Function at 0x14000b4ec
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], r8d
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xa0
xor r12d, r12d
mov r13d, r9d
mov ebx, r12d
mov r15d, r8d
mov r14d, edx
call fcn.14000b458
mov qword [rbp - 0x59], rax
test rax, rax
je 0x14000b570
mov rdi, qword [0x14003d4e8]
lea r10d, [r12 + 1]
test rdi, rdi
je 0x14000b561
mov edx, dword [rdi]
mov ecx, r12d
test edx, edx
je 0x14000b561
mov rdi, qword [rdi + 8]
mov esi, ecx
shl rsi, 6
add rsi, rdi
cmp dword [rsi + 0xc], r10d
je 0x14000b58e
add ecx, r10d
cmp ecx, edx
jb 0x14000b54b
lea rdx, str.____Requested_provider_data_was_not_found_in_database__abort_r_n
mov ecx, r10d
call fcn.14000e264
mov rax, rbx
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x14000b561
mov qword [0x14003b030], rsi
test r13d, r13d
je 0x14000b5f4
mov eax, r13d
sub eax, r10d
je 0x14000b5d1
sub eax, r10d
je 0x14000b5ca
sub eax, r10d
je 0x14000b5c3
cmp eax, r10d
je 0x14000b5bc
mov r9d, dword [rsi + 0x1c]
jmp 0x14000b5dd
mov eax, 8
jmp 0x14000b5d4
mov eax, 4
jmp 0x14000b5d4
mov eax, 2
jmp 0x14000b5d4
mov eax, r10d
mov r9d, dword [rsi + 0x1c]
test eax, r9d
ja 0x14000b5f4
mov r8d, r13d
lea rdx, str.____Selected_shellcode__lu_is_not_supported_by_this_provider__supported_mask:_0x_08x___abort_r_n
mov ecx, r10d
call fcn.14000e264
jmp 0x14000b570
xor eax, eax
mov dword [rbp + 0x5f], r12d
lea rdi, [rbp - 0x51]
lea r9, [rbp + 0x5f]
lea edx, [rax + 0x20]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
lea ecx, [rax + 0x5a]
lea rdx, [rbp - 0x51]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000b657
mov ecx, dword [rbp - 0x41]
test ecx, ecx
je 0x14000b640
sub ecx, 1
je 0x14000b637
cmp ecx, 1
jne 0x14000b640
lea r8, str.FirmwareTypeUefi
jmp 0x14000b647
lea r8, str.FirmwareTypeBios
jmp 0x14000b647
lea r8, str.FirmwareTypeUnknown
lea rdx, str.___Firmware_type___s__r_n
xor ecx, ecx
call fcn.14000e264
jmp 0x14000b665
mov edx, eax
lea rcx, str.____Failed_to_query_firmware_type
call fcn.14000f0e0
mov r8, qword [rsi + 0x20]
lea rax, [rsi + 0x28]
mov r9, qword [rax]
lea rdx, str.___Provider:___ws___Name___ws__r_n
mov ecx, 2
mov qword [rbp - 0x61], rax
call fcn.14000e264
test r14d, r14d
je 0x14000b6a1
test byte [rsi + 0x18], 1
jne 0x14000b6a1
lea rdx, str.____Abort:_selected_provider_does_not_support_HVCI_r_n
mov ecx, 1
jmp 0x14000b56b
cmp r15d, dword [rsi]
jae 0x14000b6af
lea rdx, str.____Abort:_selected_provider_require_newer_Windows_NT_version_r_n
jmp 0x14000b697
cmp dword [rsi + 4], 0xffffffff
je 0x14000b6d2
cmp r15d, dword [rsi + 4]
mov r15d, 1
jbe 0x14000b6d8
lea rdx, str.____Warning:_selected_provider_may_not_work_on_this_Windows_NT_version_r_n
mov ecx, r15d
call fcn.14000e264
jmp 0x14000b6d8
mov r15d, 1
mov ecx, dword [rbp + 0x7f]
xor r14d, r14d
mov r8, qword [0x14003b0a0]
mov edx, ecx
mov rdi, qword [0x14003b098]
mov r9, qword [0x14003b080]
mov r10, qword [0x14003b078]
mov r11, qword [0x14003b030]
test ecx, ecx
je 0x14000b711
sub edx, 1
je 0x14000b711
cmp edx, 1
jne 0x14000b76b
test byte [r11 + 0x18], 0x20
je 0x14000b730
cmp qword [0x14003b088], r14
jne 0x14000b730
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r15d
jmp 0x14000b56b
test dword [r11 + 0x18], 0x180
je 0x14000b76b
mov eax, r15d
mov edx, r15d
test rdi, rdi
je 0x14000b74a
test r8, r8
jne 0x14000b74d
mov eax, r14d
test r10, r10
je 0x14000b757
test r9, r9
jne 0x14000b75a
mov edx, r14d
test eax, eax
jne 0x14000b76b
test edx, edx
jne 0x14000b76b
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000b728
test ecx, ecx
je 0x14000b81e
sub ecx, 1
je 0x14000b78f
cmp ecx, 1
jne 0x14000b7a3
cmp qword [0x14003b070], r14
jne 0x14000b7a3
lea rdx, str.____Abort:_selected_provider_does_not_support_changing_DSE_values_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x14000b728
test dword [r11 + 0x18], 0x100
je 0x14000b810
test rdi, rdi
je 0x14000b762
test r8, r8
je 0x14000b762
mov dl, r15b
mov ecx, 0x14
call fcn.1400017d0
mov dl, r15b
mov ecx, 0xa
call fcn.1400017d0
lea r12, [rsi + 0x18]
test dword [r12], 0x800
je 0x14000b7d8
call fcn.1400105fc
test eax, eax
je 0x14000b570
mov rax, qword gs:[0x30]
mov edi, 8
mov r8d, 0x478
mov edx, edi
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
test rax, rax
jne 0x14000b837
lea rdx, str.____Abort:_could_not_allocate_provider_context_r_n
jmp 0x14000b728
test r10, r10
je 0x14000b762
test r9, r9
jmp 0x14000b7a1
cmp qword [0x14003b068], r14
jne 0x14000b7a3
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
jmp 0x14000b728
lea rax, [0x14003b030]
mov qword [rbx + 0x40], rax
mov rax, qword [0x14003b0a8]
test rax, rax
je 0x14000b882
mov rcx, rbx
call rax
test eax, eax
jne 0x14000b882
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea rdx, str.____Abort:_provider_prerequisites_are_not_meet_r_n
mov rbx, r14
jmp 0x14000b728
test byte [r12], 0x40
je 0x14000b88e
mov rax, r14
jmp 0x14000b8bb
mov rax, qword [0x14003b030]
cmp dword [rax + 0x10], 2
jb 0x14000b8a6
mov dword [rax + 0x10], r15d
mov rax, qword [0x14003b030]
mov eax, dword [rax + 0x10]
lea rcx, str.PROCEXP152
lea rax, [rax + rax*4]
shl rax, 4
add rax, rcx
mov qword [rbx + 0x48], rax
mov rcx, rbx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r15, qword [rcx + 0x20]
mov rcx, qword [rbp - 0x61]
mov rcx, qword [rcx]
mov rax, rcx
test rcx, rcx
jne 0x14000b8eb
mov rcx, r14
jmp 0x14000b8f7
add rcx, 2
cmp word [rcx], r14w
jne 0x14000b8e7
sub rcx, rax
sar rcx, 1
movzx eax, word [r15 + 0x38]
lea rcx, [rcx + 0x20]
mov edx, edi
lea r8, [rax + rcx*2]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x14000b94a
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, r14
jmp 0x14000b570
mov eax, dword [rbp + 0x6f]
mov dword [rbx + 4], eax
mov rax, qword [rbp - 0x59]
mov qword [rbx + 0x10], rax
mov dword [rbx + 8], r13d
call fcn.14000dc90
mov qword [rbx + 0x18], rax
lea rdi, [rbp - 0x21]
xor eax, eax
mov dword [rbp + 0x5f], r14d
lea r9, [rbp + 0x5f]
lea rdx, [rbp - 0x21]
lea r13d, [rax + 0x40]
mov ecx, r13d
mov r8d, r13d
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14000b995
mov rax, qword [rbp + 7]
jmp 0x14000b9ae
xor eax, eax
lea rdi, [rbp - 0x51]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
lea rcx, [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp - 0x41]
mov ecx, 0x16
mov qword [rbx + 0x38], rax
mov r14d, 0x20206f49
call fcn.140001990
mov r8, rax
test rax, rax
je 0x14000ba13
xor ecx, ecx
cmp dword [rax], ecx
jbe 0x14000b9fa
mov edi, dword [r8]
add rax, 0x28
mov rdx, qword [rax]
mov r9, rcx
cmp rdx, rcx
jbe 0x14000b9e6
mov r14d, dword [rax - 0x20]
add rax, 0x28
mov rcx, rdx
cmp rdx, r9
cmovbe rcx, r9
sub rdi, 1
jne 0x14000b9d7
mov rax, qword gs:[0x30]
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbx + 0x30]
mov dword [rbx + 0xc], r14d
movzx edx, word [r15 + 0x38]
mov r8, qword [r15 + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.14000143c
mov rcx, qword [rbx + 0x30]
lea rdx, [0x140032530]
call fcn.140001398
mov rax, qword [rbp - 0x61]
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rax]
call fcn.140001398
mov rcx, qword [rbx + 0x30]
lea rdx, str..sys
call fcn.140001398
mov rax, qword [rbx + 0x40]
mov rcx, rbx
call qword [rax + 8]
test eax, eax
je 0x14000bae0
mov rax, qword [rbx + 0x40]
mov dword [rbx + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x14000b570
mov rdx, rbx
test byte [r12], r13b
jne 0x14000ba91
mov edx, dword [rsi + 8]
mov rcx, qword [rbx + 0x28]
call rax
test eax, eax
jne 0x14000b570
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_register_provider_driver
call fcn.14000f1ac
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14000bac2
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rbx + 0x40]
mov rcx, rbx
call qword [rax + 0x10]
mov r8, qword [rbx + 0x30]
test r8, r8
je 0x14000bafd
mov rax, qword gs:[0x30]
jmp 0x14000baed
mov rax, qword gs:[0x30]
mov r8, qword [rbx + 0x30]
mov rcx, qword [rax + 0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, qword gs:[0x30]
mov r8, rbx
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
jmp 0x14000b570