Function at 0x1400c5190
Capabilities:
Check for software breakpoints
Get system information on windows

Disassembly:
push rbp
lea rdx, str.MachineGuid
mov rbp, rsp
push r15
push r14
push r13
mov r13, rcx
lea rcx, str.SOFTWAREMicrosoftCryptography
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x140
lea rsi, [rsp + 0x24]
lea r12, [rsp + 0x48]
mov qword [rsp + 0x30], 0
mov r9, rsi
mov r8, r12
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0xf8
call fcn.1400c5070
test eax, eax
jne 0x1400c52c8
mov edx, dword [rsp + 0x24]
cmp edx, 0xf7
ja 0x1400c52c8
mov r8d, edx
cmp edx, 0x1f
jbe 0x1400c52b2
xor r9d, r9d
xor edi, edi
xor ecx, ecx
xor ebx, ebx
xor r11d, r11d
mov eax, ebx
cmp r8, rax
jbe 0x1400c5275
mov r10b, byte [rsp + rax + 0x48]
lea eax, [r10 - 0x30]
cmp al, 9
jbe 0x1400c5248
lea eax, [r10 - 0x61]
cmp al, 5
ja 0x1400c523c
lea eax, [r10 - 0x57]
jmp 0x1400c5248
lea eax, [r10 - 0x41]
cmp al, 5
ja 0x1400c5271
lea eax, [r10 - 0x37]
mov r10, rcx
shl rcx, 4
add r11d, 4
mov dil, 1
shr r10, 0x3c
xor eax, r10d
mov r10, r9
shl r9, 4
shr r10, 0x3c
movzx eax, al
or rcx, r10
or r9, rax
inc ebx
jmp 0x1400c521a
test dil, dil
je 0x1400c5284
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], rcx
mov bl, 1
cmp r11d, 0x7e
ja 0x1400c5391
cmp edx, 0x10
jne 0x1400c5382
mov rax, qword [rsp + 0x48]
add qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
add qword [rsp + 0x38], rax
jmp 0x1400c538f
cmp edx, 0xf
ja 0x1400c5290
test edx, edx
je 0x1400c52c8
lea rcx, [rsp + 0x30]
mov rdx, r12
call fcn.1400b81d0
lea r14, str.DigitalProductId
mov r9, rsi
mov r8, r12
xor ebx, ebx
mov rdx, r14
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov dword [rsp + 0x24], 0xf8
call fcn.1400c5070
test eax, eax
jne 0x1400c5311
mov r8d, dword [rsp + 0x24]
lea eax, [r8 - 0x2b]
cmp eax, 0xcc
ja 0x1400c5311
lea rcx, [rsp + 0x30]
mov rdx, r12
mov bl, 1
call fcn.1400b81d0
mov r9, rsi
mov r8, r12
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionDefaultProductKey
mov rdx, r14
mov dword [rsp + 0x24], 0xf8
call fcn.1400c5070
test eax, eax
jne 0x1400c5351
mov r8d, dword [rsp + 0x24]
lea eax, [r8 - 0x2b]
cmp eax, 0xcc
ja 0x1400c5351
lea rcx, [rsp + 0x30]
mov rdx, r12
mov bl, 1
call fcn.1400b81d0
mov r9, rsi
mov r8, r12
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionDefaultProductKey2
mov rdx, r14
mov dword [rsp + 0x24], 0xf8
call fcn.1400c5070
test eax, eax
jne 0x1400c5391
mov r8d, dword [rsp + 0x24]
lea eax, [r8 - 0x2b]
cmp eax, 0xcc
ja 0x1400c5391
lea rcx, [rsp + 0x30]
mov rdx, r12
call fcn.1400b81d0
mov bl, 1
lea r15, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
mov r9, rsi
mov r8, r12
xor r14d, r14d
lea rdx, str.BootId
mov rcx, r15
mov dword [rsp + 0x24], 0xf8
call fcn.1400c5070
test eax, eax
jne 0x1400c53dc
mov r8d, dword [rsp + 0x24]
lea eax, [r8 - 2]
cmp eax, 0xf5
ja 0x1400c53dc
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r14b, 1
call fcn.1400b81d0
mov r9, rsi
mov r8, r12
lea rdx, str.BaseTime
mov rcx, r15
mov dword [rsp + 0x24], 0xf8
xor edi, edi
call fcn.1400c5070
test eax, eax
jne 0x1400c5421
mov r8d, dword [rsp + 0x24]
cmp r8d, 3
jbe 0x1400c5421
cmp dword [rsp + 0x48], 0
je 0x1400c5421
lea rcx, [rsp + 0x30]
mov rdx, r12
mov dil, 1
call fcn.1400b81d0
mov r9, rsi
mov r8d, 0x30
mov rdx, r12
mov ecx, 3
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
js 0x1400c5458
cmp dword [rsp + 0x24], 0x27
jbe 0x1400c5458
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400c5458
sub rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
jne 0x1400c546c
test dil, dil
jne 0x1400c5484
call fcn.1400c49c0
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400c5484
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov r8d, 8
mov dil, 1
call fcn.1400b81d0
test bl, bl
jne 0x1400c549c
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
jmp 0x1400c54b9
test r14b, r14b
jne 0x1400c54b9
test dil, dil
je 0x1400c5488
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [rsp + 0x4c], 0x1cccccb
jbe 0x1400c5488
movaps xmm0, xmmword [rsp + 0x30]
mov rax, r13
movups xmmword [r13], xmm0
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret