Function at 0x1400016c0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push r15
mov eax, 0x2060
call fcn.140002b50
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
lea r8, [rsp + 0x30]
mov edx, 0x2000
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x40]
mov qword [0x140045bd0], r15
call qword [sym.imp.KERNEL32.dll_K32EnumDeviceDrivers]
mov ecx, dword [rsp + 0x30]
test eax, eax
je 0x140001741
cmp ecx, 0x2000
jae 0x140001741
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140001754
mov qword [0x140045bd0], rdx
lea rcx, str.____ntoskrnlBase_p_n
jmp 0x14000174f
mov rdx, rcx
lea rcx, str.____EnumDeviceDrivers_failed__array_size_needed_is__d_n
shr rdx, 3
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x400
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x140001782
lea rcx, str.____OpenProcess_failed_n
call fcn.140001010
xor eax, eax
jmp 0x1400018e0
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], r15
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400017b1
lea rcx, str.____OpenProcessToken_failed_n
call fcn.140001010
xor eax, eax
jmp 0x1400018e0
mov qword [rsp + 0x2070], rbx
mov qword [rsp + 0x2078], rbp
mov qword [rsp + 0x2080], rsi
mov qword [rsp + 0x2058], rdi
mov qword [rsp + 0x2050], r14
mov r14d, r15d
nop dword [rax]
mov rbp, qword [rsp + 0x28]
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, 0x20
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x20]
mov rdx, rax
mov rsi, rax
lea ecx, [r8 - 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140001845
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0x10
mov rsi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test rsi, rsi
jne 0x140001858
lea rcx, str.____NtQuerySystemInformation_error__n
call fcn.140001010
jmp 0x1400018a2
mov rdi, r15
cmp dword [rsi], edi
jbe 0x14000188d
lea rbx, [rsi + 0xc]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rbx - 4]
cmp ecx, eax
jne 0x14000187f
cmp byte [rbx], 5
jne 0x14000187f
movzx eax, word [rbx + 2]
cmp rbp, rax
je 0x1400018fa
mov eax, dword [rsi]
inc rdi
add rbx, 0x18
cmp rdi, rax
jb 0x140001863
lea rcx, str.____handle_not_found_n
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, r15
inc r14d
cmp r14d, 0x100
jl 0x1400017e0
mov r14, qword [rsp + 0x2050]
mov rax, rbx
mov rbx, qword [rsp + 0x2070]
mov rdi, qword [rsp + 0x2058]
mov rsi, qword [rsp + 0x2080]
mov rbp, qword [rsp + 0x2078]
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.140001e70
add rsp, 0x2060
pop r15
ret
lea rax, [rdi + rdi*2]
mov rcx, rsi
mov rbx, qword [rsi + rax*8 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x1400018b5
jmp 0x1400018a5