Function at 0x14000b8f2
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov rax, qword [0x1400160c0]
xor rax, rbp
mov qword [rbp], rax
mov eax, dword [0x14001613c]
mov ebx, dword [0x140016138]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete byte [rbp - 5]
cmp ebx, 0xa
setl byte [rbp - 6]
mov qword [rbp - 0x58], rdx
mov rdi, rcx
mov eax, 0x50e7f91d
mov r14, qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xd54c49
jg 0x14000b99c
cmp eax, 0xcc725f7f
jg 0x14000b9fc
cmp eax, 0x9de6b456
jg 0x14000ba9e
cmp eax, 0x8d97daf2
jg 0x14000bbef
cmp eax, 0x89b7abce
jg 0x14000be23
cmp eax, 0x8793a59c
je 0x14000c160
cmp eax, 0x88c49a79
jne 0x14000b950
mov eax, 0x6cc0078e
jmp 0x14000b950
cmp eax, 0x51ccb3ca
jle 0x14000ba51
cmp eax, 0x5f52ad20
jg 0x14000bb19
cmp eax, 0x5b06b09f
jg 0x14000bc1d
cmp eax, 0x534c5fd3
jg 0x14000be47
cmp eax, 0x51ccb3cb
je 0x14000c17e
cmp eax, 0x52e8a2e4
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x89b7abcf
mov ecx, 0x9f135c58
jmp 0x14000c514
cmp eax, 0xe7228757
jg 0x14000bb5d
cmp eax, 0xdf92b44b
jg 0x14000bc4c
cmp eax, 0xd6600648
jg 0x14000be6a
cmp eax, 0xcc725f80
je 0x14000c19c
cmp eax, 0xcd933fe1
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf35a544f
mov ecx, 0xf5c392ec
jmp 0x14000c514
cmp eax, 0x2a5c6ebc
jg 0x14000bba7
cmp eax, 0x20a099a0
jg 0x14000bcdc
cmp eax, 0x152428a3
jg 0x14000bea6
cmp eax, 0xd54c4a
je 0x14000c1a6
cmp eax, 0x9ffd6d5
jne 0x14000b950
cmp byte [rbp - 8], 0
mov eax, 0xe93ff66f
mov ecx, 0x51ccb3cb
cmovne eax, ecx
jmp 0x14000b950
cmp eax, 0xa702fa21
jg 0x14000bd1b
cmp eax, 0x9f1cc221
jg 0x14000beda
cmp eax, 0x9de6b457
je 0x14000c1c4
cmp eax, 0x9f135c58
jne 0x14000b950
mov rax, qword [rbp - 0x18]
mov edx, dword [rax]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x6d6f646c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
add rsp, 0x20
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
setne byte [rbp - 8]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x89b7abcf
mov ecx, 0x9ffd6d5
jmp 0x14000c514
cmp eax, 0x7a87b5fe
jg 0x14000bd5e
cmp eax, 0x6cc0078d
jg 0x14000bf1d
cmp eax, 0x5f52ad21
je 0x14000c1e2
cmp eax, 0x65870191
jne 0x14000b950
cmp byte [rbp - 0xc], 0
mov eax, 0x20a099a1
mov ecx, 0x1b72715e
cmovne eax, ecx
xor esi, esi
jmp 0x14000b950
cmp eax, 0xf41cf63d
jg 0x14000bd90
cmp eax, 0xeab62747
jg 0x14000bf5b
cmp eax, 0xe7228758
je 0x14000c21b
cmp eax, 0xe93ff66f
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcc725f80
mov ecx, 0xd6600649
jmp 0x14000c514
cmp eax, 0x3763788b
jg 0x14000bddc
cmp eax, 0x32a71b40
jg 0x14000bf8f
cmp eax, 0x2a5c6ebd
je 0x14000c23d
cmp eax, 0x3180a16e
jne 0x14000b950
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, dword [rbp - 4]
mov eax, 0x3dda039f
jmp 0x14000b950
cmp eax, 0x94d1f1bf
jg 0x14000bfc3
cmp eax, 0x8d97daf3
je 0x14000c25b
cmp eax, 0x8fad8207
jne 0x14000b950
mov eax, dword [rbp - 0x34]
mov eax, 0x8d97daf3
jmp 0x14000b950
cmp eax, 0x5ea1d8c1
jg 0x14000bff7
cmp eax, 0x5b06b0a0
je 0x14000c283
cmp eax, 0x5d3318d1
jne 0x14000b950
mov eax, 0xbb780e9d
mov r13d, dword [rbp - 0x44]
jmp 0x14000b950
cmp eax, 0xe1997e91
jg 0x14000c01c
cmp eax, 0xdf92b44c
je 0x14000c299
cmp eax, 0xdfcf1a31
jne 0x14000b950
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x60]
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
mov r9, qword [rbp - 0x18]
sub rsp, 0x20
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call rbx
add rsp, 0x20
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp - 0x2c]
cmp eax, 0xc0000004
setne byte [rbp - 7]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe2eed3c0
mov ecx, 0x5b06b0a0
jmp 0x14000c514
cmp eax, 0x260cbe36
jg 0x14000c067
cmp eax, 0x20a099a1
je 0x14000c2b7
cmp eax, 0x25704ba2
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3180a16e
mov ecx, 0x3dda039f
jmp 0x14000c514
cmp eax, 0xbe8cd5cc
jg 0x14000c08c
cmp eax, 0xa702fa22
je 0x14000c2d8
cmp eax, 0xbb780e9d
jne 0x14000b950
mov dword [rbp - 4], r13d
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c29bdb7
mov ecx, 0xf4e4bf0c
jmp 0x14000c514
cmp eax, 0x7e66d10f
jg 0x14000c0c0
cmp eax, 0x7a87b5ff
je 0x14000c2e5
cmp eax, 0x7c29bdb7
jne 0x14000b950
mov rax, qword [rbp - 0x28]
mov eax, dword [rbp - 4]
mov eax, 0xf4e4bf0c
jmp 0x14000b950
cmp eax, 0xf5c392eb
jg 0x14000c117
cmp eax, 0xf41cf63e
je 0x14000c2f5
cmp eax, 0xf4e4bf0c
jne 0x14000b950
mov rax, qword [rbp - 0x28]
mov ecx, dword [rbp - 4]
cmp ecx, dword [rax]
setb byte [rbp - 0xa]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7c29bdb7
mov ecx, 0x7e66d110
jmp 0x14000c514
cmp eax, 0x4b144d51
jg 0x14000c137
cmp eax, 0x3763788c
je 0x14000c2ff
cmp eax, 0x3dda039f
jne 0x14000b950
mov eax, dword [rbp - 4]
inc eax
mov dword [rbp - 0x44], eax
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3180a16e
mov ecx, 0x5d3318d1
jmp 0x14000c514
cmp eax, 0x89b7abcf
je 0x14000c309
cmp eax, 0x8bd4a941
jne 0x14000b950
mov eax, 0xd83d5c2e
mov r15d, dword [rbp - 0x48]
jmp 0x14000b950
cmp eax, 0x534c5fd4
je 0x14000c32f
cmp eax, 0x57cc0855
jne 0x14000b950
mov eax, 0x20a099a1
mov esi, dword [rbp - 0x30]
jmp 0x14000b950
cmp eax, 0xd6600649
je 0x14000c38f
cmp eax, 0xd83d5c2e
jne 0x14000b950
mov dword [rbp - 0x4c], r15d
mov rax, qword [rbp - 0x60]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf41cf63e
mov ecx, 0xd54c4a
jmp 0x14000c514
cmp eax, 0x152428a4
je 0x14000c3ad
cmp eax, 0x1b72715e
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9de6b457
mov ecx, 0x260cbe37
jmp 0x14000c514
cmp eax, 0x9f1cc222
je 0x14000c3c3
cmp eax, 0xa425d0b1
jne 0x14000b950
mov rax, qword [rbp - 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
mov qword [rcx], rax
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, 0x7f26146a
jmp 0x14000b950
cmp eax, 0x6cc0078e
je 0x14000c3d9
cmp eax, 0x737c7f8c
jne 0x14000b950
mov rax, qword [rbp - 0x18]
mov r8d, dword [rax]
mov r9, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x20
mov ecx, 0xb
call rbx
add rsp, 0x20
mov eax, 0xeab62748
jmp 0x14000b950
cmp eax, 0xeab62748
je 0x14000c3f7
cmp eax, 0xf35a544f
jne 0x14000b950
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, 0xf5c392ec
jmp 0x14000b950
cmp eax, 0x32a71b41
je 0x14000c43e
cmp eax, 0x331f0870
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbe8cd5cd
mov ecx, 0x96f94c84
jmp 0x14000c514
cmp eax, 0x94d1f1c0
je 0x14000c45c
cmp eax, 0x96f94c84
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbe8cd5cd
mov ecx, 0xe1997e92
jmp 0x14000c514
cmp eax, 0x5ea1d8c2
je 0x14000c47a
cmp eax, 0x5f08ab4f
jne 0x14000b950
mov eax, 0x20a099a1
mov esi, 0xc0000225
jmp 0x14000b950
cmp eax, 0xe1997e92
je 0x14000c488
cmp eax, 0xe2eed3c0
jne 0x14000b950
mov eax, 0x10
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov r9, rsp
mov dword [r9], 0
sub rsp, 0x20
mov ecx, 0xb
xor edx, edx
xor r8d, r8d
call rbx
add rsp, 0x20
mov eax, 0xdfcf1a31
jmp 0x14000b950
cmp eax, 0x260cbe37
je 0x14000c498
cmp eax, 0x2a0a4be0
jne 0x14000b950
mov eax, 0x20a099a1
mov esi, 0xc000009a
jmp 0x14000b950
cmp eax, 0xbe8cd5cd
je 0x14000c4c7
cmp eax, 0xc7a5a73e
jne 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3763788c
mov ecx, 0x32a71b41
jmp 0x14000c514
cmp eax, 0x7e66d110
je 0x14000c4d1
cmp eax, 0x7f26146a
jne 0x14000b950
mov rax, qword [rbp - 0x40]
mov rax, qword [rax + 0x10]
mov rcx, qword [rbp - 0x58]
mov qword [rcx], rax
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa425d0b1
mov ecx, 0x7a87b5ff
jmp 0x14000c514
cmp eax, 0xf5c392ec
je 0x14000c4e7
cmp eax, 0xf6bb79a6
jne 0x14000b950
mov eax, 0x8793a59c
jmp 0x14000b950
cmp eax, 0x50e7f91d
jne 0x14000c526
mov cl, byte [rbp - 5]
cmp byte [rbp - 6], 0
mov eax, 0xe2eed3c0
mov edx, 0xdfcf1a31
cmovne eax, edx
test cl, cl
cmovne eax, edx
jmp 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf6bb79a6
mov ecx, 0x8bd4a941
jmp 0x14000c514
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x737c7f8c
mov ecx, 0xeab62748
jmp 0x14000c514
mov eax, 0xd6600649
jmp 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf41cf63e
mov ecx, 0x4b144d52
jmp 0x14000c514
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, 0x260cbe37
jmp 0x14000b950
mov rax, qword [rbp - 0x28]
mov ecx, dword [rbp - 4]
imul rcx, rcx, 0x128
lea rdx, [rax + rcx]
movzx eax, word [rax + rcx + 0x2e]
lea rcx, [rax + rdx]
add rcx, 0x30
sub rsp, 0x20
mov rdx, rdi
call sub.ntoskrnl.exe__stricmp
add rsp, 0x20
mov eax, 0x534c5fd4
jmp 0x14000b950
mov dword [rbp - 0x34], r12d
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8fad8207
mov ecx, 0x8d97daf3
jmp 0x14000c514
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa425d0b1
mov ecx, 0x7f26146a
jmp 0x14000c514
mov eax, dword [rbp - 0x34]
cmp eax, 2
sete byte [rbp - 0xc]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x8fad8207
mov ecx, 0x65870191
jmp 0x14000c514
cmp byte [rbp - 7], 0
mov eax, 0x52e8a2e4
mov ecx, 0xc7a5a73e
cmovne eax, ecx
jmp 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x88c49a79
mov ecx, 0x6cc0078e
jmp 0x14000c514
mov dword [rbp - 0x48], esi
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf6bb79a6
mov ecx, 0x8793a59c
jmp 0x14000c514
mov eax, 0xbb780e9d
xor r13d, r13d
jmp 0x14000b950
mov eax, 0xe7228758
mov r12d, 1
jmp 0x14000b950
mov eax, 0xd54c4a
jmp 0x14000b950
mov eax, 0x32a71b41
jmp 0x14000b950
mov rax, qword [rbp - 0x18]
mov edx, dword [rax]
sub rsp, 0x20
xor ecx, ecx
mov r8d, 0x6d6f646c
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
add rsp, 0x20
mov eax, 0x9f135c58
jmp 0x14000b950
mov rax, qword [rbp - 0x28]
mov ecx, dword [rbp - 4]
imul rcx, rcx, 0x128
add rax, rcx
add rax, 8
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x40]
movzx ecx, word [rcx + 0x26]
add rcx, rax
add rcx, 0x28
sub rsp, 0x20
mov rdx, rdi
call sub.ntoskrnl.exe__stricmp
add rsp, 0x20
test eax, eax
sete byte [rbp - 0xb]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f52ad21
mov ecx, 0x152428a4
jmp 0x14000c514
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcc725f80
mov ecx, 0x2a0a4be0
jmp 0x14000c514
cmp byte [rbp - 0xb], 0
mov eax, 0x25704ba2
mov ecx, 0x2a5c6ebd
cmovne eax, ecx
jmp 0x14000b950
cmp byte [rbp - 9], 0
mov eax, 0xcd933fe1
mov ecx, 0xdf92b44c
cmovne eax, ecx
jmp 0x14000b950
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x88c49a79
mov ecx, 0xa702fa22
jmp 0x14000c514
mov rax, qword [rbp - 0x18]
mov r8d, dword [rax]
mov r9, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
sub rsp, 0x20
mov ecx, 0xb
call rbx
add rsp, 0x20
mov dword [rbp - 0x30], eax
cmp dword [rbp - 0x30], 0
setns byte [rbp - 9]
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x737c7f8c
mov ecx, 0x9f1cc222
jmp 0x14000c514
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3763788c
mov ecx, 0x5ea1d8c2
jmp 0x14000c514
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f52ad21
mov ecx, 0x534c5fd4
jmp 0x14000c514
mov eax, 0xd83d5c2e
mov r15d, dword [rbp - 0x2c]
jmp 0x14000b950
mov eax, 0xe7228758
mov r12d, 2
jmp 0x14000b950
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9de6b457
mov ecx, 0x5f08ab4f
jmp 0x14000c514
mov eax, 0x96f94c84
jmp 0x14000b950
cmp byte [rbp - 0xa], 0
mov eax, 0x331f0870
mov ecx, 0x94d1f1c0
cmovne eax, ecx
jmp 0x14000b950
mov rcx, qword [rbp - 0x20]
sub rsp, 0x20
mov edx, 0x6d6f646c
call r14
add rsp, 0x20
mov eax, dword [0x14001613c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf35a544f
mov ecx, 0x57cc0855
cmove eax, ecx
cmp dword [0x140016138], 0xa
cmovl eax, ecx
jmp 0x14000b950
cmp eax, 0x4b144d52
jne 0x14000b950
mov esi, dword [rbp - 0x4c]
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.140013f90
add rsp, 0x20
mov eax, esi
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret