Function at 0x14005b540
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
lea r9, [rbp + 0x48]
xor edx, edx
mov dword [rbp + 0x48], r12d
mov rdi, rcx
xor r8d, r8d
mov ebx, r12d
lea esi, [rdx + 0x40]
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
mov r14d, 0xc0000004
jmp 0x14005b5b8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x48]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp + 0x48]
lea r9, [rbp + 0x48]
mov rdx, rax
mov ecx, esi
mov rbx, rax
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, r14d
je 0x14005b57d
test eax, eax
js 0x14005b78b
test rbx, rbx
je 0x14005b7a1
mov r15, r12
mov r14d, r12d
mov esi, 1
cmp qword [rbx], r12
jbe 0x14005b62e
mov rax, r12
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movups xmm1, xmmword [rbp - 0x48]
mov ecx, eax
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14005b61c
cmp qword [rbp - 0x38], rdi
je 0x14005b629
add r14d, esi
mov eax, r14d
cmp rax, qword [rbx]
jb 0x14005b5e1
jmp 0x14005b62e
movq r15, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15, r15
je 0x14005b7a1
mov ebx, 8
mov qword [rbp + 0x58], r12
mov r9d, ebx
lea r8, [r15 + 8]
lea rdx, [rbp + 0x58]
mov rcx, rdi
call fcn.14005cce0
test al, al
je 0x14005b7a1
mov r8, qword [rbp + 0x58]
test r8, r8
je 0x14005b7a1
add r8, rbx
mov qword [rbp - 0x60], r12
mov r9d, ebx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.14005cce0
test al, al
je 0x14005b7a1
mov r8, qword [rbp - 0x60]
test r8, r8
je 0x14005b7a1
add r8, 0x28
mov qword [rbp + 0x50], r12
mov r9d, ebx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14005cce0
test al, al
je 0x14005b7a1
mov r8, qword [rbp + 0x50]
test r8, r8
je 0x14005b7a1
xorps xmm0, xmm0
lea r15d, [rbx + 8]
mov r9d, r15d
lea rdx, [rbp - 0x58]
add r8, 0x58
mov rcx, rdi
movups xmmword [rbp - 0x58], xmm0
call fcn.14005cce0
test al, al
je 0x14005b7a1
movzx eax, word [rbp - 0x58]
test ax, ax
je 0x14005b7a1
mov ecx, eax
lea eax, [rbx - 6]
shr rcx, 1
add rcx, rsi
mul rcx
mov r14, rax
lea rax, [rbx - 9]
cmovo r14, rax
mov rcx, r14
call fcn.1400c245c
mov rbx, rax
test rax, rax
je 0x14005b73b
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14005b73e
mov rbx, r12
movzx r9d, word [rbp - 0x58]
mov rdx, rbx
mov r8, qword [rbp - 0x50]
mov rcx, rdi
call fcn.14005cce0
test al, al
je 0x14005b776
mov rdx, qword [rbp + 0x50]
lea r8, [rbp - 0x58]
add rdx, 0x58
mov word [rbp - 0x58], r12w
mov r9, r15
mov rcx, rdi
call fcn.14005cce0
test al, al
jne 0x14005b779
mov sil, r12b
test rbx, rbx
je 0x14005b786
mov rcx, rbx
call fcn.1400c1df4
mov al, sil
jmp 0x14005b7a3
test rbx, rbx
je 0x14005b7a1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret