Function at 0x140008e30
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14001f028]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, rdx
mov edi, ecx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
xor ecx, ecx
mov qword [rbp + 0x1f], rcx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 9], rcx
mov qword [rbp - 1], 0xf
lea r8d, [rcx + 7]
lea rdx, str.VEH.sys
lea rcx, [rbp - 0x19]
call fcn.140005ef0
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x19]
call fcn.140008b20
lea rcx, [0x140008a40]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov esi, 1
mov dword [rbp - 0x21], esi
mov r12d, esi
cmp edi, esi
jle 0x140008f69
lea rbx, [r14 + 8]
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008ee0
cmp rax, 5
jne 0x140008f12
add rcx, 2
lea rdx, [0x140019c50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140008f12
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140009192
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008f20
cmp rax, 6
jne 0x140008f59
add rcx, 4
lea rdx, [0x140019c50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140008f59
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140008f59
cmp word [rax + 2], 0x2d
je 0x140009192
inc r12d
add rbx, 8
cmp r12d, edi
jl 0x140008ed0
mov byte [rbp - 0x29], 0
mov r12d, 0xffffffff
cmp edi, esi
jle 0x140009019
lea rbx, [r14 + 8]
mov r15d, esi
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008f90
cmp rax, 4
jne 0x140008fc2
add rcx, 2
lea rdx, [0x140019c60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140008fc2
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x14000919e
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140008fd0
cmp rax, 5
jne 0x140009009
add rcx, 4
lea rdx, [0x140019c60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140009009
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140009009
cmp word [rax + 2], 0x2d
je 0x14000919e
inc r15d
add rbx, 8
cmp r15d, edi
jl 0x140008f82
xor r13b, r13b
mov r15d, 0xffffffff
cmp edi, esi
jle 0x1400090ca
lea rbx, [r14 + 8]
nop
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009040
cmp rax, 0x12
jne 0x14000906e
add rcx, 2
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000906e
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x1400090d1
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009080
cmp rax, 0x13
jne 0x1400090b9
add rcx, 4
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400090b9
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x1400090b9
cmp word [rax + 2], 0x2d
je 0x1400091aa
inc esi
mov dword [rbp - 0x21], esi
add rbx, 8
cmp esi, edi
jl 0x140009030
mov dword [rbp - 0x21], 0xffffffff
xor esi, esi
mov dword [rbp + 7], esi
lea r9, [rbp + 7]
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, dword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
lea r9, [rbp + 7]
mov r8d, dword [rbp + 7]
mov rdx, rax
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
je 0x140009154
nop dword [rax]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [rbp + 7], esi
lea r9, [rbp + 7]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, dword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
lea r9, [rbp + 7]
mov r8d, dword [rbp + 7]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jne 0x140009110
mov r14, rsi
mov ebx, esi
cmp dword [rdi], esi
jbe 0x1400091c0
nop dword [rax]
mov esi, ebx
imul rcx, rsi, 0x128
movzx eax, word [rdi + rcx + 0x2e]
add rax, rdi
lea rdx, [rcx + 0x30]
add rdx, rax
lea rcx, [0x14000fae0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
test rax, rax
jne 0x1400091b2
inc ebx
cmp ebx, dword [rdi]
jb 0x140009160
jmp 0x1400091be
test r12d, r12d
setg byte [rbp - 0x29]
jmp 0x140008f7b
test r15d, r15d
setg r13b
jmp 0x14000902a
mov dword [rbp - 0x21], esi
jmp 0x1400090d1
imul rax, rsi, 0x128
mov r14, qword [rax + rdi + 0x18]
xor esi, esi
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, str._____ntoskrnl__0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006080
lea rdx, [0x1400012b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [0x140006260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r12d, r12d
jle 0x140009230
lea rdx, str.___Free_pool_memory_after_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006080
lea rdx, [0x140006260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r15d, r15d
jle 0x140009258
lea rdx, str.___Mdl_memory_usage_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006080
lea rdx, [0x140006260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp dword [rbp - 0x21], 0
jle 0x140009281
lea rdx, str.___Pass_Allocation_Ptr_as_first_param_enabled
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006080
lea rdx, [0x140006260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call fcn.140001780
mov qword [0x14001fae0], rax
mov rbx, qword [rbp + 0xf]
cmp rax, 0xffffffffffffffff
je 0x1400092d0
mov dword [rbp - 0x21], esi
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x48], rcx
mov byte [rsp + 0x30], r13b
movzx ecx, byte [rbp - 0x29]
mov byte [rsp + 0x20], cl
mov r8, r14
mov rdx, rbx
mov rcx, rax
call fcn.140009ec0
mov rcx, qword [0x14001fae0]
test rax, rax
jne 0x140009308
call fcn.140001c90
nop
test rbx, rbx
je 0x140009372
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000936a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000936a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001c90
lea rdx, str.___success
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006080
lea rdx, [0x140006260]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
test rbx, rbx
je 0x140009366
mov rdx, qword [rbp + 0x1f]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000935e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009301
mov rcx, rbx
call fcn.14000cc10
xor eax, eax
jmp 0x140009377
mov rcx, rbx
call fcn.14000cc10
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14000cbf0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret