Function at 0x140013334
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x1402a0ec0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r12d, r12d
mov dword [rbp - 1], r12d
mov ebx, r12d
lea r9, [rbp - 1]
xor r8d, r8d
xor edx, edx
lea esi, [rdx + 0x40]
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
mov r14d, 0xc0000004
jmp 0x1400133c8
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 1]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp - 1]
mov r8d, dword [rbp - 1]
mov rdx, rax
mov ecx, esi
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, r14d
je 0x14001338d
test eax, eax
js 0x14001359f
test rbx, rbx
je 0x1400135b5
mov r15, r12
mov r14d, r12d
mov esi, 1
cmp qword [rbx], r12
jbe 0x14001343e
mov rax, r12
lea rax, [rax + rax*4]
movups xmm0, xmmword [rbx + rax*8 + 0x10]
movups xmmword [rbp + 0x2f], xmm0
movups xmm0, xmmword [rbx + rax*8 + 0x20]
movups xmmword [rbp - 0x39], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movups xmm1, xmmword [rbp + 0x2f]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, rcx
jne 0x14001342c
cmp qword [rbp - 0x39], rdi
je 0x140013439
add r14d, esi
mov eax, r14d
cmp rax, qword [rbx]
jb 0x1400133f1
jmp 0x14001343e
movq r15, xmm1
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test r15, r15
je 0x1400135b5
mov qword [rbp + 0x1f], r12
lea rdx, [r15 + 8]
mov ebx, 8
mov r9d, ebx
lea r8, [rbp + 0x1f]
mov rcx, rdi
call fcn.1400157f8
test al, al
je 0x1400135b5
mov rdx, qword [rbp + 0x1f]
test rdx, rdx
je 0x1400135b5
mov qword [rbp + 0x27], r12
add rdx, rbx
mov r9d, ebx
lea r8, [rbp + 0x27]
mov rcx, rdi
call fcn.1400157f8
test al, al
je 0x1400135b5
mov rdx, qword [rbp + 0x27]
test rdx, rdx
je 0x1400135b5
mov qword [rbp + 0x17], r12
add rdx, 0x28
mov r9d, ebx
lea r8, [rbp + 0x17]
mov rcx, rdi
call fcn.1400157f8
test al, al
je 0x1400135b5
mov rdx, qword [rbp + 0x17]
test rdx, rdx
je 0x1400135b5
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
add rdx, 0x58
lea r15d, [rbx + 8]
mov r9d, r15d
lea r8, [rbp + 7]
mov rcx, rdi
call fcn.1400157f8
test al, al
je 0x1400135b5
movzx eax, word [rbp + 7]
test ax, ax
je 0x1400135b5
mov ecx, eax
shr rcx, 1
add rcx, rsi
lea eax, [rbx - 6]
mul rcx
mov r14, rax
lea rax, [rbx - 9]
cmovb r14, rax
mov rcx, r14
call fcn.14012c938
mov rbx, rax
test rax, rax
je 0x14001354b
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x14001354e
mov rbx, r12
mov qword [rbp + 0x2f], rbx
movzx r9d, word [rbp + 7]
mov r8, rbx
mov rdx, qword [rbp + 0xf]
mov rcx, rdi
call fcn.1400157f8
test al, al
je 0x14001358a
mov word [rbp + 7], r12w
mov rdx, qword [rbp + 0x17]
add rdx, 0x58
mov r9, r15
lea r8, [rbp + 7]
mov rcx, rdi
call fcn.140015cb4
test al, al
jne 0x14001358d
mov sil, r12b
test rbx, rbx
je 0x14001359a
mov rcx, rbx
call fcn.14012c930
mov al, sil
jmp 0x1400135b7
test rbx, rbx
je 0x1400135b5
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14012ce10
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret