Function at 0x1800138c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe0
mov rax, qword [0x1801e4940]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor esi, esi
mov r12d, r9d
mov r13d, r8d
mov r15d, edx
mov r14d, ecx
cmp ecx, 0x35
jb 0x180013910
mov r8d, ecx
lea rdx, str.___Pprovider_with_id__lu_is_not_supported__will_be_using_default_provider__0__r_n
mov ecx, 2
call fcn.1800224a0
xor r14d, r14d
xor eax, eax
mov qword [rsp + 0x128], rbx
lea rdi, [rsp + 0x40]
mov dword [rsp + 0x30], esi
mov ecx, 0x70
lea r9, [rsp + 0x30]
rep stosb byte [rdi], al
mov ecx, 0x9f
lea rdx, [rsp + 0x40]
mov r8d, 0x70
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x180013996
mov r8d, 0xc
lea rdx, [rbp - 0x7d]
lea rcx, str.Microsoft_Hv
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, 0xc
jne 0x18001397c
lea rdx, str.___MSFT_hypervisor_present_r_n
mov ecx, 2
call fcn.1800224a0
jmp 0x1800139fd
movsd xmm0, qword [rbp - 0x7d]
lea rdi, [rbp - 0x11]
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov eax, dword [rbp - 0x75]
mov dword [rbp - 9], eax
jmp 0x1800139e3
xor ecx, ecx
mov qword [rsp + 0x24], 0xffffffffffffffff
mov eax, 1
mov dword [rsp + 0x2c], 0xffffffff
cpuid
sar ecx, 0x1f
mov dword [rsp + 0x24], ebx
test cl, 1
je 0x1800139fd
xor ecx, ecx
lea rdi, [rbp - 0x11]
mov eax, 0x40000000
cpuid
mov dword [rsp + 0x28], ecx
xor eax, eax
mov ecx, 0x20
mov dword [rsp + 0x24], ebx
movsd xmm0, qword [rsp + 0x24]
rep stosb byte [rdi], al
mov dword [rbp - 9], edx
lea r8, [rbp - 0x11]
movsd qword [rbp - 0x11], xmm0
lea rdx, str.___The___s__hypervisor_present_r_n
mov ecx, 2
call fcn.1800224a0
call fcn.180013eb0
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180013a56
mov rdi, qword [0x1801e4f60]
test rdi, rdi
je 0x180013a45
mov edx, dword [rdi]
xor ecx, ecx
test edx, edx
je 0x180013a45
mov rdi, qword [rdi + 8]
nop dword [rax]
nop dword [rax + rax]
mov ebx, ecx
shl rbx, 6
add rbx, rdi
cmp dword [rbx + 0xc], r14d
je 0x180013a80
inc ecx
cmp ecx, edx
jb 0x180013a30
lea rdx, str.____Requested_provider_data_was_not_found_in_database__abort_r_n
mov ecx, 1
call fcn.1800224a0
mov rbx, qword [rsp + 0x128]
mov rax, rsi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180028780
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x180013a45
mov eax, r14d
imul rdi, rax, 0x88
lea rax, [0x1801e1ae0]
add rdi, rax
mov qword [rdi], rbx
test r12d, r12d
je 0x180013afd
mov eax, r12d
sub eax, 1
je 0x180013ad3
sub eax, 1
je 0x180013acc
sub eax, 1
je 0x180013ac5
cmp eax, 1
je 0x180013abe
lea r9, [rbx + 0x1c]
jmp 0x180013ae1
mov ecx, 8
jmp 0x180013ad8
mov ecx, 4
jmp 0x180013ad8
mov ecx, 2
jmp 0x180013ad8
mov ecx, 1
lea r9, [rbx + 0x1c]
test dword [rbx + 0x1c], ecx
ja 0x180013afd
mov r9d, dword [r9]
lea rdx, str.____Selected_shellcode__lu_is_not_supported_by_this_provider__supported_mask:_0x_08x___abort_r_n
mov r8d, r12d
mov ecx, 1
call fcn.1800224a0
jmp 0x180013a56
lea rcx, [rsp + 0x38]
call fcn.180021010
test eax, eax
jns 0x180013b1b
mov edx, eax
lea rcx, str.____Failed_to_query_firmware_type
call fcn.180023040
jmp 0x180013b54
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x180013b3f
sub ecx, 1
je 0x180013b36
cmp ecx, 1
jne 0x180013b3f
lea r8, str.FirmwareTypeUefi
jmp 0x180013b46
lea r8, str.FirmwareTypeBios
jmp 0x180013b46
lea r8, str.FirmwareTypeUnknown
lea rdx, str.___Firmware_type___s__r_n
xor ecx, ecx
call fcn.1800224a0
mov r9, qword [rbx + 0x28]
lea rdx, str.___Provider:___ws___Name___ws__r_n
mov r8, qword [rbx + 0x20]
mov ecx, 2
call fcn.1800224a0
test r15d, r15d
je 0x180013b84
test byte [rbx + 0x18], 1
jne 0x180013b84
lea rdx, str.____Abort:_selected_provider_does_not_support_HVCI_r_n
jmp 0x180013a4c
cmp r13d, dword [rbx]
jae 0x180013b95
lea rdx, str.____Abort:_selected_provider_require_newer_Windows_NT_version_r_n
jmp 0x180013a4c
mov eax, dword [rbx + 4]
cmp eax, 0xffffffff
je 0x180013bb3
cmp r13d, eax
jbe 0x180013bb3
lea rdx, str.____Warning:_selected_provider_may_not_work_on_this_Windows_NT_version_r_n
mov ecx, 1
call fcn.1800224a0
mov ecx, dword [rbp + 0x7f]
mov r8d, 1
mov edx, ecx
test ecx, ecx
je 0x180013bed
sub edx, r8d
je 0x180013bed
sub edx, r8d
je 0x180013bed
cmp edx, r8d
jne 0x180013c4e
cmp qword [rdi + 0x80], rsi
jne 0x180013cb0
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_process_handle_acquisition_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
mov ecx, r8d
jmp 0x180013a51
mov rax, qword [rdi]
mov edx, dword [rax + 0x18]
test dl, 0x20
je 0x180013c0d
cmp qword [rdi + 0x58], rsi
jne 0x180013c0d
lea rdx, str.____Abort:_selected_provider_does_not_support_memory_translation_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r8d
jmp 0x180013a51
test edx, 0x180
je 0x180013c4e
mov eax, r8d
mov edx, r8d
cmp qword [rdi + 0x68], rsi
je 0x180013c27
cmp qword [rdi + 0x70], rsi
jne 0x180013c29
xor eax, eax
cmp qword [rdi + 0x48], rsi
je 0x180013c35
cmp qword [rdi + 0x50], rsi
jne 0x180013c37
xor edx, edx
test eax, eax
jne 0x180013c4e
test edx, edx
jne 0x180013c4e
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r8d
jmp 0x180013a51
test ecx, ecx
je 0x180013cfc
sub ecx, r8d
je 0x180013c6f
cmp ecx, r8d
jne 0x180013cb0
cmp qword [rdi + 0x40], rsi
jne 0x180013ca7
lea rdx, str.____Abort:_selected_provider_does_not_support_changing_DSE_values_or_r_n_tKDU_interface_is_not_implemented_for_this_method._r_n
jmp 0x180013c9c
mov rax, qword [rdi]
test dword [rax + 0x18], 0x100
je 0x180013c89
cmp qword [rdi + 0x68], rsi
je 0x180013c95
cmp qword [rdi + 0x70], rsi
jne 0x180013ca7
jmp 0x180013c95
cmp qword [rdi + 0x48], rsi
je 0x180013c95
cmp qword [rdi + 0x50], rsi
jne 0x180013cb0
lea rdx, str.____Abort:_selected_provider_does_not_support_arbitrary_kernel_read_write_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r8d
call fcn.1800224a0
xor r8d, r8d
test r8d, r8d
je 0x180013a56
mov dl, 1
mov ecx, 0x14
call fcn.18001fa40
mov dl, 1
mov ecx, 0xa
call fcn.18001fa40
test dword [rbx + 0x18], 0x800
je 0x180013cde
call fcn.180023750
test eax, eax
je 0x180013a56
mov ecx, 0x478
call fcn.180021290
mov rsi, rax
test rax, rax
jne 0x180013d11
lea rdx, str.____Abort:_could_not_allocate_provider_context_r_n
jmp 0x180013a4c
cmp qword [rdi + 0x38], rsi
jne 0x180013cb0
lea rdx, str.____Abort:_selected_provider_does_not_support_driver_mapping_or_r_n_tKDU_interface_is_not_implemented_for_these_methods._r_n
mov ecx, r8d
jmp 0x180013a51
mov qword [rax + 0x40], rdi
mov rax, qword [rdi + 0x78]
test rax, rax
je 0x180013d3d
mov rcx, rsi
call rax
test eax, eax
jne 0x180013d3d
mov rcx, rsi
call fcn.1800212b0
xor esi, esi
lea rdx, str.____Abort:_provider_prerequisites_are_not_meet_r_n
jmp 0x180013a4c
test byte [rbx + 0x18], 0x40
je 0x180013d47
xor eax, eax
jmp 0x180013d6f
mov rax, qword [rdi]
cmp dword [rax + 0x10], 2
jb 0x180013d57
mov dword [rax + 0x10], 1
mov rax, qword [rdi]
mov ecx, dword [rax + 0x10]
lea rax, [rcx + rcx*4]
shl rax, 4
lea rcx, str.PROCEXP152
add rax, rcx
mov qword [rsi + 0x48], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rdi, qword [rcx + 0x20]
mov rcx, qword [rbx + 0x28]
call fcn.18001f970
movzx ecx, word [rdi + 0x38]
add rax, rax
add rcx, 0x40
add rcx, rax
call fcn.180021290
mov qword [rsi + 0x30], rax
test rax, rax
je 0x180013e9d
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x10], rax
mov dword [rsi + 8], r12d
mov dword [rsi + 4], r13d
call fcn.1800210a0
mov qword [rsi + 0x18], rax
call fcn.180022580
mov qword [rsi + 0x38], rax
call fcn.180022c40
mov rcx, qword [rsi + 0x30]
mov dword [rsi + 0xc], eax
movzx edx, word [rdi + 0x38]
mov r8, qword [rdi + 0x40]
shr rdx, 1
mov r9, rdx
call fcn.18001f910
mov rcx, qword [rsi + 0x30]
lea rdx, [0x18002fd9c]
call fcn.18001f8c0
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rsi + 0x30]
call fcn.18001f8c0
mov rcx, qword [rsi + 0x30]
lea rdx, [0x18002fda0]
call fcn.18001f8c0
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 8]
test eax, eax
je 0x180013e94
mov rax, qword [rsi + 0x40]
mov dword [rsi + 0x50], 1
mov rax, qword [rax + 0x18]
test rax, rax
je 0x180013a56
test byte [rbx + 0x18], 0x40
mov rdx, rsi
jne 0x180013e4e
mov edx, dword [rbx + 8]
mov rcx, qword [rsi + 0x28]
call rax
test eax, eax
jne 0x180013a56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Cannot_register_provider_driver
call fcn.180023120
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x180013e7f
call qword [sym.imp.ntdll.dll_NtClose]
mov rax, qword [rsi + 0x40]
mov rcx, rsi
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x180013e9d
jmp 0x180013e98
mov rcx, qword [rsi + 0x30]
call fcn.1800212b0
mov rcx, rsi
call fcn.1800212b0
xor esi, esi
jmp 0x180013a56