Function at 0x1400b0510
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov r12, rcx
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1406e7af8], 0xa
setl cl
or cl, al
nop word cs:[rax + rax]
nop dword [rax]
mov eax, reloc.WS2_32.dll_recv
call fcn.1401fc5d0
sub rsp, rax
mov rdi, rsp
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401fc5d0
sub rsp, rax
mov r15, rsp
test cl, cl
je 0x1400b0560
mov dword [rdi], 0
sub rsp, 0x20
xor esi, esi
mov ecx, ntohl
xor edx, edx
xor r8d, r8d
mov r9, rdi
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
cmp eax, 0xc0000004
jne 0x1400b0692
xor esi, esi
mov r14, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400b0614
mov edx, dword [rdi]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call r14
add rsp, 0x20
mov rsi, rax
mov r8d, dword [rdi]
sub rsp, 0x20
mov ecx, ntohl
mov rdx, rax
mov r9, rdi
call sub.ntdll.dll_NtQuerySystemInformation
add rsp, 0x20
cmp eax, 0xc0000004
jne 0x1400b0692
cmp dword [0x1406e7af8], 0xa
jl 0x1400b062e
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0690
test rsi, rsi
je 0x1400b05d0
sub rsp, 0x20
nop word [rax + rax]
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call rbx
add rsp, 0x20
cmp dword [0x1406e7af8], 0xa
jl 0x1400b05d0
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b05d0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call rbx
jmp 0x1400b0640
jmp 0x1400b0690
mov ebx, dword [0x1406e7afc]
mov edx, dword [0x1406e7af8]
lea ecx, [rbx - 1]
imul ecx, ebx
and ecx, 1
cmp edx, 0xa
jl 0x1400b06b2
test ecx, ecx
je 0x1400b06b2
jmp 0x1400b06b0
test eax, eax
js 0x1400b06e2
test rsi, rsi
je 0x1400b076e
cmp dword [rsi], 0
je 0x1400b0789
mov rbx, r12
cmp edx, 0xa
jl 0x1400b07a2
test ecx, ecx
je 0x1400b07a2
nop dword [rax]
jmp 0x1400b06e0
test rsi, rsi
je 0x1400b076e
sub rsp, 0x20
xor r14d, r14d
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
cmp dword [0x1406e7af8], 0xa
jl 0x1400b0771
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b0771
mov rdi, qword [sym.imp.KERNEL32.dll_VirtualFree]
xor r14d, r14d
nop dword [rax + rax]
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call rdi
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call rdi
add rsp, 0x20
cmp dword [0x1406e7af8], 0xa
jl 0x1400b0771
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0730
jmp 0x1400b0771
xor r14d, r14d
mov rax, r14
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp edx, 0xa
jl 0x1400b09b8
test ecx, ecx
je 0x1400b09b8
nop word [rax + rax]
jmp 0x1400b07a0
lea r12, [rsi + 0x30]
xor r13d, r13d
xorps xmm6, xmm6
nop dword [rax]
movzx edi, word [r12 - 2]
cmp dword [0x1406e823c], 0xa
jl 0x1400b07d4
mov eax, dword [0x1406e8238]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0960
cmp dword [0x1406e7be0], 0xa
jl 0x1400b07f2
mov eax, dword [0x1406e7be4]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0970
add rdi, r12
movups xmmword [r15 + 0x10], xmm6
movups xmmword [r15], xmm6
sub rsp, 0x20
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rsp, 0x20
sub rsp, 0x20
mov rcx, r15
mov rdx, rdi
mov r8, rax
call fcn.14008d7b0
add rsp, 0x20
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400b0831
mov rdx, qword [rbx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x1400b083e
mov rcx, qword [r15]
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add rsp, 0x20
mov edi, eax
test eax, eax
jne 0x1400b08d0
cmp dword [0x1406e7af8], 0xa
jl 0x1400b0870
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b08a8
mov r14, qword [r12 - 0x18]
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
cmp dword [0x1406e7af8], 0xa
jl 0x1400b08d0
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b08d0
sub rsp, 0x20
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
jmp 0x1400b0870
sub rsp, 0x20
mov rcx, r15
call fcn.14008d6a0
add rsp, 0x20
cmp dword [0x1406e8254], 0xa
jl 0x1400b08fe
mov eax, dword [0x1406e8250]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0980
cmp dword [0x1406e825c], 0xa
jl 0x1400b0918
mov eax, dword [0x1406e8258]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b0990
test edi, edi
je 0x1400b0992
add r13, 1
mov eax, dword [rsi]
cmp r13, rax
jae 0x1400b0992
add r12, 0x128
cmp dword [0x1406e7af8], 0xa
jl 0x1400b07b0
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x1400b07b0
jmp 0x1400b06e0
jmp 0x1400b0960
jmp 0x1400b0970
jmp 0x1400b0980
jmp 0x1400b0990
cmp dword [0x1406e7af8], 0xa
jl 0x1400b09b0
mov eax, dword [0x1406e7afc]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
jne 0x1400b07a0
test edi, edi
je 0x1400b0771
sub rsp, 0x20
xor r14d, r14d
mov rcx, rsi
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add rsp, 0x20
jmp 0x1400b0771