Function at 0x140008830
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
xor r14d, r14d
mov qword [rsp + 0x68], rcx
mov r12, r8
mov qword [rsp + 0x38], rcx
mov r8d, dword [rcx]
lea rdi, [0x140078b48]
mov qword [rsp + 0x70], r14
mov r15, rcx
mov qword [rsp + 0x78], rdi
lea ebx, [r14 + 1]
mov qword [rsp + 0x60], r14
mov r13, rdx
mov esi, 0xc0000135
mov ecx, r8d
test r8d, r8d
je 0x140008eae
sub ecx, ebx
je 0x140008ac2
sub ecx, ebx
je 0x1400089c5
cmp ecx, ebx
je 0x1400088b9
mov esi, 0xc0000002
jmp 0x140009132
mov esi, 0xc0000004
mov r14d, 0x1000
nop dword [rax]
nop dword [rax + rax]
mov edx, r14d
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x140008918
lea r9, [rbp + 0x150]
mov r8d, r14d
mov rdx, rax
mov ecx, reloc.Cabinet.dll_FCIAddFile
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
test eax, eax
jns 0x14000890d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
add r14d, r14d
cmp esi, 0xc0000004
je 0x1400088d0
test esi, esi
js 0x140009132
lea rax, [rsp + 0x50]
xor r14d, r14d
mov qword [rsp + 0x48], rax
cmp dword [rdi], r14d
jbe 0x140009132
test ebx, ebx
je 0x140009132
mov eax, r14d
imul rcx, rax, 0x128
mov rax, qword [rcx + rdi + 0x18]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + rdi + 0x20]
mov dword [rsp + 0x40], eax
movzx eax, word [rcx + rdi + 0x2e]
add rcx, 0x30
add rcx, rax
add rcx, rdi
je 0x1400089b4
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140008972
call fcn.1400071b0
mov r15, rax
test rax, rax
je 0x1400089b4
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rdx, r12
mov dword [rsp + 0x44], 0
lea rcx, [rsp + 0x30]
call r13
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
inc r14d
cmp r14d, dword [rdi]
jb 0x140008936
jmp 0x140009132
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [r15 + 8]
mov rcx, qword [rax]
mov eax, r14d
mov r9, qword [rcx + 8]
mov r8d, dword [r9 + 0xc]
mov edx, dword [r9 + 8]
add r8, r9
test edx, edx
je 0x140009132
mov rcx, r8
cmp dword [rcx], 4
je 0x140008a07
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x1400089f3
jmp 0x140009132
lea rcx, [rax + rax*2]
mov r14d, dword [r8 + rcx*4 + 8]
add r14, r9
je 0x140009132
xor esi, esi
mov edi, esi
cmp dword [r14], esi
jbe 0x140009132
test ebx, ebx
je 0x140009132
mov eax, edi
imul rcx, rax, 0x6c
mov rax, qword [rcx + r14 + 4]
mov qword [rsp + 0x30], rax
mov eax, dword [rcx + r14 + 0xc]
mov dword [rsp + 0x40], eax
mov r8d, dword [rcx + r14 + 0x18]
mov rax, qword [r15 + 8]
mov rcx, qword [rax]
add r8, qword [rcx + 8]
je 0x140008ab2
mov edx, Ordinal_96
lea rcx, [r8 + 4]
call fcn.140032ce8
lea rcx, [rsp + 0x50]
lea rdx, [rax + 2]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x30]
call fcn.1400093c0
test eax, eax
je 0x140008aa1
mov rcx, qword [rbp + 0x150]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008aa5
mov dword [rsp + 0x44], esi
mov rdx, r12
lea rcx, [rsp + 0x30]
call r13
mov ebx, eax
inc edi
cmp edi, dword [r14]
jb 0x140008a26
jmp 0x140009132
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [r15 + 8]
mov rcx, qword [rax]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x78], r15
test r8d, r8d
je 0x140008b52
cmp r8d, ebx
jne 0x140008cca
lea rax, [rbp + 0x150]
mov r9d, 0x30
lea r8, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140009132
cmp dword [rbp + 0x150], 0x30
jne 0x140009132
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140009132
mov r8d, Ordinal_41
mov qword [rbp - 0x80], rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x70]
call fcn.140013350
test eax, eax
je 0x140009132
jmp 0x140008b71
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbp - 0x30], xmm0
lea rax, [rbp + 0xe0]
mov r8d, Ordinal_69
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rbp - 0x38]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rax
call fcn.140013350
test eax, eax
je 0x140009132
mov rcx, qword [rbp + 0x100]
mov rdi, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff0
add rdi, 0x10
cmp rcx, rdi
je 0x140008cb8
nop
test ebx, ebx
je 0x140008cb8
lea rax, [rbp + 0x40]
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov r8d, 0x68
lea rdx, [rsp + 0x60]
call fcn.140013350
mov ebx, eax
test eax, eax
je 0x140008ca7
mov rax, qword [rbp + 0x70]
mov ecx, 0x40
movups xmm0, xmmword [rbp + 0x98]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x80]
mov dword [rsp + 0x40], eax
movq rax, xmm0
shr rax, 0x10
movzx edx, ax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140008ca7
movzx r8d, word [rsp + 0x52]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x60], rax
call fcn.140013350
test eax, eax
je 0x140008c9c
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x30]
call fcn.1400093c0
test eax, eax
je 0x140008c8a
mov rcx, qword [rbp + 0x150]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008c8f
mov dword [rsp + 0x44], r14d
mov rdx, r12
lea rcx, [rsp + 0x30]
call r13
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x50]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
jne 0x140008bc0
mov esi, r14d
test ebx, ebx
je 0x140009132
lea rdi, [0x140078b48]
test esi, esi
js 0x140009132
cmp dword [r15], 1
jne 0x140008ce1
mov rax, qword [r15 + 8]
mov r10, qword [rax]
jmp 0x140008cea
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r10, rax
mov ecx, dword [r15]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r15
test ecx, ecx
je 0x140008d0a
cmp ecx, 1
jne 0x140009132
mov r9d, 8
lea rax, [rbp + 0x150]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rcx, r10
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140009132
cmp dword [rbp + 0x150], 8
jne 0x140009132
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140009132
mov r8d, 0x10
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.140013350
test eax, eax
je 0x140009132
lea rax, [rbp + 0xb0]
mov r8d, reloc.WLDAP32.dll_Ordinal_36
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x60]
mov eax, dword [rbp - 0x54]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov esi, 0x8000000d
call fcn.140013350
test eax, eax
je 0x140009132
mov eax, dword [rbp + 0xc4]
mov edi, dword [rbp - 0x54]
sub rax, 8
add rdi, 0xc
cmp rax, rdi
je 0x14000912f
nop
test ebx, ebx
je 0x14000912f
lea rcx, [rbp + 8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rcx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
mov r8d, Ordinal_54
call fcn.140013350
test eax, eax
je 0x140008e99
mov eax, dword [rbp + 0x20]
mov ecx, 0x40
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x28]
mov dword [rsp + 0x40], eax
movzx eax, word [rbp + 0x34]
mov word [rsp + 0x50], ax
movzx eax, word [rbp + 0x36]
mov edx, eax
mov word [rsp + 0x52], ax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140008e99
movzx r8d, word [rsp + 0x52]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
mov eax, dword [rbp + 0x38]
mov qword [rsp + 0x60], rax
call fcn.140013350
test eax, eax
je 0x140008e8e
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x30]
call fcn.1400093c0
test eax, eax
je 0x140008e7c
mov rcx, qword [rbp + 0x150]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008e81
mov dword [rsp + 0x44], r14d
mov rdx, r12
lea rcx, [rsp + 0x30]
call r13
mov ebx, eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rbp + 0x10]
sub rax, 8
cmp rax, rdi
jne 0x140008dc0
jmp 0x14000912f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [r15]
mov r10, rax
mov qword [rbp - 0x78], rdi
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], r15
test ecx, ecx
je 0x140008f3a
cmp ecx, ebx
jne 0x140008fe9
lea rax, [rbp + 0x150]
mov r9d, 0x30
lea r8, [rbp - 0x28]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r10
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140008fe9
cmp dword [rbp + 0x150], 0x30
jne 0x140008fe9
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140008fe9
mov r8d, Ordinal_41
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.140013350
test eax, eax
je 0x140008fe9
jmp 0x140008f59
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
movsd xmm0, qword [rax + 0x20]
movsd qword [rbp - 0x30], xmm0
mov rax, qword [rbp - 0x38]
mov rdi, qword [rax + 0x20]
add rax, 0x10
sub rdi, 0x10
cmp rdi, rax
je 0x140008fdf
nop
test ebx, ebx
je 0x140008fdf
mov rax, qword [rdi + 0x30]
lea rdx, [rbp + 0x150]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov eax, dword [rdi + 0x40]
mov dword [rsp + 0x40], eax
lea rax, [rdi + 0x58]
mov qword [rsp + 0x48], rax
call fcn.1400093c0
test eax, eax
je 0x140008fb8
mov rcx, qword [rbp + 0x150]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008fbd
mov dword [rsp + 0x44], r14d
mov rdx, r12
lea rcx, [rsp + 0x30]
call r13
mov rdi, qword [rdi + 0x10]
mov ebx, eax
mov rax, qword [rbp - 0x38]
sub rdi, 0x10
add rax, 0x10
cmp rdi, rax
jne 0x140008f70
mov esi, r14d
lea rdi, [0x140078b48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
test ebx, ebx
je 0x140009132
test esi, esi
js 0x140009132
cmp dword [r15], 1
jne 0x140009012
mov rax, qword [r15 + 8]
mov r10, qword [rax]
jmp 0x14000901b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r10, rax
mov ecx, dword [r15]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], r15
test ecx, ecx
je 0x14000903b
cmp ecx, 1
jne 0x140009132
mov r9d, 8
lea rax, [rbp + 0x150]
lea r8, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov rcx, r10
lea edx, [r9 + 0x12]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140009132
cmp dword [rbp + 0x150], 8
jne 0x140009132
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x140009132
mov r8d, 0x10
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.140013350
test eax, eax
je 0x140009132
mov eax, dword [rbp - 0x54]
mov edi, dword [rax + 0x14]
add rax, 0x10
sub rdi, 8
cmp rdi, rax
je 0x14000912f
test ebx, ebx
je 0x14000912f
mov eax, dword [rdi + 0x18]
lea rdx, [rbp + 0x150]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov eax, dword [rdi + 0x20]
mov dword [rsp + 0x40], eax
movzx eax, word [rdi + 0x2c]
mov word [rsp + 0x50], ax
movzx eax, word [rdi + 0x2e]
mov word [rsp + 0x52], ax
mov eax, dword [rdi + 0x30]
mov qword [rsp + 0x58], rax
call fcn.1400093c0
test eax, eax
je 0x14000910a
mov rcx, qword [rbp + 0x150]
mov eax, dword [rcx + 8]
mov dword [rsp + 0x44], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x14000910f
mov dword [rsp + 0x44], r14d
mov rdx, r12
lea rcx, [rsp + 0x30]
call r13
mov edi, dword [rdi + 8]
mov ebx, eax
mov eax, dword [rbp - 0x54]
sub rdi, 8
add rax, 0x10
cmp rdi, rax
jne 0x1400090b2
mov esi, r14d
lea r11, [rsp + 0x220]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret