Function at 0x1400cf480
Capabilities:
Allocate thread local storage
Check os version
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbp
sub rsp, 0x190
xor ebp, ebp
mov qword [sym.ProcessHacker.exe_PhInstanceHandle], rdx
mov qword [rsp + 0x28], rbp
xor edx, edx
mov ecx, 0x1002
mov qword [rsp + 0x20], rbp
mov r9d, 0x100000
mov r8d, 0x200000
call qword [sym.imp.ntdll.dll_RtlCreateHeap]
mov qword [0x140196670], rax
test rax, rax
jne 0x1400cf4cf
mov eax, 0xc000009a
add rsp, 0x190
pop rbp
ret
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
jns 0x1400cf4f6
mov edx, 0x7fffffff
mov dword [sym.ProcessHacker.exe_WindowsVersion], edx
jmp 0x1400cf68e
lea rcx, [sym.ProcessHacker.exe_PhOsVersion]
mov eax, 2
lea rdx, [rsp + 0x70]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400cf510
mov rax, qword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rsp + 0x74]
cmp eax, 6
jne 0x1400cf5c6
mov eax, dword [rsp + 0x78]
cmp eax, 1
jb 0x1400cf5c8
jne 0x1400cf59a
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x3d
jmp 0x1400cf65c
cmp eax, 2
jne 0x1400cf5ae
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jmp 0x1400cf65c
cmp eax, 3
jne 0x1400cf65c
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x3f
jmp 0x1400cf65c
jae 0x1400cf5d3
mov dword [sym.ProcessHacker.exe_WindowsVersion], ebp
jmp 0x1400cf65c
cmp eax, 0xa
jne 0x1400cf64f
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x1400cf651
mov ecx, dword [rsp + 0x7c]
cmp ecx, 0x2800
je 0x1400cf643
cmp ecx, 0x295a
je 0x1400cf637
cmp ecx, 0x3839
je 0x1400cf62b
cmp ecx, 0x3ad7
je 0x1400cf61f
cmp ecx, 0x3fab
mov eax, 0x68
mov edx, 0x7fffffff
cmovne eax, edx
mov dword [sym.ProcessHacker.exe_WindowsVersion], eax
jmp 0x1400cf65c
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x67
jmp 0x1400cf65c
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x66
jmp 0x1400cf65c
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x65
jmp 0x1400cf65c
mov dword [sym.ProcessHacker.exe_WindowsVersion], 0x64
jmp 0x1400cf65c
jbe 0x1400cf65c
mov edx, 0x7fffffff
mov dword [sym.ProcessHacker.exe_WindowsVersion], edx
mov dword [sym.ProcessHacker.exe_ProcessQueryAccess], 0x1000
mov dword [sym.ProcessHacker.exe_ProcessAllAccess], 0x1f1fff
mov dword [sym.ProcessHacker.exe_ThreadQueryAccess], 0x800
mov dword [sym.ProcessHacker.exe_ThreadSetAccess], 0x400
mov dword [sym.ProcessHacker.exe_ThreadAllAccess], 0x1f0fff
xor r9d, r9d
lea rdx, [sym.ProcessHacker.exe_PhSystemBasicInformation]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
xor r9d, r9d
lea rcx, [0x140196248]
xor r8d, r8d
mov edx, 0xf0003
call qword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
test eax, eax
js 0x1400cf958
cmp byte [0x1401967d8], 1
lea rcx, [0x140193830]
mov eax, 0xfa0
mov qword [rsp + 0x1a8], rsi
cmovbe eax, ebp
mov dword [0x14018dea8], eax
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
lea rcx, [0x140193840]
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
xor eax, eax
mov dword [0x140193850], ebp
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov ecx, 0x40
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
mov qword [0x140193820], rax
lea rax, [rsp + 0x30]
mov qword [0x140196820], rax
mov dword [0x140193854], 0x200
mov qword [0x140193858], 0x40
call sym.ProcessHacker.exe_PhCreateObject
mov esi, 1
mov rdx, rax
mov ecx, esi
mov word [rax], bp
lock xadd dword [0x1401937ec], ecx
movzx ecx, cl
mov byte [rax + 2], cl
mov dword [rax + 4], ebp
mov qword [rax + 8], rbp
lea rax, str.Type
mov qword [rdx + 0x10], rax
cmp ecx, 0x100
jae 0x1400cf94c
mov word [rdx - 0x10], cx
mov qword [rsp + 0x1b8], r14
lea r14, [0x140196820]
mov qword [r14 + rcx*8], rdx
lea ecx, [rsi + 0x3f]
mov qword [0x140193820], rdx
mov dword [rdx + 4], esi
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, rax
mov ecx, esi
mov word [rax], bp
lock xadd dword [0x1401937ec], ecx
movzx eax, cl
lea rcx, str.Alloc
mov qword [rdx + 0x10], rcx
mov byte [rdx + 2], al
mov dword [rdx + 4], ebp
mov qword [rdx + 8], rbp
cmp eax, 0x100
jae 0x1400cf940
mov qword [r14 + rax*8], rdx
mov qword [0x140193828], rdx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140196214], eax
cmp eax, 0xffffffff
je 0x1400cf821
call fcn.1400c8ff0
test al, al
jne 0x1400cf82b
mov eax, 0xc0000001
jmp 0x1400cf90f
mov rdx, qword [0x140193820]
mov ecx, 0x40
mov qword [rsp + 0x1b0], rdi
call sym.ProcessHacker.exe_PhCreateObject
mov rdi, rax
mov ecx, esi
mov word [rax], si
lock xadd dword [0x1401937ec], ecx
movzx eax, cl
lea rcx, [0x1400cfb80]
mov qword [rdi + 8], rcx
lea rcx, str.FileStream
mov qword [rdi + 0x10], rcx
mov byte [rdi + 2], al
mov dword [rdi + 4], ebp
cmp eax, 0x100
jae 0x1400cf934
lea rcx, [rdi + 0x20]
mov qword [rsp + 0x1a0], rbx
mov qword [r14 + rax*8], rdi
call qword [sym.imp.ntdll.dll_RtlInitializeSListHead]
mov rdx, qword [0x140193820]
mov ecx, 0x40
mov dword [rdi + 0x30], ebp
mov dword [rdi + 0x34], 0x10
mov qword [rdi + 0x38], 0x40
mov qword [0x140196660], rdi
call sym.ProcessHacker.exe_PhCreateObject
mov word [rax], bp
lock xadd dword [0x1401937ec], esi
mov rbx, qword [rsp + 0x1a0]
lea rdx, [0x1400d0f00]
movzx esi, sil
mov qword [rax + 8], rdx
lea rdx, str.SymbolProvider
mov qword [rax + 0x10], rdx
mov byte [rax + 2], sil
mov dword [rax + 4], ebp
cmp esi, 0x100
jae 0x1400cf928
mov rdi, qword [rsp + 0x1b0]
mov qword [r14 + rsi*8], rax
mov qword [0x140196658], rax
xor eax, eax
mov r14, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1a8]
add rsp, 0x190
pop rbp
ret
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov ecx, 0xc0000001
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov eax, 0xc0000001
add rsp, 0x190
pop rbp
ret