Function at 0x140008bd0
Capabilities:
Get system information on windows
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x70
mov rax, qword [0x140012080]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea rcx, [0x14000cee0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, rax
lea r8, [0x14000d068]
lea rcx, [rsp + 0x48]
call fcn.140008550
nop
mov ebx, dword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
sub ebx, r15d
mov r14d, 4
mov rax, qword gs:[0x58]
add r14, qword [rax]
mov eax, dword [r14]
cmp dword [0x14001aa9c], eax
jle 0x140008c6c
lea rcx, [0x14001aa9c]
call fcn.140009c08
cmp dword [0x14001aa9c], 0xffffffff
jne 0x140008c6c
mov byte [0x14001aaa0], 0
lea rcx, [0x14001aa9c]
call fcn.140009b9c
add ebx, 0xffffffd9
xor esi, esi
mov r9d, esi
lea r10, str.xxxxxxxx____xxxxx____xxxxxx____xxx_xxxx
nop dword [rax + rax]
movsxd rdi, r9d
add rdi, r15
lea rdx, [0x14000d098]
mov al, 0x78
mov rcx, r10
mov r8, rdi
sub r8, r10
cmp al, 0x78
jne 0x140008ca5
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140008cbe
inc rdx
inc rcx
movzx eax, byte [rcx]
test al, al
jne 0x140008c98
test rdi, rdi
jne 0x140008ccd
xor bl, bl
jmp 0x140008e41
inc r9d
cmp r9d, ebx
jbe 0x140008c80
xor bl, bl
jmp 0x140008e41
call fcn.140008360
mov ecx, dword [rsp + 0x60]
sub rcx, r15
add rax, rdi
add rcx, rax
mov qword [0x140012010], rcx
mov eax, dword [rdi + 8]
mov dword [section..data], eax
mov eax, dword [rdi + 0x11]
mov dword [0x140012008], eax
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, 4
lea rdx, [rsp + 0x20]
mov ecx, 0xc4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140008e3f
test byte [rsp + 0x20], 1
je 0x140008e3f
lea rcx, [0x14000cee0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, rax
lea r8, str.KVASCODE
lea rcx, [rsp + 0x28]
call fcn.140008550
nop
mov rbx, qword [rsp + 0x28]
cmp dword [rsp + 0x40], 0
je 0x140008e80
mov rdi, qword [rsp + 0x30]
cmp rbx, rdi
je 0x140008e80
sub edi, ebx
mov eax, dword [r14]
cmp dword [0x14001aa9c], eax
jle 0x140008d9d
lea rcx, [0x14001aa9c]
call fcn.140009c08
cmp dword [0x14001aa9c], 0xffffffff
jne 0x140008d9d
mov byte [0x14001aaa0], 0
lea rcx, [0x14001aa9c]
call fcn.140009b9c
add edi, 0xffffffdc
lea r9, str.xxxxxxxx____xxxxx____xxxxx_____xxxxx
nop word [rax + rax]
movsxd r14, esi
add r14, rbx
lea rdx, [0x14000d0f8]
mov cl, 0x78
mov rax, r9
mov r8, r14
sub r8, r9
cmp cl, 0x78
jne 0x140008dda
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140008e76
inc rdx
inc rax
movzx ecx, byte [rax]
test cl, cl
jne 0x140008dc8
test r14, r14
je 0x140008e80
call fcn.140008360
mov ecx, dword [rsp + 0x40]
sub rcx, rbx
add rax, r14
add rcx, rax
mov qword [0x140012010], rcx
test rbx, rbx
je 0x140008e3f
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008e37
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008eae
mov rcx, rbx
call fcn.140009efc
mov bl, 1
test r15, r15
je 0x140008ebd
mov rdx, qword [rsp + 0x58]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x140008eb5
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008eb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
inc esi
cmp esi, edi
jbe 0x140008db0
test rbx, rbx
je 0x140008e3f
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140008e37
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r15
call fcn.140009efc
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140009b40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret