Function at 0x7ff6cc76c650
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r14
sub rsp, 0x40
movsx eax, byte [0x7ff6cc85deb8]
xor r9d, r9d
mov r14, rdx
mov qword [rsp + 0x28], r13
mov rdx, qword [0x7ff6cc85edb8]
mov qword [rsp + 0x20], r15
movzx r15d, cl
lea r8d, [rax + rax*2]
shl r8d, 4
lea ecx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
movss xmm2, dword [0x7ff6cc8385ac]
xor r8d, r8d
mov eax, r8d
mov qword [0x7ff6cc85ebc0], r8
xor r13d, r13d
mov qword [0x7ff6cc85ebc8], rax
cmp byte [0x7ff6cc85deb8], al
mov ecx, r8d
mov qword [0x7ff6cc85ebd0], rcx
mov r10d, r13d
mov qword [0x7ff6cc85ebd8], r8
mov qword [0x7ff6cc85ebe0], r8
mov qword [0x7ff6cc85ebe8], r8
jbe 0x7ff6cc76c863
mov r11, qword [0x7ff6cc85eb88]
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x7ff6cc85ec40]
mov qword [rsp + 0x58], rbp
mov rbp, qword [0x7ff6cc85edb0]
mov qword [rsp + 0x60], rsi
mov rsi, qword [0x7ff6cc85eb80]
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x7ff6cc85eba0]
mov qword [rsp + 0x30], r12
mov r12, qword [0x7ff6cc85edb8]
nop word [rax + rax]
mov r8d, r10d
mov r9d, r10d
shl r9, 4
lea rcx, [r8 + r8*2]
shl rcx, 4
add rcx, r12
mov rax, qword [rcx]
sub qword [rcx + 8], rax
mov rax, qword [rcx + 0x18]
add qword [0x7ff6cc85ebd8], rax
mov rax, qword [rcx]
add qword [0x7ff6cc85ebc0], rax
mov eax, dword [rcx + 0x28]
add dword [0x7ff6cc85ebe8], eax
mov rax, qword [rcx + 0x20]
add qword [0x7ff6cc85ebe0], rax
mov rax, qword [rcx + 8]
add qword [0x7ff6cc85ebc8], rax
mov rax, qword [rcx + 0x10]
add qword [0x7ff6cc85ebd0], rax
mov rax, qword [rcx + 8]
sub rax, qword [r9 + rsi]
mov qword [r9 + rsi + 8], rax
mov rax, qword [rcx + 8]
mov qword [r9 + rsi], rax
mov rax, qword [rcx + 0x10]
sub rax, qword [r9 + r11]
mov qword [r9 + r11 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r9 + r11], rax
mov rdx, qword [rcx]
sub rdx, qword [r9 + rbp]
mov qword [r9 + rbp + 8], rdx
mov rax, qword [rcx]
mov qword [r9 + rbp], rax
test r15b, r15b
je 0x7ff6cc76c822
mov rax, qword [r9 + rsi + 8]
add rdx, rax
add rdx, qword [r9 + r11 + 8]
je 0x7ff6cc76c81a
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x7ff6cc76c7dd
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
test rax, rax
jns 0x7ff6cc76c7ee
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rdi + r8*4], xmm0
xorps xmm0, xmm0
mov rax, qword [r9 + r11 + 8]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x7ff6cc76c80e
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [rbx + r8*4], xmm0
jmp 0x7ff6cc76c822
mov dword [rdi + r8*4], r13d
mov dword [rbx + r8*4], r13d
movsx eax, byte [0x7ff6cc85deb8]
inc r10d
cmp r10d, eax
jb 0x7ff6cc76c720
mov rcx, qword [0x7ff6cc85ebd0]
mov rax, qword [0x7ff6cc85ebc8]
mov r8, qword [0x7ff6cc85ebc0]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r13, qword [rsp + 0x28]
mov rdx, rax
sub rdx, qword [0x7ff6cc85ec30]
mov r9, rcx
sub r9, qword [0x7ff6cc85ec20]
mov qword [0x7ff6cc85ec30], rax
mov rax, r8
sub rax, qword [0x7ff6cc85eb90]
mov qword [0x7ff6cc85ec20], rcx
mov qword [0x7ff6cc85ec38], rdx
mov qword [0x7ff6cc85ec28], r9
lea rcx, [rax + r9]
mov qword [0x7ff6cc85eb98], rax
add rcx, rdx
mov qword [0x7ff6cc85eb90], r8
test r15b, r15b
mov r15, qword [rsp + 0x20]
je 0x7ff6cc76c92c
test rcx, rcx
je 0x7ff6cc76c918
xorps xmm1, xmm1
cvtsi2ss xmm1, rcx
jns 0x7ff6cc76c8d4
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
test rdx, rdx
jns 0x7ff6cc76c8e5
addss xmm0, xmm2
divss xmm0, xmm1
movss dword [0x7ff6cc85f0d4], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, r9
test r9, r9
jns 0x7ff6cc76c902
addss xmm0, xmm2
divss xmm0, xmm1
mov qword [r14], rcx
movss dword [0x7ff6cc85f0d0], xmm0
add rsp, 0x40
pop r14
ret
mov dword [0x7ff6cc85f0d4], 0
mov dword [0x7ff6cc85f0d0], 0
mov qword [r14], rcx
add rsp, 0x40
pop r14
ret