Function at 0x1401a7c08
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov r15, r8
mov r12, rdx
mov rdi, rcx
xor r14d, r14d
xor r13d, r13d
call fcn.1401a74d0
mov ebx, eax
test eax, eax
jns 0x1401a7c4c
mov ecx, eax
jmp 0x1401a7e3f
lea r14, [rdi + 0x60]
test r14, r14
je 0x1401a7c63
mov rcx, r14
call fcn.140077dac
mov r13d, 1
mov rcx, qword [rdi]
mov edx, dword [rcx + 4]
sub edx, 1
je 0x1401a7c7e
cmp edx, 1
je 0x1401a7c77
xor esi, esi
jmp 0x1401a7c83
mov esi, 1
jmp 0x1401a7c83
mov esi, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, dword [rdi + 8]
test ecx, ecx
je 0x1401a7e2a
cmp ecx, 1
jne 0x1401a7e44
cmp dword [r15], esi
jb 0x1401a7e11
cmp qword [r12], 0
je 0x1401a7e11
cmp dword [rdi + 0x38], esi
jae 0x1401a7cea
mov r8d, dword [rdi + 0x38]
mov r10d, esi
sub r10d, dword [rdi + 0x38]
movzx ecx, byte [rdi + 0x37]
mov r9b, sil
sub r9b, byte [rdi + 0x38]
test ecx, ecx
je 0x1401a7cd9
cmp ecx, 1
je 0x1401a7cd3
xor eax, eax
jmp 0x1401a7cdd
mov rax, qword [rdi + 0x10]
jmp 0x1401a7cdd
lea rax, [rdi + 0x10]
mov byte [r8 + rax], r9b
inc r8
sub r10, 1
jne 0x1401a7cbb
test esi, esi
je 0x1401a7d3a
xor edx, edx
mov r11d, esi
movzx ecx, byte [rdi + 0x57]
test ecx, ecx
je 0x1401a7d0a
cmp ecx, 1
je 0x1401a7d04
xor eax, eax
jmp 0x1401a7d0e
mov rax, qword [rdi + 0x40]
jmp 0x1401a7d0e
lea rax, [rdi + 0x40]
movzx ecx, byte [rdi + 0x37]
mov r10b, byte [rdx + rax]
test ecx, ecx
je 0x1401a7d29
cmp ecx, 1
je 0x1401a7d23
xor eax, eax
jmp 0x1401a7d2d
mov rax, qword [rdi + 0x10]
jmp 0x1401a7d2d
lea rax, [rdi + 0x10]
xor byte [rdx + rax], r10b
inc rdx
sub r11, 1
jne 0x1401a7cf3
mov r8, qword [rdi]
lea rcx, [rdi + 0x10]
movzx edx, byte [rcx + 0x27]
test edx, edx
je 0x1401a7d55
cmp edx, 1
je 0x1401a7d52
xor ecx, ecx
jmp 0x1401a7d55
mov rcx, qword [rcx]
and dword [rbp - 0x31], 0
mov qword [rbp - 0x39], rcx
test rcx, rcx
jne 0x1401a7d66
xor eax, eax
jmp 0x1401a7d76
mov rax, qword [0x1404524a8]
mov ecx, dword [rax]
lea rax, [rbp - 0x39]
add rax, rcx
and dword [rbp - 0x21], 0
lea rdx, [rbp - 9]
movaps xmm0, xmmword [r12]
xor r9d, r9d
mov qword [rbp - 0x29], rax
lea rax, [0x140054e1c]
movaps xmm1, xmmword [rbp - 0x29]
mov qword [rbp - 1], rax
lea rax, [rbp + 0x7f]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0xf], r8
lea r8d, [r9 + 0x40]
mov qword [rbp + 0x1b], rax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rbp + 0x27], rax
movdqa xmmword [rbp - 0x29], xmm1
mov qword [rbp - 9], 3
mov dword [rbp + 0x17], 0x80
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], r15
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x7f]
test ebx, ebx
js 0x1401a7e3d
and dword [rdi + 0x38], 0
lea rcx, [rdi + 0x40]
movzx edx, byte [rcx + 0x17]
test edx, edx
je 0x1401a7e05
cmp edx, 1
je 0x1401a7e02
xor ecx, ecx
jmp 0x1401a7e05
mov rcx, qword [rcx]
mov r8d, esi
xor edx, edx
call sub.msvcrt.dll_memset
jmp 0x1401a7e44
mov rax, qword [r12]
neg rax
mov dword [r15], esi
sbb ebx, ebx
and ebx, 0xc004d107
cmp qword [r12], 0
jmp 0x1401a7e3b
mov eax, dword [rdi + 0x38]
neg eax
sbb ebx, ebx
and ebx, 0x80004005
cmp dword [rdi + 0x38], 0
je 0x1401a7e44
mov ecx, ebx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test r14, r14
je 0x1401a7e5d
test r13d, r13d
je 0x1401a7e5d
mov rcx, r14
call fcn.14007ae68
lea r11, [rsp + 0x90]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret