Function at 0x14009381c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov rcx, qword [0x14017a048]
lea r14, [0x14017a048]
cmp rcx, r14
je 0x14009387d
test dword [rcx + 0x1c], 0x200
je 0x14009387d
cmp byte [rcx + 0x19], 4
jb 0x14009387d
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015e7f8]
mov edx, 0xf
call fcn.140006b98
xor ebp, ebp
mov dword [rsp + 0x20], ebp
test rsi, rsi
jne 0x1400938a0
lea r8, str.pwszSystemDevicePath
mov edx, 0xbf
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008ac24
xor edx, edx
mov qword [rsi], rbp
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.msvcrt.dll_memset
xor edx, edx
lea r9, [rsp + 0x20]
xor r8d, r8d
lea ecx, [rdx + 0x62]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, 0xc0000023
test eax, eax
jns 0x140093933
cmp eax, ebx
je 0x140093933
cmp eax, 0x80000005
je 0x140093933
cmp eax, 0xc0000004
je 0x140093933
mov ecx, eax
call fcn.140026c9c
mov ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140093ad2
test byte [rcx + 0x1c], 8
je 0x140093aa9
cmp byte [rcx + 0x19], 2
jb 0x140093aa9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015e7f8]
mov edx, 0x10
mov r9d, eax
call fcn.140006bc4
jmp 0x140093aa2
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140093955
mov ebx, 0x8007000e
jmp 0x140093aa2
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rdi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x1400939d0
mov ecx, eax
call fcn.140026c9c
mov ebx, eax
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140093a93
test byte [rcx + 0x1c], 8
je 0x140093a93
cmp byte [rcx + 0x19], 2
jb 0x140093a93
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015e7f8]
mov edx, 0x11
mov r9d, eax
call fcn.140006bc4
jmp 0x140093a93
movzx edx, word [rdi]
lea rax, [rdx + 2]
cmp rax, 0x208
jbe 0x1400939eb
mov ecx, ebx
call fcn.140026c9c
jmp 0x140093a91
test dl, 1
je 0x140093a0b
lea r8, str.pSysInfo__SystemPartition.Length___sizeof_WCHAR___0
mov edx, pe_nt_image_headers64
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.14008ac24
movzx edx, word [rdi]
movzx eax, dx
add eax, 8
cmp eax, dword [rsp + 0x20]
jbe 0x140093a1e
mov ebx, 0x8000ffff
jmp 0x140093a93
movzx r9d, dx
lea rax, [rsp + 0x30]
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x30]
shr r9, 1
mov r8d, 0x104
sub rdx, rax
lea rax, [r8 - 0x104]
add rax, r9
je 0x140093a5e
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140093a5e
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x140093a3c
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
mov rax, r8
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
test r8, r8
je 0x140093a93
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14008c1cc
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14017a048]
cmp rcx, r14
je 0x140093ad2
test dword [rcx + 0x1c], 0x200
je 0x140093ad2
cmp byte [rcx + 0x19], 4
jb 0x140093ad2
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015e7f8]
mov edx, 0x12
call fcn.140006b98
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140001d90
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret