Function at 0x14005b00c
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor r15d, r15d
lea rdx, [0x140435c70]
mov r12, rcx
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
mov qword [rbp + 0x28], r15
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x14040f6ac]
movdqa xmmword [rbp + 0x30], xmm1
mov r13d, r15d
mov rdi, r8
call fcn.1400ed82c
xorps xmm0, xmm0
mov qword [rbp + 0x50], r15
xor edx, edx
movdqa xmmword [rbp + 0x40], xmm0
lea r8d, [r15 + 0x20]
mov qword [rsp + 0x38], r15
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x40], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x58], r15
call sub.msvcrt.dll_memset
xor edx, edx
mov qword [rbp - 0x20], r15
lea r8d, [r15 + 0x30]
mov qword [rbp - 0x18], r15
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x10], r15
call sub.msvcrt.dll_memset
mov qword [rbp - 0x30], r15
mov ebx, r15d
mov qword [rsp + 0x28], r15
mov esi, r15d
mov qword [rbp - 0x60], r15
mov r14d, r15d
test rdi, rdi
jne 0x14005b0f7
mov edi, 0x80070057
lea rdx, [0x1404362cc]
lea rcx, [0x14040fd70]
mov r15d, edi
call fcn.1400edb90
mov ecx, edi
call fcn.14007ab24
jmp 0x14005b775
cmp qword [rbp + 0xd0], r15
jne 0x14005b10a
mov edi, 0x80070057
mov r15d, edi
jmp 0x14005b0eb
cmp qword [rbp + 0xd8], r15
je 0x14005b100
mov rax, qword [0x1404379a0]
mov edi, 1
mov qword [rbp - 0x38], rax
lea r13, [rax + 8]
mov qword [rsp + 0x20], r13
test r13, r13
je 0x14005b143
mov edx, edi
mov rcx, r13
call fcn.140073400
mov rax, qword [rbp - 0x38]
mov dword [rsp + 0x30], edi
cmp qword [r12 + 0x30], r15
jne 0x14005b154
mov ecx, 0x80070005
mov r15d, ecx
jmp 0x14005b0ed
cmp qword [r12 + 0x38], r15
je 0x14005b14a
mov r15, qword [rax + 0xd8]
mov r13, qword [0x140437a10]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x14005b1ad
xor edx, edx
lea r8d, [rax + 0x28]
mov rcx, rdi
call sub.msvcrt.dll_memset
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
jmp 0x14005b1b0
mov rdi, rax
mov qword [rbp - 0x48], rdi
mov ecx, 0x8007000e
test rdi, rdi
jne 0x14005b1cb
mov r15d, ecx
call fcn.14007ab24
xor r13d, r13d
jmp 0x14005b1f7
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.14006b444
xor r13d, r13d
mov r15d, eax
test eax, eax
jns 0x14005b1ec
mov ecx, eax
call fcn.14007ab24
jmp 0x14005b1f7
mov qword [rbp - 0x48], r13
mov rsi, rdi
mov qword [rbp - 0x30], rdi
mov ecx, r15d
call fcn.14007ab44
lea rcx, [rbp - 0x48]
call fcn.14005ba84
test r15d, r15d
jns 0x14005b215
mov ecx, r15d
jmp 0x14005b76b
mov eax, dword [rbp + 0xb8]
lea rdx, [rsp + 0x28]
mov dword [rbp - 0x40], eax
lea rcx, [rbp - 0x48]
mov rax, qword [rbp + 0xc0]
mov qword [rbp - 0x48], rax
call fcn.1400610b8
mov r15d, eax
test eax, eax
jns 0x14005b245
mov ecx, eax
jmp 0x14005b76b
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [0x1403b8660]
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call rdi
mov r15d, eax
test eax, eax
js 0x14005b23e
mov rax, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x68], rax
xor r9d, r9d
lea rax, [0x1400055b8]
mov qword [rsp + 0x48], 3
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x10]
lea r8d, [r9 + 0x40]
mov qword [rsp + 0x60], rax
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x78]
test r15d, r15d
js 0x14005b20d
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x14005b2d0
mov ecx, 0x8000ffff
jmp 0x14005b768
mov rdx, qword [r12 + 0x30]
mov rax, qword [rdx]
cmp rax, qword [rcx]
jne 0x14005b763
mov rax, qword [rdx + 8]
cmp rax, qword [rcx + 8]
jne 0x14005b763
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x14005b2c6
mov rax, qword [r12 + 0x38]
sub rcx, rax
movzx edx, word [rax]
movzx r8d, word [rax + rcx]
sub edx, r8d
jne 0x14005b316
add rax, 2
test r8d, r8d
jne 0x14005b300
test edx, edx
jne 0x14005b763
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14005b34b
lea rdx, [rbp - 0x60]
call fcn.14007a9ec
mov r15d, eax
test eax, eax
jns 0x14005b347
mov ecx, eax
call fcn.14007ab24
mov r14, qword [rbp - 0x60]
jmp 0x14005b770
mov r14, qword [rbp - 0x60]
mov r15, qword [rsi + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [0x1403b8660]
mov rdx, qword [rsp + 0x28]
mov rcx, r15
call rdi
mov r15d, eax
test eax, eax
js 0x14005b23e
mov rdi, qword [rbp - 0x20]
mov r15, r14
mov rax, qword [rbp - 0x38]
mov r14, r13
mov qword [rbp - 8], r12
mov qword [rbp], rax
test rdi, rdi
je 0x14005b3ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
test r15, r15
lea rdx, [0x140436e80]
mov rax, r13
lea rcx, [0x1404196f8]
cmovne rax, r15
mov edi, 3
mov qword [rbp - 0x20], rax
lea rax, [0x140002b78]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x74]
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rdi
call fcn.1400ed188
lea r8d, [rdi + 0x3d]
xor r9d, r9d
lea rdx, [rsp + 0x48]
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x74]
test r15d, r15d
js 0x14005b20d
mov rax, qword [rbp - 0x58]
lea r8d, [rdi + 0x3d]
mov rcx, qword [rbp + 0x28]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [0x14001f278]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x50], rax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x70], rax
mov eax, dword [rbp + 0x20]
mov dword [rbp - 0x80], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x70]
test r15d, r15d
js 0x14005b20d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r15d, [rdi + 0x25]
xor edx, edx
mov rcx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14005b4cb
mov r8d, r15d
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbx], 1
mov qword [rbx + 8], r13
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
jmp 0x14005b4ce
mov rbx, r13
test rbx, rbx
jne 0x14005b4dd
mov ecx, 0x8007000e
jmp 0x14005b768
mov r15d, r13d
cmp qword [rsi + 8], r13
jne 0x14005b50f
mov edi, 0x80004005
lea rdx, [0x1404311d8]
lea rcx, [0x140422f60]
mov r15d, edi
call fcn.1400ebd6c
mov ecx, edi
call fcn.14007ab24
mov edi, 3
jmp 0x14005b55c
cmp qword [rsi + 0x10], r13
jne 0x14005b51f
mov edi, 0x80004005
mov r15d, edi
jmp 0x14005b501
lea rax, [0x1400017f8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x68], rsi
lea rax, [rbp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x60], rax
lea r8d, [r9 + 0x40]
lea ecx, [r8 + 0x79]
call sub.ntdll.dll_NtQuerySystemInformation
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x14005b20d
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x6c], rax
xor r9d, r9d
lea rax, [0x1400014b8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rax
mov edi, 1
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x74], eax
lea r8d, [rdi + 0x3f]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x78], rax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 0x64]
mov qword [rbp - 0x80], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x68]
test r15d, r15d
js 0x14005b20d
mov r9, qword [rbp - 0x50]
lea rcx, [rsp + 0x38]
mov r8d, dword [rbp - 0x64]
mov edx, edi
call fcn.140054e10
mov r15d, eax
test eax, eax
js 0x14005b23e
mov r9, qword [rbp + 0x30]
test r9, r9
je 0x14005b628
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.140079670
mov r15d, eax
test eax, eax
js 0x14005b23e
mov r9, qword [rbp + 0x30]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005b632
mov r8d, r13d
mov dword [rbp + 0xc8], r13d
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140054e10
mov r15d, eax
test eax, eax
js 0x14005b23e
mov r9, qword [rbp - 0x18]
test r9, r9
je 0x14005b67c
lea rdx, [rbp + 0xc8]
mov rcx, r9
call fcn.140079670
mov r15d, eax
test eax, eax
js 0x14005b23e
mov r9, qword [rbp - 0x18]
mov r8d, dword [rbp + 0xc8]
jmp 0x14005b67f
mov r8d, r13d
mov edx, 3
lea rcx, [rsp + 0x38]
call fcn.140054e10
mov r15d, eax
test eax, eax
js 0x14005b23e
mov r8, qword [rbp + 0xd0]
lea rcx, [rsp + 0x38]
mov rdx, qword [rbp + 0xd8]
call fcn.140054d6c
mov r15d, eax
test eax, eax
js 0x14005b23e
lea rsi, [rbx + 8]
mov rdi, qword [rsi]
test rdi, rdi
je 0x14005b6e7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov qword [rsi], r13
mov r13, qword [rbp - 0x10]
lea rdx, [0x14042f5a0]
lea rcx, [0x140421cd0]
call fcn.1400ed4d4
xor r15d, r15d
test r13, r13
je 0x14005b72e
mov edi, dword [r13 - 4]
xor ecx, ecx
call fcn.14007ab44
mov r8, rsi
mov edx, edi
mov rcx, r13
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x14005b731
mov ecx, eax
call fcn.14007ab24
jmp 0x14005b731
and qword [rsi], r15
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x14005b20d
mov rcx, qword [r12 + 0x28]
test rcx, rcx
je 0x14005b757
call fcn.140068464
and qword [r12 + 0x28], 0
mov rax, rbx
xor ebx, ebx
mov qword [r12 + 0x28], rax
jmp 0x14005b770
mov ecx, 0x80070005
mov r15d, ecx
call fcn.14007ab24
mov r13, qword [rsp + 0x20]
mov ecx, r15d
call fcn.14007ab44
xor r12d, r12d
test r14, r14
je 0x14005b7a1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x14005b7c5
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [0x1403b8660]
mov rcx, rdi
call rsi
mov qword [rsp + 0x28], r12
lea rcx, [rbp - 0x30]
call fcn.14005ba84
test rbx, rbx
je 0x14005b7db
mov rcx, rbx
call fcn.140068464
lea rcx, [rbp - 0x28]
call fcn.140058990
lea rcx, [rbp - 0x58]
call fcn.1400588e4
lea rcx, [rbp - 0x50]
call fcn.14005ba10
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14005b80b
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0x40], r12
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x14005b82a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403b8660]
mov rcx, rbx
call rdi
lea rcx, [rbp + 0x10]
call fcn.14005b86c
test r13, r13
je 0x14005b847
cmp dword [rsp + 0x30], r12d
je 0x14005b847
mov rcx, r13
call fcn.14007329c
mov eax, r15d
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret