Function at 0x177d8
Capabilities:
Get system information on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x100
xor esi, esi
mov r13, rcx
cmp rdx, rsi
mov ebx, esi
je 0x180fc
cmp byte [rdx], 0xe
jne 0x1808d
mov edi, dword [rdx + 0x18]
mov rbp, qword [rcx + 0x18]
mov r12d, dword [rdx + 0x10]
mov r14d, dword [rdx + 8]
mov eax, 0xb4a00070
cmp edi, eax
ja 0x17dea
je 0x17da1
mov eax, 0xb4a00047
cmp edi, eax
ja 0x17c11
je 0x17bae
cmp edi, 0xb0100
je 0x17aca
cmp edi, 0xb4a00004
je 0x17a03
cmp edi, 0xb4a00008
je 0x1799f
cmp edi, 0xb4a0000c
je 0x17981
cmp edi, 0xb4a00010
je 0x17943
cmp edi, 0xb4a00014
je 0x17922
cmp edi, 0xb4a00037
je 0x178e8
cmp edi, 0xb4a0003c
je 0x178c2
cmp edi, 0xb4a00040
jne 0x17fa3
cmp r12d, 8
jb 0x18101
mov r8, qword [rbp]
lea rdx, [0x0001d5e0]
lea rcx, [0x0001d5e8]
call fcn.00011b90
jmp 0x18101
cmp r12d, 8
jb 0x18101
mov r8, qword [rbp]
lea rdx, [0x0001d5e0]
lea rcx, [0x0001d5e8]
call fcn.00011a88
jmp 0x18101
cmp byte [0x0001d530], sil
je 0x17918
cmp byte [0x0001d430], sil
jne 0x18101
cmp byte [0x0001d1d0], sil
jne 0x18101
cmp byte [0x0001d6c0], sil
jne 0x18101
mov ebx, 0xc00000a3
jmp 0x18101
mov byte [0x0001d1d0], sil
call fcn.00012b28
mov byte [0x0001d430], sil
mov ebx, eax
mov byte [0x0001d6c0], sil
jmp 0x18101
cmp qword [0x0001d538], rsi
je 0x17918
cmp qword [0x0001d548], rsi
je 0x17918
cmp qword [0x0001d560], rsi
je 0x17918
cmp qword [0x0001d568], rsi
je 0x17918
mov byte [0x0001d1d0], 1
mov byte [0x0001d430], 1
mov byte [0x0001d6c0], 1
jmp 0x18101
cmp r12d, 0x22
jb 0x180fc
lea rcx, [0x0001d538]
mov rdx, rbp
call fcn.000117c0
jmp 0x17ccb
cmp byte [0x0001d530], sil
je 0x179f9
cmp r14d, 0x22
jb 0x180fc
cmp qword [0x0001d538], rsi
mov eax, dword [rbp]
mov dword [rsp + 0x148], eax
je 0x179e7
lea r8, [rsp + 0x148]
lea rcx, [0x0001d538]
mov rdx, rbp
call fcn.000116d8
mov ebx, eax
mov eax, dword [rsp + 0x148]
jmp 0x179ec
mov ebx, 0x8000001a
cmp ebx, esi
jl 0x18101
jmp 0x17ef2
mov ebx, 0xc0000022
jmp 0x18101
cmp r12d, 0x10
jne 0x180fc
cmp qword [rbp + 8], rsi
je 0x17a8a
mov rcx, rbp
call fcn.0001811c
cmp eax, esi
mov ebx, eax
jl 0x18101
mov rcx, rbp
call fcn.00012a3c
cmp eax, esi
mov ebx, eax
jl 0x17ac0
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, r13
mov qword [0x0001d480], rax
call qword [sym.imp.ntoskrnl.exe_IoGetRequestorProcessId]
lea rdx, [0x0001d5e0]
lea rcx, [0x0001d5e8]
mov r8d, eax
call fcn.00011a88
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
lea rcx, [rsp + 0xb0]
mov qword [0x0001d710], rax
mov qword [rsp + 0xb0], rax
call fcn.00018508
jmp 0x18101
call qword [sym.imp.ntoskrnl.exe_PsGetCurrentProcessId]
mov rcx, r13
mov qword [0x0001d480], rax
call qword [sym.imp.ntoskrnl.exe_IoGetRequestorProcessId]
lea rdx, [0x0001d5e0]
lea rcx, [0x0001d5e8]
mov r8d, eax
call fcn.00011b90
mov rcx, rbp
call fcn.00012a3c
mov ebx, eax
call fcn.000182f8
jmp 0x18101
lea rdx, [0x0001b050]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x158]
lea rcx, [rsp + 0xc0]
mov edx, 0x80000000
call qword [sym.imp.ntoskrnl.exe_IoGetDeviceObjectPointer]
cmp eax, esi
jl 0x18101
lea rcx, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov r9d, dword [rbp + 0xc]
mov rdx, qword [rsp + 0x150]
lea rax, [rsp + 0xe8]
add r9d, 0x14
mov r8, rbp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xd0]
mov ecx, 0xb0100
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
cmp rax, rsi
je 0x17b9b
mov rcx, qword [rsp + 0x150]
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x17b9b
lea rcx, [rsp + 0xd0]
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x18101
mov eax, esi
lea rcx, [0x0001d558]
xchg dword [0x0001d180], eax
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov rcx, qword [0x0001d548]
cmp rcx, rsi
mov r11b, al
je 0x17bfc
cmp qword [rcx], rcx
je 0x17bfc
mov rdx, qword [rcx]
cmp rdx, rcx
je 0x17bfc
movabs rcx, 0xfffff78000000320
mov rax, qword [rcx]
mov qword [rdx + 0x18], rax
mov rdx, qword [rdx]
cmp rdx, qword [0x0001d548]
jne 0x17be9
lea rcx, [0x0001d558]
mov dl, r11b
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
jmp 0x18101
cmp edi, 0xb4a00048
je 0x17d89
cmp edi, 0xb4a0004c
je 0x17d6b
cmp edi, 0xb4a00050
je 0x17d34
cmp edi, 0xb4a00054
je 0x17d0f
cmp edi, 0xb4a00058
je 0x17cd2
cmp edi, 0xb4a00060
je 0x17cb3
cmp edi, 0xb4a00064
je 0x17c99
cmp edi, 0xb4a00068
je 0x17c85
cmp edi, 0xb4a0006c
jne 0x17fa3
cmp r12d, 8
jb 0x180fc
mov rcx, rbp
call fcn.0001859c
jmp 0x17ccb
cmp r12d, 8
jb 0x180fc
mov rcx, rbp
call fcn.00018508
jmp 0x17ccb
mov ecx, dword [rbp]
add rcx, 4
cmp r12, rcx
jb 0x180fc
mov rcx, rbp
call fcn.00015f78
jmp 0x17ccb
mov ecx, dword [rbp]
add rcx, 4
cmp r12, rcx
jb 0x180fc
mov rcx, rbp
call fcn.00015ed0
mov ebx, eax
jmp 0x18101
cmp r12d, 0xc
jb 0x18101
cmp qword [rbp], rsi
je 0x180fc
mov edx, dword [rbp + 8]
mov rcx, qword [rbp]
mov r9b, 1
mov r8, rbp
call fcn.00013890
cmp eax, esi
mov ebx, eax
jl 0x18101
mov qword [r13 + 0x38], 8
jmp 0x18101
cmp r12d, 0xc
jb 0x180fc
lea r9, [rsp + 0x148]
mov r8d, r14d
mov rdx, rbp
mov rcx, rbp
call fcn.00014180
jmp 0x18027
cmp r12d, 8
jb 0x180fc
mov edi, 0x118
cmp r14d, edi
jb 0x180fc
mov rcx, qword [rbp]
mov rdx, rbp
call fcn.000143f4
cmp eax, esi
mov ebx, eax
jl 0x18101
mov qword [r13 + 0x38], rdi
jmp 0x18101
mov ecx, 5
lea r9, [rsp + 0x148]
mov rdx, rbp
mov r8d, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
jmp 0x18027
lea r8, [rsp + 0x148]
mov edx, r14d
mov rcx, rbp
call fcn.00014318
jmp 0x18027
lea rbp, [0x0001d6d8]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea rdi, [0x0001d6c8]
jmp 0x17dd0
mov rax, qword [rcx]
xor edx, edx
mov qword [0x0001d6c8], rax
mov qword [rax + 8], rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [0x0001d6c8]
cmp rcx, rdi
jne 0x17dba
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
jmp 0x18101
mov eax, 0xb4a000f8
cmp edi, eax
ja 0x17f47
je 0x17e4d
cmp edi, 0xb4a00074
je 0x17f05
cmp edi, 0xb4a000c0
je 0x17efb
cmp edi, 0xb4a000c4
je 0x17e4d
cmp edi, 0xb4a000e0
je 0x17e4d
cmp edi, 0xb4a000e4
je 0x17e4d
cmp edi, 0xb4a000e8
je 0x17e4d
cmp edi, 0xb4a000ec
je 0x17e4d
cmp edi, 0xb4a000f0
je 0x17e4d
cmp edi, 0xb4a000f4
jne 0x17fa3
xor edx, edx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x48]
call fcn.0001a520
xor r8d, r8d
lea rcx, [rsp + 0x68]
lea edx, [r8 + 1]
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov rcx, qword [0x0001d528]
mov dword [rsp + 0x80], edi
mov dword [rsp + 0x84], r12d
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x90], r14d
mov qword [rsp + 0x98], rbp
call qword [sym.imp.ntoskrnl.exe_IoAllocateWorkItem]
cmp rax, rsi
mov qword [rsp + 0x60], rax
je 0x18086
lea r9, [rsp + 0x60]
lea rdx, [0x00016118]
mov r8d, 1
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_IoQueueWorkItem]
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ebx, dword [rsp + 0xa4]
mov eax, dword [rsp + 0xa0]
mov qword [r13 + 0x38], rax
jmp 0x18101
mov ecx, 0x10
jmp 0x17d70
cmp r12d, 8
jb 0x180fc
cmp r14d, 4
jb 0x180fc
cmp byte [0x0001d6c0], sil
mov rax, qword [rbp]
mov qword [rsp + 0x50], rax
je 0x17f37
lea rcx, [rsp + 0x50]
call fcn.0001860c
mov esi, eax
mov dword [rbp], esi
mov qword [r13 + 0x38], 4
jmp 0x18101
cmp edi, 0xb4a000fc
je 0x17e4d
cmp edi, 0xb4a00114
je 0x18072
cmp edi, 0xb4a00118
je 0x1805b
cmp edi, 0xb4a00128
je 0x1803d
cmp edi, 0xb4a00130
je 0x1800a
cmp edi, 0xb4a00138
je 0x18000
cmp edi, 0xb4a0013c
je 0x17fdc
cmp edi, 0xb4a00400
je 0x17fc4
cmp edi, 0xb4a00404
je 0x17fad
mov ebx, 0xc0000010
jmp 0x18101
cmp r12d, 0x18
jb 0x180fc
mov rcx, rbp
call fcn.0001837c
jmp 0x17ccb
cmp r12d, 0x22
jb 0x180fc
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
jmp 0x18101
cmp r12d, 8
jb 0x18101
mov rcx, qword [rbp]
call fcn.000196fc
neg al
sbb ebx, ebx
not ebx
and ebx, 0xc0000001
jmp 0x18101
call fcn.00018a58
jmp 0x18101
cmp r14d, 4
jb 0x18101
lea r8, [rsp + 0x148]
mov edx, r14d
mov rcx, rbp
call fcn.0001931c
cmp eax, esi
mov ebx, eax
jl 0x18101
mov eax, dword [rsp + 0x148]
jmp 0x17ef2
cmp r12d, 0x12
jb 0x180fc
lea rcx, [0x0001d538]
mov rdx, rbp
call fcn.000118f8
jmp 0x17ccb
cmp r12d, 8
jb 0x180fc
mov rcx, rbp
call fcn.00017014
jmp 0x18101
cmp r12d, 8
jb 0x180fc
mov rcx, rbp
call fcn.00016cf0
jmp 0x18101
mov ebx, 0xc000009a
jmp 0x18101
cmp byte [rdx], 0xf
jne 0x180fc
cmp dword [rdx + 0x18], 0xb4a0007b
jne 0x180da
cmp dword [rdx + 8], 0x20
mov rax, qword [rcx + 0x70]
jb 0x180fc
lea rcx, [0x0001d1e8]
lea rdi, [0x0001d6c8]
lea rbp, [0x0001d6d8]
mov qword [rax], rcx
lea rcx, [0x0001d1f8]
mov qword [rax + 0x10], rdi
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rbp
mov qword [r13 + 0x38], 0x20
jmp 0x18101
cmp dword [rdx + 0x18], 0xb4a00090
jne 0x18101
cmp dword [rdx + 8], 8
jb 0x180fc
mov rax, qword [rcx + 0x18]
lea rcx, [0x00018450]
mov qword [rax], rcx
jmp 0x17d02
mov ebx, 0xc000000d
mov eax, ebx
add rsp, 0x100
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret