Function at 0x1400eb1f0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rbx
lea rbp, [rax - 0x57]
sub rsp, 0xd8
mov qword [rax + 0x18], rsi
lea rdx, [0x1400df380]
mov qword [rax - 0x18], rdi
mov rbx, rcx
mov qword [rax - 0x20], r12
mov ecx, 8
mov qword [rax - 0x38], r15
mov r12d, r8d
mov r15, r9
lea r8, [0x1400df390]
mov r9d, 0x20
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateHashtable
mov rsi, rax
cmp rbx, 4
jne 0x1400eb2fa
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov edx, ebx
mov r8d, 0x800
mov dword [rbp + 0x5f], 0x800
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x5f]
lea r9, [rbp + 0x5f]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
cmp eax, 0xc0000004
jne 0x1400eb2c9
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov r8d, dword [rbp + 0x5f]
mov edx, 4
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov r8d, dword [rbp + 0x5f]
lea r9, [rbp + 0x5f]
mov rdx, rax
mov ecx, 0xb
mov rdi, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, eax
test ebx, ebx
js 0x1400eb4ec
mov r8, qword [rbp + 0x7f]
mov r9, rsi
mov rdx, r15
mov rcx, rdi
call fcn.1400eaca0
mov rcx, qword [sym.4yUlCM3HuVsHzW5CaCX.exe_PhHeapHandle]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400eb4ec
mov rcx, qword [rbp + 0x67]
xor dil, dil
mov qword [rsp + 0xc0], r13
xor r13d, r13d
test rcx, rcx
jne 0x1400eb40c
cmp byte [0x1401910b4], dil
lea rcx, [rbp + 0x67]
mov qword [rbp - 0x61], rbx
mov edx, 0x410
mov qword [rbp - 0x59], r13
jne 0x1400eb373
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x61]
mov qword [rbp - 0x21], r13
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r13d
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp - 0x19], r13
call qword [sym.imp.ntdll.dll_NtOpenProcess]
cmp eax, 0xc0000022
jne 0x1400eb37c
movzx eax, byte [0x1401910b4]
test al, al
je 0x1400eb38b
mov edx, 0x410
lea rcx, [rbp + 0x67]
lea r8, [rbp - 0x61]
call fcn.1400ecc50
test eax, eax
jns 0x1400eb405
movzx eax, byte [0x1401910b4]
mov edi, dword [sym.4yUlCM3HuVsHzW5CaCX.exe_ProcessQueryAccess]
or edi, 0x10
mov qword [rbp - 0x61], rbx
mov qword [rbp - 0x59], r13
test al, al
je 0x1400eb3ab
mov eax, edi
and eax, 0x1410
cmp eax, edi
je 0x1400eb3ec
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x30
lea r9, [rbp - 0x61]
mov qword [rbp - 0x21], r13
lea r8, [rbp - 0x29]
mov dword [rbp - 0x11], r13d
mov edx, edi
mov qword [rbp - 0x19], r13
lea rcx, [rbp + 0x67]
movdqu xmmword [rbp - 9], xmm0
call qword [sym.imp.ntdll.dll_NtOpenProcess]
mov ebx, eax
cmp eax, 0xc0000022
jne 0x1400eb3fd
cmp byte [0x1401910b4], r13b
je 0x1400eb3fd
lea r8, [rbp - 0x61]
mov edx, edi
lea rcx, [rbp + 0x67]
call fcn.1400ecc50
mov ebx, eax
test ebx, ebx
js 0x1400eb4e4
mov rcx, qword [rbp + 0x67]
mov dil, 1
lea rax, [0x1400eaac0]
mov qword [rsp + 0xb8], r14
mov r14, qword [rbp + 0x7f]
lea r8, [rbp + 7]
mov qword [rbp + 7], rax
lea rdx, [0x1400e7f90]
lea rax, [rbp - 0x51]
mov qword [rbp - 0x51], r15
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], 1
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x31], r13d
mov dword [rbp + 0x17], 2
call fcn.1400e7df0
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 0x5f]
mov r9d, 8
mov qword [rsp + 0x20], r13
mov edx, 0x1a
mov ebx, eax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400eb4b0
cmp qword [rbp + 0x5f], r13
je 0x1400eb4b0
mov rcx, qword [rbp + 0x67]
lea r8, [rbp + 7]
lea rdx, [0x1400e8400]
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], 3
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x31], r13d
call fcn.1400e8250
mov ebx, eax
test r12b, 3
je 0x1400eb4cd
mov rcx, qword [rbp + 0x67]
mov r9, r14
mov r8, r15
mov qword [rsp + 0x20], rsi
mov edx, r12d
call fcn.1400eaf10
mov r14, qword [rsp + 0xb8]
test dil, dil
je 0x1400eb4e4
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntdll.dll_NtClose]
mov r13, qword [rsp + 0xc0]
lea rcx, [rsi - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
mov r15, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0x100]
cmp eax, 1
jne 0x1400eb524
call fcn.1400d9400
mov eax, ebx
add rsp, 0xd8
pop rbx
pop rbp
ret