Function at 0x140354d00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x108
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x80], 0xfffffffffffffffe
mov qword [rbp - 0x28], rcx
mov eax, 0xa5ea0987
mov r15, qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140354d6d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c7f2ed
mov ecx, 0xb62f73a1
nop word cs:[rax + rax]
nop dword [rax + rax]
cmove eax, ecx
cmp dword [0x140ae08a4], 0xa
cmovl eax, ecx
cmp eax, 0x178eac7
jle 0x140354e30
cmp eax, 0x46989b7c
jg 0x140354e90
cmp eax, 0x18b47db7
jg 0x140354f2d
cmp eax, 0xbdeb2b8
jle 0x140355021
cmp eax, 0x14349eda
jg 0x1403551f8
cmp eax, 0xbdeb2b9
je 0x140355376
cmp eax, 0xbfadb0f
jne 0x140354d6d
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x10], rcx
mov rax, qword [rbp - 0x10]
mov rax, qword [rbp + 0x48]
mov edx, dword [rbp + 0x5c]
imul rdx, rdx, 0x128
add rax, rdx
add rax, 8
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rbp + 0x30]
movzx edx, word [rdx + 0x26]
lea rdi, [rax + rdx]
add rdi, 0x28
call fcn.1402a0f10
mov ecx, 0x8a2d3ab5
nop dword [rax]
cmp ecx, 0xf1aa600a
je 0x1403553a1
cmp ecx, 0x8a2d3ab5
jne 0x140354e00
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov ecx, 0xf1aa600a
jmp 0x140354e00
cmp eax, 0xbc535c5f
jg 0x140354ee0
cmp eax, 0x9fb14846
jg 0x140354f71
cmp eax, 0x85037854
jle 0x140355056
cmp eax, 0x906797b5
jg 0x14035521e
cmp eax, 0x85037855
je 0x1403553f4
cmp eax, 0x8c515e21
jne 0x140354d6d
mov rcx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x8000
call r15
mov eax, 0x9fb14847
jmp 0x140354d6d
cmp eax, 0x60de6e68
jg 0x140354fb6
cmp eax, 0x50ffb69a
jle 0x140355095
cmp eax, 0x550b5c8d
jg 0x14035525b
cmp eax, 0x50ffb69b
je 0x1403553fe
cmp eax, 0x53d3dd8c
jne 0x140354d6d
cmp dword [rbp + 0x24], 0
mov eax, 0x60de6e69
mov ecx, 0xaf828379
cmove eax, ecx
jmp 0x140354d6d
cmp eax, 0xeac25f44
jg 0x140354ff0
cmp eax, 0xd0ab6380
jle 0x1403550c7
cmp eax, 0xd50ed56e
jg 0x14035527b
cmp eax, 0xd0ab6381
je 0x140355424
cmp eax, 0xd4fd9510
jne 0x140354d6d
cmp byte [rbp + 0x7c], 0
mov eax, 0x168c66a1
mov ecx, 0xd0ab6381
cmovne eax, ecx
jmp 0x140354d6d
cmp eax, 0x2c927105
jle 0x140355115
cmp eax, 0x3e2b82cc
jg 0x1403552a7
cmp eax, 0x2c927106
je 0x14035543d
cmp eax, 0x2f50159d
jne 0x140354d6d
mov eax, 0x78623328
mov r14d, 1
mov rcx, qword [rbp - 0x38]
mov qword [rbp + 8], rcx
jmp 0x140354d6d
cmp eax, 0xa6ae6c57
jle 0x140355150
cmp eax, 0xaf828378
jg 0x1403552e9
cmp eax, 0xa6ae6c58
je 0x14035545b
cmp eax, 0xa7e012ef
jne 0x140354d6d
mov rcx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x8000
call r15
mov eax, 0xca7e35a6
jmp 0x140354d6d
cmp eax, 0x6b3b90e1
jle 0x140355187
cmp eax, 0x78623327
jg 0x14035530c
cmp eax, 0x6b3b90e2
je 0x140355465
cmp eax, 0x710eaf7b
jne 0x140354d6d
mov eax, 0x178eac8
mov qword [rbp + 0x18], r13
jmp 0x140354d6d
cmp eax, 0xf65fb9c2
jle 0x1403551b2
cmp eax, 0xfc6994af
jg 0x140355338
cmp eax, 0xf65fb9c3
je 0x14035548c
cmp eax, 0xf68260c0
je 0x1403552ff
jmp 0x140354d6d
cmp eax, 0x4d56bcb
jle 0x140355361
cmp eax, 0x4d56bcc
je 0x1403554aa
cmp eax, 0x92f7a54
jne 0x140354d6d
mov eax, 0x50ffb69b
mov r12d, 4
mov rsi, qword [rbp - 0x18]
jmp 0x140354d6d
cmp eax, 0x801400a3
je 0x140354d38
cmp eax, 0x8031318d
je 0x1403554c0
cmp eax, 0x83a8eae7
jne 0x140354d6d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x627585c8
mov ecx, 0x9c43ef72
jmp 0x140354d60
cmp eax, 0x46989b7d
je 0x1403554de
cmp eax, 0x4ae50de9
je 0x140355506
cmp eax, 0x4e1f158b
jne 0x140354d6d
mov eax, 0x43ae3488
mov dword [rbp + 0x40], 0
jmp 0x140354d6d
cmp eax, 0xbc535c60
je 0x140355519
cmp eax, 0xc897e8b4
je 0x14035552b
cmp eax, 0xca7e35a6
jne 0x140354d6d
mov rcx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x8000
call r15
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7e012ef
mov ecx, 0x2f50159d
jmp 0x140354d60
cmp eax, 0x18b47db8
je 0x140355553
cmp eax, 0x21c0b6ae
je 0x140355569
cmp eax, 0x27db734c
jne 0x140354d6d
cmp byte [rbp + 0x79], 0
mov eax, 0x710eaf7b
mov ecx, 0x8c515e21
cmovne eax, ecx
mov r13, qword [rbp - 0x40]
jmp 0x140354d6d
cmp eax, 0x9fb14847
je 0x140355576
cmp eax, 0xa3f263bb
je 0x140355594
cmp eax, 0xa5ea0987
jne 0x140354d6d
lea rax, [rbp + 0x74]
mov qword [rbp], rax
mov rax, qword [rbp]
mov eax, 0x14349edb
jmp 0x140354d6d
cmp eax, 0x60de6e69
je 0x1403555a6
cmp eax, 0x627585c8
je 0x1403555bb
cmp eax, 0x65c0bcfe
jne 0x140354d6d
mov eax, 0x8031318d
jmp 0x140354d6d
cmp eax, 0xeac25f45
je 0x1403555c9
cmp eax, 0xf0eeb23d
je 0x1403555f4
cmp eax, 0xf36a3e76
jne 0x140354d6d
mov edx, dword [rbp + 0x74]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp - 8], rax
mov eax, 0xeac25f45
jmp 0x140354d6d
cmp eax, 0x14349edb
je 0x1403555fe
cmp eax, 0x168c66a1
jne 0x140354d6d
mov eax, 0x178eac8
xor ecx, ecx
mov qword [rbp + 0x18], rcx
jmp 0x140354d6d
cmp eax, 0x906797b6
je 0x14035562b
cmp eax, 0x9c43ef72
jne 0x140354d6d
cmp qword [rbp + 0x68], 0
setne byte [rbp + 0x7e]
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x627585c8
mov ecx, 0xf0eeb23d
jmp 0x140354d60
cmp eax, 0x550b5c8e
je 0x14035563c
cmp eax, 0x5955ae1c
jne 0x140354d6d
mov eax, 0x168c66a1
jmp 0x140354d6d
cmp eax, 0xd50ed56f
je 0x140355655
cmp eax, 0xe6386a72
jne 0x140354d6d
cmp byte [rbp + 0x7b], 0
mov eax, 0xf68260c0
mov ecx, 0xa6ae6c58
cmovne eax, ecx
jmp 0x140354d6d
cmp eax, 0x3e2b82cd
je 0x14035566d
cmp eax, 0x43ae3488
jne 0x140354d6d
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov eax, dword [rbp + 0x40]
mov dword [rbp + 0x5c], eax
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x906797b6
mov ecx, 0xbdeb2b9
jmp 0x140354d60
cmp eax, 0xaf828379
je 0x14035567b
cmp eax, 0xb62f73a1
jne 0x140354d6d
mov eax, 0x710eaf7b
xor r13d, r13d
jmp 0x140354d6d
cmp eax, 0x78623328
je 0x140355691
cmp eax, 0x79015798
jne 0x140354d6d
cmp byte [rbp + 0x7d], 0
mov eax, 0xfddadec0
mov ecx, 0xa3f263bb
cmovne eax, ecx
jmp 0x140354d6d
cmp eax, 0xfc6994b0
je 0x1403556be
cmp eax, 0xfddadec0
jne 0x140354d6d
cmp qword [rbp + 0x68], 0
setne byte [rbp + 0x7c]
mov eax, 0xfc6994b0
jmp 0x140354d6d
cmp eax, 0x4c7f2ed
jne 0x14035586e
mov eax, 0x801400a3
jmp 0x140354d6d
mov rax, qword [rbp + 0x48]
mov ecx, dword [rbp + 0x5c]
cmp ecx, dword [rax]
setb byte [rbp + 0x7a]
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x906797b6
mov ecx, 0x18b47db8
jmp 0x140354d60
mov qword [rbp + 0x60], rax
mov r8, qword [rbp + 0x60]
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.1402a1150
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x50], rax
mov ecx, 0x47a88473
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x3c0ef28b
je 0x14035580e
cmp ecx, 0x47a88473
jne 0x1403553d0
mov rcx, qword [rbp + 0x50]
call fcn.140326fe0
mov ecx, 0x3c0ef28b
jmp 0x1403553d0
mov eax, 0xf36a3e76
jmp 0x140354d6d
mov qword [rbp - 0x40], rsi
mov dword [rbp + 0x38], r12d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21c0b6ae
mov ecx, 0x46989b7d
jmp 0x140354d60
mov rcx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x8000
call r15
mov eax, 0x5955ae1c
jmp 0x140354d6d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa7e012ef
mov ecx, 0xca7e35a6
jmp 0x140354d60
mov eax, 0x4e1f158b
jmp 0x140354d6d
cmp qword [rbp + 0x48], 0
setne byte [rbp + 0x7b]
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e2b82cd
mov ecx, 0xe6386a72
jmp 0x140354d60
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3e2b82cd
mov ecx, 0x6b3b90e2
jmp 0x140354d60
cmp byte [rbp + 0x7e], 0
mov eax, 0xf36a3e76
mov ecx, 0x550b5c8e
cmovne eax, ecx
jmp 0x140354d6d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x65c0bcfe
mov ecx, 0xd4fd9510
jmp 0x140354d60
mov eax, dword [rbp + 0x38]
cmp eax, 4
sete byte [rbp + 0x79]
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x21c0b6ae
mov ecx, 0x27db734c
jmp 0x140354d60
mov eax, dword [rbp + 0x5c]
add eax, 1
mov dword [rbp + 0x20], eax
mov eax, 0xd50ed56f
jmp 0x140354d6d
cmp dword [rbp + 0x3c], 0
setns byte [rbp + 0x7d]
mov eax, 0x79015798
jmp 0x140354d6d
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x68], rax
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x3c], eax
mov eax, dword [rbp + 0x3c]
cmp eax, 0xc0000004
mov eax, 0xbc535c60
mov ecx, 0x83a8eae7
cmove eax, ecx
jmp 0x140354d6d
cmp byte [rbp + 0x7a], 0
mov eax, 0x92f7a54
mov ecx, 0xbfadb0f
cmovne eax, ecx
jmp 0x140354d6d
mov eax, dword [rbp + 0x38]
mov eax, 0x46989b7d
jmp 0x140354d6d
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4c7f2ed
mov ecx, 0x801400a3
jmp 0x140354d60
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x48], rax
mov eax, 0xf65fb9c3
jmp 0x140354d6d
mov eax, 0x78623328
xor r14d, r14d
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 8], rcx
jmp 0x140354d6d
mov rax, qword [rbp + 0x68]
mov eax, 0x9c43ef72
jmp 0x140354d6d
mov r8d, dword [rbp + 0x74]
mov rdx, qword [rbp - 8]
mov ecx, ntohs
lea r9, [rbp + 0x74]
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rbp + 0x44], eax
mov eax, 0xc897e8b4
mov rcx, qword [rbp - 8]
mov qword [rbp + 0x10], rcx
jmp 0x140354d6d
mov eax, 0x4d56bcc
jmp 0x140354d6d
mov dword [rbp + 0x74], 0
mov ecx, ntohs
xor edx, edx
xor r8d, r8d
lea r9, [rbp + 0x74]
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rbp + 0x44], eax
mov eax, 0xc897e8b4
xor ecx, ecx
mov qword [rbp + 0x10], rcx
jmp 0x140354d6d
mov rax, qword [rbp + 0x48]
mov eax, dword [rbp + 0x5c]
mov eax, 0xbdeb2b9
jmp 0x140354d6d
mov rcx, qword [rbp + 0x68]
xor edx, edx
mov r8d, 0x8000
call r15
mov eax, 0x85037855
jmp 0x140354d6d
mov eax, dword [rbp + 0x20]
mov dword [rbp + 0x40], eax
mov eax, 0x43ae3488
mov rcx, qword [rbp - 0x20]
mov qword [rbp - 0x30], rcx
jmp 0x140354d6d
mov rax, qword [rbp + 0x48]
mov eax, 0x6b3b90e2
jmp 0x140354d6d
mov rax, qword [rbp + 0x30]
mov rax, qword [rax + 0x10]
mov qword [rbp - 0x38], rax
mov eax, 0x2c927106
jmp 0x140354d6d
mov rax, qword [rbp + 8]
mov qword [rbp - 0x20], rax
mov eax, 0xeaba66b
nop
cmp eax, 0xb12a9a57
je 0x1403556dc
cmp eax, 0xeaba66b
jne 0x1403556a0
lea rcx, [rbp - 0x60]
call fcn.14029ffd0
mov eax, 0xb12a9a57
jmp 0x1403556a0
mov eax, dword [0x140ae08a0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x65c0bcfe
mov ecx, 0x8031318d
jmp 0x140354d60
lea rax, [rbp - 0x60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x50], rax
mov edx, dword [0x140ae13c8]
mov eax, dword [0x140ae13cc]
lea ecx, [rdx - 1]
imul ecx, edx
test cl, 1
mov edi, 0x738613db
mov edx, 0x9ee08d9a
cmove edi, edx
cmp eax, 0xa
cmovl edi, edx
mov edx, 0x20d2bfe0
nop dword [rax]
cmp edx, 0x89a375c8
je 0x1403557ee
cmp edx, 0x20d2bfe0
jne 0x140355720
mov rdx, qword [rbp + 0x50]
mov esi, 0x909df85a
nop dword [rax]
cmp esi, 0x909df85a
je 0x140355752
cmp esi, 0xcc67f6f9
jne 0x140355740
jmp 0x140355759
mov esi, 0xcc67f6f9
jmp 0x140355740
test cl, 1
mov qword [rbp + 0x60], rdx
mov rdx, qword [rbp + 0x60]
sete byte [rbp + 0x78]
cmp eax, 0xa
setl byte [rbp + 0x7f]
mov edx, 0x66b82bf3
nop word cs:[rax + rax]
nop
cmp edx, 0x66b82bf2
jle 0x1403557c0
cmp edx, 0x79353d0e
je 0x1403557d2
cmp edx, 0x738613db
je 0x1403557d6
cmp edx, 0x66b82bf3
jne 0x140355780
movzx ebx, byte [rbp + 0x78]
cmp byte [rbp + 0x7f], 0
mov edx, 0x738613db
mov esi, 0x79353d0e
cmovne edx, esi
test bl, bl
cmovne edx, esi
jmp 0x140355780
cmp edx, 0x9ee08d9a
je 0x1403557dd
cmp edx, 0x600374b5
jne 0x140355780
jmp 0x1403557e4
mov edx, edi
jmp 0x140355780
mov edx, 0x79353d0e
jmp 0x140355780
mov edx, 0x600374b5
jmp 0x140355780
mov edx, 0x89a375c8
jmp 0x140355720
mov rax, qword [rbp - 0x10]
test r14d, r14d
mov eax, 0x50ffb69b
mov ecx, 0x4ae50de9
cmove eax, ecx
mov rsi, qword [rbp - 0x20]
mov r12d, r14d
jmp 0x140354d6d
mov qword [rbp + 0x60], rax
mov rdi, qword [rbp + 0x60]
lea rax, [rbp - 0x60]
mov qword [rbp + 0x50], rax
mov ecx, 0x47a88473
nop word cs:[rax + rax]
nop dword [rax]
cmp ecx, 0x3c0ef28b
je 0x140355850
cmp ecx, 0x47a88473
jne 0x140355830
mov rcx, qword [rbp + 0x50]
call fcn.140326fe0
mov ecx, 0x3c0ef28b
jmp 0x140355830
mov qword [rbp + 0x60], rax
mov rcx, qword [rbp + 0x60]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov dword [rbp + 0x24], eax
mov eax, 0x53d3dd8c
jmp 0x140354d6d
cmp eax, 0x178eac8
jne 0x140354d6d
mov rax, qword [rbp]
mov rax, qword [rbp + 0x18]
add rsp, 0x108
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret