Function at 0x14015e789
Capabilities:
Get system information on windows

Disassembly:
call fcn.14016db51
call rax
mov qword [rsp + 0x50], rax
test r10w, r12w
test rax, rax
jmp 0x1402817c9
call rax
mov rax, rdi
xadd si, di
jmp 0x140281ba5
call rax
mov rbp, qword [rsp + 0x50]
cmp dx, r15w
stc
test eax, eax
jmp 0x140281802
je 0x140281bc2
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
rcr cl, cl
shrd ecx, eax, 0x80
lea ecx, [rdi + 0xb]
btr edx, r8d
mov rdx, rax
add r8d, r8d
mov qword [rsp + 0x20], rbp
cdqe
setbe al
mov rax, qword [sym.imp.ntoskrnl.exe_NtQuerySystemInformation]
jmp 0x14027b9bc
js 0x140281b77
lea r10, [0x140263c61]
bts rcx, rdx
mov r9, rdi
sub r10, rsi
btc eax, r13d
nop
bt ax, 0x6e
movzx r8d, byte [r9 + rsi]
setl ch
mov dh, cl
movsx cx, dh
lea rax, [r9 + rsi]
mov ecx, r9d
rol dh, cl
movzx rdx, ax
stc
movzx edx, byte [r10 + rax]
mov eax, 0x2afa2a84
clc
rol eax, cl
clc
stc
jmp 0x140281853
add al, r9b
jmp 0x14028185b
inc r9
xor dl, al
lea eax, [rdx - 0x41]
cmc
jmp 0x140281869
cmp al, 0x19
jmp 0x140281870
ja 0x140281879
add dl, 0x20
lea eax, [r8 - 0x41]
clc
cmp al, 0x19
jmp 0x140281885
ja 0x140281894
add r8b, 0x20
jmp 0x140281894
test dl, dl
je 0x1402818a5
cmp dl, r8b
je 0x140281823
cmp dl, 0x2e
jne 0x1402818bc
test r8b, r8b
jmp 0x1402818b6
je 0x1402818d8
cmp dl, r8b
jmp 0x1402818c4
jb 0x1402818e9
cmp dl, r8b
jmp 0x1402818d2
ja 0x1402818e9
mov r9, qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
jmp 0x1402818e4
jmp 0x1402819ce
lea r10, [0x14027aee6]
test r14w, dx
rol r8w, cl
mov r9, rdi
sbb edx, 0x2f6c353f
bts r8, r12
sub r10, rsi
bswap ecx
rcr ah, 0x7a
nop
movzx r8d, byte [r9 + rsi]
rcl al, 0xe6
movzx eax, di
mov rax, 0x73c73248
lea rax, [r9 + rsi]
mov ecx, r9d
bswap rdx
btc dx, 0xf8
movzx edx, byte [r10 + rax]
mov eax, 0x2afa2a84
rol eax, cl
test r15, r13
test sp, 0x7ac8
add al, r9b
jmp 0x14028194b
inc r9
xor dl, al
lea eax, [rdx - 0x41]
clc
cmc
cmp al, 0x19
jmp 0x14028195c
ja 0x140281968
add dl, 0x20
sub ax, sp
lea eax, [r8 - 0x41]
cmp al, 0x19
jmp 0x140281973
ja 0x14028197d
add r8b, 0x20
test dl, dl
je 0x14028198e
cmp dl, r8b
je 0x14028190e
cmp dl, 0x2e
jmp 0x140281996
jne 0x1402819aa
test r8b, r8b
jmp 0x1402819a4
je 0x1402819c6
cmp dl, r8b
jmp 0x1402819b2
jb 0x140281a61
cmp dl, r8b
jmp 0x1402819c0
ja 0x140281a61
mov r9, qword [sym.imp.HAL.dll_KeQueryPerformanceCounter]
clc
test r9, r9
je 0x140281a61
mov r10d, dword [rbp]
bt rdx, 0x97
rol dh, 0xf2
mov rdx, rdi
test cl, 0x2f
stc
cmc
test r10, r10
jmp 0x1402819f3
je 0x140281b77
lea rcx, [rbp + 0x18]
rol r8b, cl
adc r8d, ebx
clc
mov r8, qword [rcx]
cmp r8, r9
jmp 0x140281a0f
jae 0x140281a2f
mov eax, dword [rcx + 8]
test bh, 0xcd
cmp r11b, 0xe1
lea rax, [rax + r8]
cmp al, sil
cmp rax, r9
ja 0x140281a59
inc rdx
jmp 0x140281a37
add rcx, 0x128
stc
cmp r14b, 0x59
cmp r10d, r13d
cmp rdx, r10
jmp 0x140281a4e
jb 0x140281a04
jmp 0x140281b77
mov rdi, r8
jmp 0x140281b77
mov qword [rsp + 0x40], rbx
rol rbx, 0xd2
mov ebx, dword [rbp]
mov r11, rdi
stc
test rbx, 0x6b62752f
test rbx, rbx
jmp 0x140281a80
je 0x140281b71
lea r9, [rbp + 8]
movzx eax, word [r9 + 0x26]
add dl, bpl
movsx r10, di
or edx, 0x56451e1b
mov r8, rsi
sar cl, cl
sub rax, rsi
movsx r10d, cx
lea r10, [rax + r9 + 0x28]
movzx ax, r14b
movsxd rcx, edi
not eax
movzx ecx, byte [r10 + r8]
xchg al, al
bswap edx
cwde
movzx edx, byte [r8]
movzx rax, ax
inc r8
shr al, 0xf2
sub eax, 0xd603992
lea eax, [rcx - 0x41]
cmp bpl, 0xde
stc
test r15b, 0x54
cmp al, 0x19
jmp 0x140281ae7
ja 0x140281af8
add cl, 0x20
sar al, cl
add al, 0xee
test r11b, 0xbb
lea eax, [rdx - 0x41]
clc
cmp al, 0x19
jmp 0x140281b03
ja 0x140281b0c
add dl, 0x20
test cl, cl
jmp 0x140281b13
je 0x140281b21
cmp cl, dl
je 0x140281ab7
cmp cl, 0x2e
jne 0x140281b37
test dl, dl
jmp 0x140281b31
je 0x140281b6d
cmp cl, dl
jmp 0x140281b3e
jb 0x140281b4c
cmp cl, dl
jbe 0x140281b6d
inc r11
test dil, dl
add r9, 0x128
clc
cmp r11, rbx
jmp 0x140281b62
jb 0x140281a8a
jmp 0x140281b71
mov rdi, qword [r9 + 0x10]
mov rbx, qword [rsp + 0x40]
stc
test rbp, rbp
jmp 0x140281b7f
je 0x14026c7a4
xor edx, edx
cbw
movzx rax, si
movzx ax, r13b
mov rcx, rbp
xchg ah, al
cbw
mov rax, qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14026c7a2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
movzx rsi, di
movzx di, al
pop rdi
seta sil
pop rsi
jmp 0x140281bc1
ret
mov rax, rdi
add sil, r10b
add rsp, 0x28
movzx rsi, r9w
pop rdi
movsx rsi, cx
movzx si, spl
movzx rsi, ax
pop rsi
ret