Function at 0x14005d0c0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0x98
mov r14, rdx
lea rcx, [0x140405ef4]
xor r12d, r12d
lea rdx, [0x14041c3cc]
and dword [rbp - 0x59], r12d
mov r13, r9
call fcn.1400e7410
xor eax, eax
mov qword [rbp + 0x57], rax
mov ebx, eax
mov qword [rbp - 0x51], rax
mov edi, eax
mov qword [rbp - 0x49], rax
mov esi, eax
mov r15d, eax
test r14, r14
jne 0x14005d14b
lea rdx, [0x14041e708]
lea rcx, [0x1403f79f8]
call fcn.1400e7a9c
mov ecx, 0x80070057
mov r13d, ecx
call fcn.140078308
jmp 0x14005d3c3
cmp qword [rbp + 0x67], rax
je 0x14005d139
test r13, r13
je 0x14005d139
cmp qword [rbp + 0x77], rax
je 0x14005d139
cmp qword [rbp + 0x7f], rax
je 0x14005d139
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp - 0x39], rax
test rax, rax
jne 0x14005d19f
mov r13d, 0x8007000e
mov ecx, r13d
call fcn.140078308
lea rdx, [0x14041c958]
lea rcx, [0x1403fe1f8]
call fcn.1400e775c
jmp 0x14005d3c3
lea rdx, [rbp + 0x57]
mov rcx, r14
mov r15, rax
call fcn.140051ce4
mov r13d, eax
test eax, eax
jns 0x14005d1bc
mov ecx, eax
jmp 0x14005d3ba
mov r14, qword [0x140421ad0]
xor r13d, r13d
test r14, r14
je 0x14005d3b1
lea r12, [r14 + 8]
mov qword [rbp - 0x41], r12
test r12, r12
je 0x14005d1ed
lea eax, [r13 + 1]
mov rcx, r12
mov edx, eax
mov dword [rbp - 0x59], eax
call fcn.140070fcc
mov rbx, qword [rbp + 0x57]
lea r8, [rbp + 0x57]
mov rcx, rbx
lea rdx, str.Volume:GVLK
call fcn.1400e467c
test eax, eax
jns 0x14005d219
mov r14d, 0xc004f306
mov r13d, r14d
mov ecx, r14d
jmp 0x14005d141
cmp dword [rbp + 0x57], r13d
jne 0x14005d25a
lea r8, [rbp + 0x57]
mov rcx, rbx
lea rdx, str.Volume:CSVLK
call fcn.1400e467c
test eax, eax
js 0x14005d208
cmp dword [rbp + 0x57], r13d
jne 0x14005d25a
mov r14d, 0xc004f306
lea rdx, [0x1404207d8]
lea rcx, [0x140401d18]
mov r13d, r14d
call fcn.1400e6078
jmp 0x14005d211
mov rdx, qword [rbp + 0x5f]
lea r9, [rbp - 0x51]
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov rcx, r14
call fcn.1400d76f8
mov r13d, eax
test eax, eax
jns 0x14005d289
mov ecx, eax
call fcn.140078308
mov rdi, qword [rbp - 0x51]
jmp 0x14005d3c3
and qword [rbp + 0x5f], rsi
lea r8, [rbp + 0x5f]
xor edx, edx
lea rcx, [0x1403a9d30]
call fcn.1400edcd4
mov rdi, qword [rbp - 0x51]
mov r13d, eax
mov r14, qword [rbp + 0x5f]
test eax, eax
jns 0x14005d2b7
mov ecx, eax
call fcn.140078308
jmp 0x14005d2dc
lea r9, [rbp + 0x5f]
mov rdx, r14
lea r8, [rbp - 0x49]
mov rcx, rdi
call fcn.1400697e0
mov r13d, eax
test eax, eax
jns 0x14005d2d8
mov ecx, eax
call fcn.140078308
mov rsi, qword [rbp - 0x49]
mov ecx, r13d
call fcn.140078324
test r14, r14
je 0x14005d303
mov rax, qword [r14]
mov r12, qword [rax + 0x10]
mov rcx, r12
call qword [0x1403a2250]
mov rcx, r14
call r12
mov r12, qword [rbp - 0x41]
test r13d, r13d
jns 0x14005d310
mov ecx, r13d
jmp 0x14005d141
mov r12d, dword [rbp + 0x5f]
lea rax, [0x14001bb20]
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x31]
xor r9d, r9d
mov qword [rbp - 0x11], rsi
lea rax, [rbp - 0x55]
mov qword [rbp - 0x31], 3
mov qword [rbp - 0x21], rax
mov ecx, 0xb9
mov rax, r15
mov dword [rbp - 0x19], r12d
lea r8d, [r9 + 0x38]
mov qword [rbp - 1], rax
mov dword [rbp - 9], reloc.OLEAUT32.dll_SafeArrayGetDim
call sub.ntdll.dll_NtQuerySystemInformation
mov r13d, dword [rbp - 0x55]
test r13d, r13d
jns 0x14005d371
mov ecx, r13d
call fcn.140078308
mov r12, qword [rbp - 0x41]
jmp 0x14005d3c3
lea rdx, [0x14041ed64]
mov r14, rsi
lea rcx, [0x140408560]
call fcn.1400e7de0
mov rax, qword [rbp + 0x6f]
xor esi, esi
mov rcx, qword [rbp + 0x7f]
xor r15d, r15d
mov qword [rax], r14
mov rax, qword [rbp + 0x67]
mov dword [rax], r12d
mov rax, qword [rbp - 0x39]
mov qword [rcx], rax
mov rax, qword [rbp + 0x77]
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayGetDim
jmp 0x14005d36b
mov r13d, 0x8000ffff
mov ecx, r13d
call fcn.140078308
mov rbx, qword [rbp + 0x57]
mov ecx, r13d
call fcn.140078324
test r15, r15
je 0x14005d3d9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x14005d3e7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x14005d401
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [0x1403a2250]
mov rcx, rdi
call rsi
test rbx, rbx
je 0x14005d40f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x14005d422
cmp dword [rbp - 0x59], 0
je 0x14005d422
mov rcx, r12
call fcn.140070e60
mov eax, r13d
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret