Function at 0x14005e3c8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa8
xor ebx, ebx
mov r13, rdx
mov qword [rbp - 0x59], rbx
mov r12d, ebx
mov qword [rbp + 0x57], rbx
mov r14d, ebx
mov qword [rbp - 0x61], rbx
mov r15d, ebx
mov qword [rbp - 0x69], rbx
test rdx, rdx
jne 0x14005e422
mov ecx, 0x80070057
mov esi, ecx
call fcn.140079c40
jmp 0x14005e7b4
test r8d, r8d
je 0x14005e411
test r9, r9
je 0x14005e411
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14005e411
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14005e411
lea rdx, [0x1400028d8]
mov qword [rbp - 0x15], r9
mov qword [rbp - 0x29], rdx
xor r9d, r9d
lea rdx, [rbp + 0x5f]
mov dword [rbp - 0x19], r8d
mov qword [rbp - 0x21], rdx
lea rdx, [rbp - 0x31]
mov qword [rbp - 9], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x31], 3
mov dword [rbp - 0xd], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x5f]
cmp esi, 0x8007000d
jne 0x14005e48d
mov esi, 0xc004f307
jmp 0x14005e491
test esi, esi
jns 0x14005e495
mov ecx, esi
jmp 0x14005e418
mov rsi, qword [0x14043f560]
lea rcx, [0x14043f520]
call fcn.140052d24
mov rdi, rax
mov rax, qword [rsi]
mov rbx, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
lea rcx, [rbp - 0x61]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r9, [0x1403cab60]
mov rcx, rsi
lea r8, str.msft:rm_algorithm_volume_1.0
mov rdx, rdi
call rax
mov esi, eax
test eax, eax
jns 0x14005e4ed
mov ecx, eax
jmp 0x14005e418
mov rdi, qword [0x14043f560]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
lea rcx, [rbp - 0x69]
mov rax, rbx
mov qword [rsp + 0x20], rcx
lea r8, [0x1403cad80]
mov rcx, rdi
lea rdx, str.msft:spp_stockobjects_plugins_params_named
xor r9d, r9d
call rax
mov esi, eax
test eax, eax
js 0x14005e4e6
lea rdx, [rbp + 0x57]
mov rcx, r13
call fcn.14005216c
mov esi, eax
test eax, eax
jns 0x14005e54d
mov ecx, eax
call fcn.140079c40
jmp 0x14005e7b0
mov rax, qword [0x14043f520]
test rax, rax
je 0x14005e791
lea r12, [rax + 8]
test r12, r12
je 0x14005e571
mov rcx, r12
call fcn.14006f734
test r12, r12
mov r15, qword [rbp + 0x57]
lea r9, [rbp - 0x59]
mov rdx, r15
lea r8, str.applicationId
setne r14b
call fcn.1400d4d98
mov esi, eax
test eax, eax
js 0x14005e4e6
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:GVLK
call fcn.1400eb6a4
test eax, eax
jns 0x14005e5b7
mov ecx, 0xc004f306
jmp 0x14005e416
cmp dword [rbp + 0x57], 0
jne 0x14005e5da
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:CSVLK
call fcn.1400eb6a4
test eax, eax
js 0x14005e5ad
cmp dword [rbp + 0x57], 0
je 0x14005e5ad
mov rax, qword [rbp - 0x59]
lea rcx, str.SppBindingAppId
mov rbx, qword [rbp - 0x69]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x51], rcx
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov r13d, 1
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rax, rdi
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x14005e4e6
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingSkuId
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x49], 2
mov qword [rbp - 0x41], r15
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x14005e4e6
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationType
mov qword [rbp - 0x51], rax
lea rax, str.Token
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x14005e4e6
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationResponse
mov qword [rbp - 0x51], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x41], rax
mov eax, dword [rbp + 0x67]
mov dword [rbp - 0x39], eax
mov rax, qword [rbx]
mov dword [rbp - 0x49], 4
mov rdi, qword [rax + 0x48]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rcx, rbx
call rax
lea rdx, [0x14043b548]
mov esi, eax
lea rcx, [0x140415fcc]
call fcn.1400edf70
test esi, esi
js 0x14005e491
mov rdi, qword [0x14043f5b0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x59]
mov rax, rbx
mov rcx, rdi
call rax
mov esi, eax
test eax, eax
js 0x14005e4e6
mov rbx, qword [rbp - 0x61]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x69]
mov rax, rdi
mov rcx, rbx
call rax
lea rdx, [0x1404397f4]
mov esi, eax
lea rcx, [0x14042b938]
call fcn.1400edc30
test esi, esi
jns 0x14005e7b4
jmp 0x14005e491
mov esi, 0x8000ffff
mov ecx, esi
call fcn.140079c40
lea rdx, [0x140439dcc]
lea rcx, [0x14041cbf0]
call fcn.1400ed8ec
mov r15, qword [rbp + 0x57]
mov ecx, esi
call fcn.140079c60
mov rbx, qword [rbp - 0x69]
test rbx, rbx
je 0x14005e80a
lea rdx, [0x14043dc50]
lea rcx, [0x1404205e8]
call fcn.1400ed5b8
mov rax, qword [rbx]
lea rdx, [0x14043af88]
lea rcx, [0x140421758]
mov rdi, qword [rax + 0x10]
call fcn.1400ee2b8
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
and qword [rbp - 0x69], 0
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14005e833
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
and qword [rbp - 0x61], 0
test r15, r15
je 0x14005e841
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14005e850
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x14005e862
test r14d, r14d
je 0x14005e862
mov rcx, r12
call fcn.14007240c
mov eax, esi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret