Function at 0x140011f38
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x20
and dword [rbp + 0x28], 0
lea rdi, [rbp + 0x20]
xor eax, eax
lea r9, [rbp + 0x28]
lea edx, [rax + 4]
mov ecx, edx
mov r8d, edx
rep stosb byte [rdi], al
mov ecx, 0xc4
lea rdx, [rbp + 0x20]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, 1
test eax, eax
js 0x140012036
lea rcx, str._t___SystemKernelVaShadowInformation_r_n
call fcn.140002fe4
mov dl, byte [rbp + 0x20]
lea rcx, str.KvaShadowEnabled
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowUserGlobal
shr edx, 1
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowPcid
shr edx, 2
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowInvpcid
shr edx, 3
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowRequired
shr edx, 4
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowRequiredAvailable
shr edx, 5
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str._tInvalidPteBit__lu_r_n
shr edx, 6
and edx, 0x3f
call fcn.140002fe4
mov edx, dword [rbp + 0x20]
lea rcx, str.L1DataCacheFlushSupported
shr edx, 0xc
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x20]
lea rcx, str.L1TerminalFaultMitigationPresent
shr edx, 0xd
and dl, bl
call fcn.140011ee0
jmp 0x140012044
mov edx, eax
lea rcx, str.Cannot_query_Kernel_VA_Shadow_information
call fcn.140011be4
xor eax, eax
mov dword [rbp + 0x28], 8
lea rdi, [rbp + 0x30]
lea r9, [rbp + 0x28]
lea rdx, [rbp + 0x30]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov ecx, 0xc9
lea r8d, [rax + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea ecx, [rax + 0x3ffffffe]
cmp ecx, ebx
jbe 0x14001237d
test eax, eax
je 0x14001208b
lea rcx, str.Cannot_query_speculation_control_information
jmp 0x140012384
mov r8d, dword [rbp + 0x28]
lea eax, [r8 - 4]
test eax, 0xfffffffb
je 0x1400120a8
lea rdx, str.Unknown_speculation_control_information_size__lu_r_n
mov ecx, ebx
call fcn.140010d44
lea rcx, str._t___SystemSpeculationControlInformation_r_n
call fcn.140002fe4
mov dl, byte [rbp + 0x30]
lea rcx, str.BpbEnabled
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledSystemPolicy
shr edx, 1
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledNoHardwareSupport
shr edx, 2
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlEnumerated
shr edx, 3
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCmdEnumerated
shr edx, 4
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.IbrsPresent
shr edx, 5
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.StibpPresent
shr edx, 6
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SmepPresent
shr edx, 7
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableAvailable
shr edx, 8
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableSupported
shr edx, 9
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisabledSystemWide
shr edx, 0xa
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisabledKernel
shr edx, 0xb
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableRequired
shr edx, 0xc
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledKernelToUser
shr edx, 0xd
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlRetpolineEnabled
shr edx, 0xe
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlImportOptimizationEnabled
shr edx, 0xf
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.EnhancedIbrs
shr edx, 0x10
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfStatusAvailable
shr edx, 0x11
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfProcessorNotAffected
shr edx, 0x12
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationEnabled
shr edx, 0x13
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_Hardware
shr edx, 0x14
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_LoadOption
shr edx, 0x15
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_CoreScheduler
shr edx, 0x16
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.EnhancedIbrsReported
shr edx, 0x17
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.MdsHardwareProtected
shr edx, 0x18
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.MbClearEnabled
shr edx, 0x19
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.MbClearReported
shr edx, 0x1a
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str._t_tTsxCtrlStatus__lu_r_n
shr edx, 0x1b
and edx, 3
call fcn.140002fe4
mov edx, dword [rbp + 0x30]
lea rcx, str.TsxCtrlReported
shr edx, 0x1d
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x30]
lea rcx, str.TaaHardwareImmune
shr edx, 0x1e
and dl, bl
call fcn.140011ee0
cmp dword [rbp + 0x28], 8
jne 0x14001238b
lea rcx, str._t___SystemSpeculationControlInformation_v2_r_n
call fcn.140002fe4
mov dl, byte [rbp + 0x34]
lea rcx, str.SbdrSsdpHardwareProtected
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x34]
lea rcx, str.FbsdpHardwareProtected
shr edx, 1
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x34]
lea rcx, str.PsdpHardwareProtected
shr edx, 2
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x34]
lea rcx, str.FbClearEnabled
shr edx, 3
and dl, bl
call fcn.140011ee0
mov edx, dword [rbp + 0x34]
lea rcx, str.FbClearReported
shr edx, 4
and dl, bl
call fcn.140011ee0
jmp 0x14001238b
lea rcx, str.Speculation_control_information_class_not_present
mov edx, eax
call fcn.140011be4
add rsp, 0x20
pop rdi
pop rbx
pop rbp
ret