Function at 0x140069690
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r13
sub rsp, 0x40
movsx eax, byte [0x1400d9038]
mov rdx, qword [0x1400d7e38]
xor r9d, r9d
lea r8d, [rax + rax*2]
mov r13, rcx
lea ecx, [r9 + 8]
shl r8d, 4
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r10d, r10d
xor r15d, r15d
movss xmm2, dword [0x1400bd724]
mov rax, r10
mov rcx, r10
mov rbx, r10
mov qword [0x1400d7a20], r10
mov r9, r10
mov qword [0x1400d7a28], rax
mov qword [0x1400d7a30], rcx
mov qword [0x1400d7a38], r10
mov qword [0x1400d7a40], rbx
mov qword [0x1400d7a48], r10
mov r11d, r15d
cmp byte [0x1400d9038], al
jbe 0x1400698da
mov rcx, qword [0x1400d7a98]
mov rbx, qword [0x1400d7e38]
mov r8, qword [0x1400d7c70]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, qword [0x1400d7df0]
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x1400d80b8]
mov qword [rsp + 0x30], r12
mov r12, qword [0x1400d7e40]
mov qword [rsp + 0x28], r14
mov rbp, rdi
mov r14, r12
add rbx, 8
sub rbp, rcx
sub r14, rcx
sub r12, rdi
sub rsi, r8
lea r9, [rcx + 8]
nop word [rax + rax]
mov rdx, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
lea rcx, [rdx + rax]
add rcx, qword [rbx - 8]
sub qword [rbx], rcx
add qword [0x1400d7a38], rdx
mov rax, qword [rbx - 8]
add qword [0x1400d7a20], rax
mov eax, dword [rbx + 0x20]
add dword [0x1400d7a48], eax
mov rax, qword [rbx + 0x18]
add qword [0x1400d7a40], rax
mov rax, qword [rbx]
add qword [0x1400d7a28], rax
mov rax, qword [rbx + 8]
add qword [0x1400d7a30], rax
mov rax, qword [rbx]
sub rax, qword [r9 - 8]
mov qword [r9], rax
mov rax, qword [rbx]
mov qword [r9 - 8], rax
mov rax, qword [rbx + 8]
sub rax, qword [rdi]
mov qword [r9 + rbp], rax
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rcx, qword [rbx + 0x18]
sub rcx, qword [r12 + rdi]
add rcx, qword [rbx + 0x10]
add rcx, qword [rbx - 8]
mov qword [r14 + r9], rcx
mov rax, qword [rbx + 0x18]
add rax, qword [rbx + 0x10]
add rax, qword [rbx - 8]
mov qword [r12 + rdi], rax
mov r10, qword [r9]
mov rax, qword [r9 + rbp]
lea rdx, [r10 + rax]
add rdx, rcx
je 0x140069874
pxor xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140069837
addss xmm1, xmm2
pxor xmm0, xmm0
cvtsi2ss xmm0, r10
test r10, r10
jns 0x140069849
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rsi + r8], xmm0
mov rax, qword [r9 + rbp]
pxor xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140069869
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [r8], xmm0
jmp 0x14006987b
mov dword [rsi + r8], r15d
mov dword [r8], r15d
movsx eax, byte [0x1400d9038]
inc r11d
add rbx, 0x30
add r9, 0x10
add rdi, 0x10
add r8, 4
cmp r11d, eax
jb 0x140069780
mov rbx, qword [0x1400d7a40]
mov r9, qword [0x1400d7a38]
mov rcx, qword [0x1400d7a30]
mov rax, qword [0x1400d7a28]
mov r10, qword [0x1400d7a20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r8, rcx
mov rdx, rax
sub r8, qword [0x1400d7c80]
sub rdx, qword [0x1400d7ff0]
mov qword [0x1400d7c80], rcx
mov qword [0x1400d7ff0], rax
mov rcx, rbx
lea rax, [rbx + r10]
sub rcx, qword [0x1400d80c0]
mov rbx, qword [rsp + 0x50]
add rax, r9
add rcx, r10
mov qword [0x1400d80c0], rax
mov qword [0x1400d7ff8], rdx
add rcx, r9
mov qword [0x1400d7c88], r8
lea rax, [rcx + r8]
mov qword [0x1400d80c8], rcx
add rax, rdx
je 0x14006999b
pxor xmm1, xmm1
cvtsi2ss xmm1, rax
test rax, rax
jns 0x140069954
addss xmm1, xmm2
pxor xmm0, xmm0
cvtsi2ss xmm0, rdx
test rdx, rdx
jns 0x140069966
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [0x1400d7c64], xmm0
pxor xmm0, xmm0
cvtsi2ss xmm0, r8
test r8, r8
jns 0x140069984
addss xmm0, xmm2
divss xmm0, xmm1
mov qword [r13], rax
movss dword [0x1400d7c14], xmm0
add rsp, 0x40
pop r13
ret
xorps xmm0, xmm0
mov qword [r13], rax
movss dword [0x1400d7c64], xmm0
movss dword [0x1400d7c14], xmm0
add rsp, 0x40
pop r13
ret