Function at 0x1b340
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
and dword [rax + 8], 0
mov r15d, 0x410
mov ebx, 1
mov rdx, r15
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov r12, rax
test rax, rax
jne 0x1b37f
mov eax, 0xc000009a
jmp 0x1b617
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov esi, 0x208
mov ecx, ebx
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x1b375
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.000407c0
lea rdx, [0x000412d0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x00041310]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor r8d, r8d
lea r9, [rsp + 0xc0]
lea ebx, [r8 + 0xb]
lea rdx, [rsp + 0xc0]
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov edx, dword [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
mov qword [rsp + 0xd8], rax
test rax, rax
jne 0x1b41c
mov ebx, 0xc000009a
jmp 0x1b5ff
mov r8d, dword [rsp + 0xc0]
xor edx, edx
mov rcx, rax
call fcn.000407c0
mov r8d, dword [rsp + 0xc0]
xor r9d, r9d
mov rdx, rsi
mov ecx, ebx
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ebx, eax
mov dword [rsp + 0xc8], eax
test eax, eax
js 0x1b5f4
mov eax, dword [rsi]
xor r13d, r13d
lea r14, [rsi + 8]
mov dword [rsp + 0xc0], eax
test eax, eax
je 0x1b5f4
xor ebx, ebx
lea rbp, [r14 + 0x10]
lea esi, [rbx + 1]
xor eax, eax
mov ecx, r13d
mov word [rsp + 0x22], r15w
mov qword [r12], rax
mov qword [rdi], rax
mov eax, r13d
imul rcx, rcx, 0x128
mov rdx, rdi
lea r15, [rcx + r14 + 0x28]
mov qword [rsp + 0xd0], rcx
imul rax, rax, 0x128
sub rdx, rax
mov word [rsp + 0x20], bx
mov qword [rsp + 0x28], r12
sub rdx, r14
mov rcx, r15
mov al, byte [rcx]
mov byte [rdx + rcx - 0x28], al
add rcx, rsi
cmp al, bl
jne 0x1b4bb
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe__strlwr]
mov r11, qword [0x000620f8]
cmp r11, rbx
je 0x1b4f0
mov eax, dword [0x00062b9c]
cmp r11, qword [rbp]
cmove eax, esi
mov dword [0x00062b9c], eax
lea rdx, [0x000412c0]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_strstr]
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
cmp rax, rbx
jne 0x1b514
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rdx, [0x00041340]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, rbx
jne 0x1b58a
lea rdx, [0x00041350]
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_strstr]
cmp rax, rbx
jne 0x1b58a
movzx eax, word [rbp + 0x16]
lea rcx, [rsp + 0x40]
add rax, qword [rsp + 0xd0]
lea rdx, [rax + r14 + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8b, sil
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea r8, [rsp + 0x20]
jmp 0x1b5b0
lea rcx, [rsp + 0x40]
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov r8b, sil
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea r8, [rsp + 0x30]
mov edx, dword [rbp + 8]
mov rcx, qword [rbp]
call fcn.0001ae78
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
add r13d, esi
add rbp, 0x128
mov r15d, 0x410
cmp r13d, dword [rsp + 0xc0]
jb 0x1b475
mov ebx, dword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd8]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret