Function at 0x140011f30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
mov r12, rcx
mov dword [rsp + 0x24], 0
xor esi, esi
lea r9, [rsp + 0x24]
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400121ad
xor edi, edi
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rsi, [rsp + 0x24]
jmp 0x140011fc3
mov edx, dword [rsp + 0x24]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call rbx
mov rdi, rax
mov r8d, dword [rsp + 0x24]
mov ecx, 0xb
mov rdx, rax
mov r9, rsi
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140011fdb
test rdi, rdi
je 0x140011f90
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140011f90
test eax, eax
js 0x14001218a
test rdi, rdi
je 0x1400121a4
cmp dword [rdi], 0
je 0x14001218f
mov r14, rdi
add r14, 0x30
xor r15d, r15d
movaps xmm6, xmmword [section..rdata]
lea rbp, [rsp + 0x28]
nop dword [rax + rax]
movzx r13d, word [r14 - 2]
add r13, r14
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rcx, r13
call fcn.1401ed780
mov rsi, rax
cmp rax, 0xf
jbe 0x1400120a0
test rsi, rsi
js 0x1400121c6
mov rbp, r12
mov rax, rsi
or rax, 0xf
movabs r12, 0x7fffffffffffffff
movabs rcx, 0x8000000000000000
js 0x140012085
mov r12, rax
cmp rax, 0x17
jae 0x140012074
mov r12d, reloc.WS2_32.dll_shutdown
lea rcx, [r12 + 1]
cmp r12, 0xfff
jb 0x1400120bf
mov r12, rax
add rcx, 0x27
call fcn.1400ad850
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1400120c7
mov qword [rsp + 0x38], rsi
mov rcx, rbp
mov rdx, r13
mov r8, rsi
call fcn.1401d4a60
mov byte [rsp + rsi + 0x28], 0
mov rbx, qword [rsp + 0x28]
jmp 0x1400120f0
call fcn.1400ad850
mov rbx, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r12
mov rcx, rbx
mov rdx, r13
mov r8, rsi
call fcn.1401d4a60
mov byte [rbx + rsi], 0
mov qword [rsp + 0x28], rbx
mov r12, rbp
lea rbp, [rsp + 0x28]
cmp qword [r12 + 0x18], 0x10
mov rdx, r12
jb 0x1400120ff
mov rdx, qword [r12]
cmp qword [rsp + 0x40], 0x10
cmovb rbx, rbp
mov rcx, rbx
call fcn.1401e65bc
mov esi, eax
test eax, eax
jne 0x140012131
mov rax, qword [r14 - 0x18]
mov qword [rsp + 0x48], rax
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x14001216e
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140012169
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x1400121cb
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400ad894
test esi, esi
je 0x1400121a8
add r15, 1
mov eax, dword [rdi]
add r14, 0x128
cmp r15, rax
jb 0x140012010
jmp 0x14001218f
test rdi, rdi
je 0x1400121a4
xor esi, esi
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400121ad
xor esi, esi
jmp 0x1400121ad
mov rsi, qword [rsp + 0x48]
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400035c0
call fcn.1401e54b4
int3