0]
call fcn.1400edf70
jmp 0x14005a188
mov rax, qword [rbp - 0x60]
lea rdx, [rsp + 0x40]
mov rcx, qword [rbp + 0x18]
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rax, [0x14001d5d8]
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x48], rax
mov ecx, 0xb9
lea rax, [rbp - 0x78]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x68], rax
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x78], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x78]
test r15d, r15d
js 0x14005a188
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14005a465
mov qword [rax], 1
lea rdx, [0x14043ea08]
mov qword [rax + 8], r13
lea rcx, [0x140421fb8]
mov qword [rax + 0x18], r13
mov qword [rax + 0x20], r13
call fcn.1400ed5b8
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
jmp 0x14005a468
mov rbx, r13
test rbx, rbx
jne 0x14005a477
mov ecx, 0x8007000e
jmp 0x14005a6df
mov r15d, r13d
cmp qword [rsi + 8], r13
jne 0x14005a48f
mov ecx, 0x80004005
mov r15d, ecx
call fcn.140079c40
jmp 0x14005a4d6
cmp qword [rsi + 0x10], r13
je 0x14005a480
lea rax, [0x140001558]
mov qword [rsp + 0x40], 3
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x50], rax
xor r9d, r9d
lea rax, [rbx + 0x10]
mov r8, rdi
mov ecx, 0xb9
mov qword [rsp + 0x58], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, r15d
call fcn.140079c60
test r15d, r15d
js 0x14005a188
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x64], rax
mov esi, 3
lea rax, [0x140001218]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x70]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rax
mov r8, rdi
mov eax, dword [rbp - 0x74]
mov ecx, 0xb9
mov dword [rsp + 0x6c], eax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 1
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x70]
test r15d, r15d
js 0x14005a188
mov r9, qword [rbp - 0x58]
lea edx, [rsi - 2]
mov r8d, dword [rbp - 0x6c]
lea rcx, [rsp + 0x30]
call fcn.140053cb0
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov r9, qword [rbp + 0x20]
test r9, r9
je 0x14005a5a8
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.1400787a4
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov r9, qword [rbp + 0x20]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005a5b2
mov r8d, r13d
mov dword [rbp + 0xc8], r13d
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140053cb0
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov r9, qword [rbp - 0x20]
test r9, r9
je 0x14005a5fc
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.1400787a4
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov r9, qword [rbp - 0x20]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005a5ff
mov r8d, r13d
mov edx, esi
lea rcx, [rsp + 0x30]
call fcn.140053cb0
mov r15d, eax
test eax, eax
js 0x14005a1b2
mov r8, qword [rbp + 0xd0]
lea rcx, [rsp + 0x30]
mov rdx, qword [rbp + 0xd8]
call fcn.140053c0c
mov r15d, eax
test eax, eax
js 0x14005a1b2
lea rsi, [rbx + 8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x14005a677
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
lea rdx, [0x14043d850]
lea rcx, [0x1404184dc]
call fcn.1400edc30
mov qword [rsi], r13
mov r13, qword [rbp - 0x18]
xor r15d, r15d
test r13, r13
je 0x14005a6ab
mov edi, dword [r13 - 4]
xor ecx, ecx
call fcn.140079c60
mov r8, rsi
mov edx, edi
mov rcx, r13
call fcn.140079998
mov r15d, eax
test eax, eax
jns 0x14005a6ae
mov ecx, eax
call fcn.140079c40
jmp 0x14005a6ae
and qword [rsi], r15
mov ecx, r15d
call fcn.140079c60
test r15d, r15d
js 0x14005a188
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14005a6ce
call fcn.1400676ec
mov rax, rbx
xor ebx, ebx
mov qword [r12 + 0x28], rax
jmp 0x14005a6e7
mov ecx, 0x80070005
mov r15d, ecx
call fcn.140079c40
mov r13, qword [rsp + 0x20]
mov ecx, r15d
call fcn.140079c60
xor r12d, r12d
test r14, r14
je 0x14005a718
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14005a742
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rdi
call rax
mov qword [rsp + 0x28], r12
lea rcx, [rbp - 0x38]
call fcn.14005aa2c
test rbx, rbx
je 0x14005a758
mov rcx, rbx
call fcn.1400676ec
lea rcx, [rbp - 0x30]
call fcn.1400578a0
lea rcx, [rbp - 0x60]
call fcn.1400577f4
lea rcx, [rbp - 0x58]
call fcn.14005a9b4
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14005a79b
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x14043dea4]
lea rcx, [0x140418ba0]
call fcn.1400ee2b8
mov qword [rsp + 0x38], r12
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14005a7c0
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
lea rcx, [rbp]
call fcn.14005a810
test r13, r13
je 0x14005a7f2
cmp dword [rbp + 0xc0], r12d
je 0x14005a7f2
mov rcx, r13
call fcn.14007240c
lea rdx, [0x140437570]
lea rcx, [0x140429f7c]
call fcn.1400ed8ec
mov eax, r15d
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret