Function at 0x1401cf6d0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
mov qword [rsp + 0xa0], rcx
mov rax, qword [0x14082e958]
xor rax, rsp
mov qword [rsp + 0xf0], rax
lea r9, [rsp + 0xcc]
mov qword [rsp + 0x80], r9
mov rax, qword [rsp + 0x80]
mov dword [rsp + 0xcc], 0
xor esi, esi
mov ecx, ntohs
xor edx, edx
xor r8d, r8d
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, eax
mov eax, 0xb171989f
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1401cf77d
mov qword [rsp + 0xc0], r12
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x498bc169
mov ecx, 0x4109a68e
nop word cs:[rax + rax]
nop dword [rax]
cmove eax, ecx
cmp dword [0x1408381b4], 0xa
cmovl eax, ecx
cmp eax, 0xf151a08e
jle 0x1401cf7e0
cmp eax, 0x447beda9
jg 0x1401cf850
cmp eax, 0x190cfff9
jle 0x1401cf8f5
cmp eax, 0x289f78f5
jg 0x1401cf9f7
cmp eax, 0x190cfffa
je 0x1401cfcb3
cmp eax, 0x195cd8ee
je 0x1401cfcd5
cmp eax, 0x1ec718e5
jne 0x1401cf77d
cmp byte [rsp + 0x36], 0
mov eax, 0x195cd8ee
mov ecx, 0x190cfffa
cmovne eax, ecx
jmp 0x1401cf77d
cmp eax, 0xb171989e
jle 0x1401cf8a0
cmp eax, 0xd214de6f
jle 0x1401cf92f
cmp eax, 0xdaa48a73
jg 0x1401cfa36
cmp eax, 0xd214de70
je 0x1401cf9b4
cmp eax, 0xd288ad52
je 0x1401cfced
cmp eax, 0xd97ba2ad
jne 0x1401cf77d
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call rbx
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa773d56e
mov ecx, 0x7f796072
jmp 0x1401cf770
cmp eax, 0x66826e96
jle 0x1401cf979
cmp eax, 0x754e0c28
jle 0x1401cfa75
cmp eax, 0x754e0c29
je 0x1401cfd05
cmp eax, 0x7e9e1c75
je 0x1401cfd3a
cmp eax, 0x7f796072
jne 0x1401cf77d
mov eax, 0x8b79c581
jmp 0x1401cf77d
cmp eax, 0x9add3ae3
jg 0x1401cf9c1
cmp eax, 0x8b79c580
jle 0x1401cfab8
cmp eax, 0x8b79c581
je 0x1401cfd58
cmp eax, 0x8ccca626
je 0x1401cfd9f
cmp eax, 0x8db31f6c
jne 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa773d56e
mov ecx, 0xd97ba2ad
jmp 0x1401cf770
cmp eax, 0xc7d2af2
jle 0x1401cfaed
cmp eax, 0xc7d2af3
je 0x1401cfdb7
cmp eax, 0x125252f9
je 0x1401cf741
cmp eax, 0x13dd8b12
jne 0x1401cf77d
mov eax, dword [rsp + 0x44]
mov eax, 0x4fa15d07
jmp 0x1401cf77d
cmp eax, 0xbe4f0de6
jle 0x1401cfb21
cmp eax, 0xbe4f0de7
je 0x1401cfdd9
cmp eax, 0xc3751c2f
je 0x1401cfdf7
cmp eax, 0xc705ae0d
jne 0x1401cf77d
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x30]
mov eax, 0xc3751c2f
jmp 0x1401cf77d
cmp eax, 0x498bc168
jle 0x1401cfb55
cmp eax, 0x498bc169
je 0x1401cfe20
cmp eax, 0x4fa15d07
je 0x1401cfe2a
cmp eax, 0x666182df
jne 0x1401cf77d
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call rbx
mov eax, 0x125252f9
xor r12d, r12d
jmp 0x1401cf77d
cmp eax, 0xa773d56d
jle 0x1401cfc91
cmp eax, 0xa773d56e
je 0x1401cfe52
cmp eax, 0xa78db840
je 0x1401cfe6b
cmp eax, 0xaece3d76
jne 0x1401cf77d
mov eax, 0x7e9e1c75
jmp 0x1401cf77d
cmp eax, 0x289f78f6
je 0x1401cfe95
cmp eax, 0x34d6c522
je 0x1401cfec0
cmp eax, 0x4109a68e
jne 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x498bc169
mov ecx, 0x9add3ae4
jmp 0x1401cf770
cmp eax, 0xdaa48a74
je 0x1401cfece
cmp eax, 0xe3e67571
je 0x1401cfeec
cmp eax, 0xe6241cee
jne 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc705ae0d
mov ecx, 0xc3751c2f
jmp 0x1401cf770
cmp eax, 0x66826e97
je 0x1401cff49
cmp eax, 0x6f8e45bd
jne 0x1401d00d8
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call rbx
mov eax, 0xe3e67571
mov r15d, 1
jmp 0x1401cf77d
cmp eax, 0x80effb7f
je 0x1401cff53
cmp eax, 0x82da2071
jne 0x1401cf77d
cmp byte [rsp + 0x37], 0
mov eax, 0x125252f9
mov ecx, 0x666182df
cmovne eax, ecx
mov r12, qword [rsp + 0xb8]
jmp 0x1401cf77d
cmp eax, 0xf151a08f
je 0x1401cff6d
cmp eax, 0x21a615f
jne 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaece3d76
mov ecx, 0x7e9e1c75
jmp 0x1401cf770
cmp eax, 0xb171989f
je 0x1401cff86
cmp eax, 0xb71b2387
jne 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x66826e97
mov ecx, 0x447bedaa
jmp 0x1401cf770
cmp eax, 0x447bedaa
je 0x1401cffaa
cmp eax, 0x44db7371
jne 0x1401cf77d
mov eax, edi
mov rdi, rsi
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0xa8], rbp
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x88], rcx
mov rax, qword [rsp + 0x88]
mov rax, qword [rsp + 0x50]
mov edx, dword [rsp + 0x30]
imul rdx, rdx, 0x128
add rax, rdx
add rax, 8
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x58]
movzx edx, word [rdx + 0x26]
add rdx, rax
add rdx, 0x28
call fcn.1401d0120
mov eax, dword [0x140837998]
mov ecx, dword [0x14083799c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x2e]
cmp ecx, 0xa
setl byte [rsp + 0x2f]
mov eax, 0xb88e123e
mov rsi, qword [rsp + 0xa0]
nop
cmp eax, 0x3e7afe87
jg 0x1401cfc20
cmp eax, 0xb88e123e
je 0x1401cfc3d
cmp eax, 0x3425d5a5
jne 0x1401cfc00
jmp 0x1401cffbc
cmp eax, 0x3e7afe88
je 0x1401cfc5b
cmp eax, 0x595a41f8
jne 0x1401cfc00
mov rcx, rsi
call fcn.1401c7fd0
mov eax, 0x3e7afe88
jmp 0x1401cfc00
movzx ecx, byte [rsp + 0x2e]
cmp byte [rsp + 0x2f], 0
mov eax, 0x595a41f8
mov edx, 0x3e7afe88
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x1401cfc00
mov rcx, rsi
call fcn.1401c7fd0
mov rbp, rax
mov eax, dword [0x140837998]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x595a41f8
mov ecx, 0x3425d5a5
cmove eax, ecx
cmp dword [0x14083799c], 0xa
cmovl eax, ecx
jmp 0x1401cfc00
cmp eax, 0x9add3ae4
je 0x1401d008b
cmp eax, 0xa05740f6
jne 0x1401cf77d
mov eax, 0x685c4334
xor ebp, ebp
jmp 0x1401cf77d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
mov eax, 0xbe4f0de7
mov ecx, 0xd214de70
cmove eax, ecx
jmp 0x1401cf77d
cmp qword [rsp + 0x38], 0
mov eax, 0xf151a08f
mov ecx, 0xa05740f6
cmove eax, ecx
jmp 0x1401cf77d
cmp qword [rsp + 0x38], 0
mov eax, 0x8db31f6c
mov ecx, 0x8b79c581
cmove eax, ecx
jmp 0x1401cf77d
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x30]
cmp ecx, dword [rax]
mov eax, 0x8ccca626
mov ecx, 0x44db7371
cmovb eax, ecx
jmp 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaece3d76
mov ecx, 0x80effb7f
jmp 0x1401cf770
mov edx, dword [rsp + 0xcc]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r8d, dword [rsp + 0xcc]
mov ecx, ntohs
mov rdx, rax
lea r9, [rsp + 0xcc]
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, eax
mov eax, 0xb171989f
jmp 0x1401cf77d
mov eax, 0x289f78f6
mov r14d, 4
mov r13, qword [rsp + 0x90]
jmp 0x1401cf77d
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x48], eax
mov eax, 0x754e0c29
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0xb0], rcx
jmp 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x66826e97
mov ecx, 0xb71b2387
jmp 0x1401cf770
mov eax, dword [rsp + 0x30]
add eax, 1
mov dword [rsp + 0x74], eax
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc705ae0d
mov ecx, 0xc7d2af3
jmp 0x1401cf770
mov eax, 0x4109a68e
jmp 0x1401cf77d
cmp dword [rsp + 0x44], 0
setns byte [rsp + 0x36]
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x13dd8b12
mov ecx, 0x1ec718e5
jmp 0x1401cf770
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call rbx
mov eax, 0xd97ba2ad
jmp 0x1401cf77d
mov eax, dword [rsp + 0x4c]
cmp eax, 4
sete byte [rsp + 0x37]
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x34d6c522
mov ecx, 0x82da2071
jmp 0x1401cf770
mov qword [rsp + 0xb8], r13
mov dword [rsp + 0x4c], r14d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x34d6c522
mov ecx, 0xa78db840
jmp 0x1401cf770
mov eax, dword [rsp + 0x4c]
mov eax, 0xa78db840
jmp 0x1401cf77d
mov eax, dword [0x1408381b0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x13dd8b12
mov ecx, 0x4fa15d07
jmp 0x1401cf770
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x98], rax
mov r14, rbp
mov ebp, edi
mov rdi, rsi
lea rsi, [rsp + 0xd0]
mov rcx, rsi
call fcn.1401b0ed0
mov rcx, rsi
mov rsi, rdi
mov edi, ebp
mov rbp, r14
call fcn.1401c4670
mov rax, qword [rsp + 0x88]
test r15d, r15d
mov eax, 0x289f78f6
mov ecx, 0xe6241cee
cmove eax, ecx
mov r13, qword [rsp + 0x98]
mov r14d, r15d
jmp 0x1401cf77d
mov eax, 0xb71b2387
jmp 0x1401cf77d
mov eax, 0xe3e67571
xor r15d, r15d
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x78], rcx
jmp 0x1401cf77d
mov rcx, qword [rsp + 0x38]
xor edx, edx
mov r8d, 0x8000
call rbx
mov eax, 0xa05740f6
jmp 0x1401cf77d
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x44], edi
mov eax, dword [rsp + 0x44]
cmp eax, 0xc0000004
mov eax, 0xdaa48a74
mov ecx, 0xd288ad52
cmove eax, ecx
jmp 0x1401cf77d
mov eax, 0x754e0c29
mov dword [rsp + 0x48], 0
jmp 0x1401cf77d
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x60]
mov eax, dword [0x140837998]
mov ecx, dword [0x14083799c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rsp + 0x2e]
cmp ecx, 0xa
setl byte [rsp + 0x2f]
mov eax, 0xb88e123e
nop dword [rax]
cmp eax, 0x3e7afe87
jg 0x1401d0010
cmp eax, 0xb88e123e
je 0x1401d0032
cmp eax, 0x3425d5a5
jne 0x1401cfff0
jmp 0x1401d009d
cmp eax, 0x3e7afe88
je 0x1401d0050
cmp eax, 0x595a41f8
jne 0x1401cfff0
lea rcx, [rsp + 0xd0]
call fcn.1401c7fd0
mov eax, 0x3e7afe88
jmp 0x1401cfff0
movzx ecx, byte [rsp + 0x2e]
cmp byte [rsp + 0x2f], 0
mov eax, 0x595a41f8
mov edx, 0x3e7afe88
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x1401cfff0
lea rcx, [rsp + 0xd0]
call fcn.1401c7fd0
mov rsi, rax
mov eax, dword [0x140837998]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x595a41f8
mov ecx, 0x3425d5a5
cmove eax, ecx
cmp dword [0x14083799c], 0xa
cmovl eax, ecx
jmp 0x1401cfff0
mov eax, 0x685c4334
mov rbp, qword [rsp + 0xc0]
jmp 0x1401cf77d
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x60]
mov rdx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
mov eax, 0x21a615f
mov ecx, 0x6f8e45bd
cmove eax, ecx
mov rsi, rdi
mov edi, dword [rsp + 0x6c]
mov rbp, qword [rsp + 0xa8]
mov r15d, dword [rsp + 0x70]
jmp 0x1401cf77d
cmp eax, 0x685c4334
jne 0x1401cf77d
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140384540
mov rax, rbp
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret