Function at 0x1400299dc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
lea rcx, str.AsrGetSystemVolumeDevPath
lea ebp, [rbx + 1]
call fcn.140029428
mov dword [rsp + 0x58], ebx
mov esi, ebx
test r14, r14
je 0x140058483
lea r9, [rsp + 0x58]
mov word [r14], bx
xor r8d, r8d
lea ecx, [rbx + 0x62]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
jns 0x140029a3d
cmp eax, 0xc0000023
jne 0x140058322
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
je 0x1400583c0
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400583fc
movzx r9d, word [rsi]
mov edi, 0x104
mov r8, qword [rsi + 8]
mov edx, edi
shr r9, 1
mov rcx, r14
call fcn.140029060
test eax, eax
js 0x14005842d
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea rcx, str.AsrGetSystemVolumeDevPath
call fcn.140027f60
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
cmp edi, 0x80000005
je 0x140029a3d
cmp edi, 0xc0000004
je 0x140029a3d
mov ecx, edi
mov ebp, ebx
call fcn.1400f2b4c
mov ebx, eax
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x140029a95
test byte [rcx + 0x1c], 8
je 0x140029a95
mov edx, 0x18
lea rax, str.ntStatus
mov r9d, edi
jmp 0x1400583a5
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r9d, eax
mov edx, 0x1a
lea rax, str.NtQuerySystemInformation__SystemSystemPartitionInformation__pSysInfo__cbRequiredSize__cbRequiredSize_
mov rcx, qword [section..data]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401053e0]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
nop
jmp 0x140029a95
mov r9d, 0xe
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x140029a95
test byte [rcx + 0x1c], 8
je 0x140029a95
lea edx, [r9 + 0xb]
lea rax, str.pSysInfo
jmp 0x1400584ba
mov ecx, eax
mov ebp, ebx
call fcn.1400f2b4c
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x140029a95
test byte [rax + 0x1c], 8
je 0x140029a95
jmp 0x140058377
mov ecx, eax
mov ebp, ebx
call fcn.1400f2b1c
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x140029a95
test byte [rax + 0x1c], 8
je 0x140029a95
movzx r9d, word [rsi]
mov rdx, rdi
mov r8, qword [rsi + 8]
mov rcx, r14
shr r9, 1
call fcn.140029060
mov r9d, eax
mov edx, 0x1b
lea rax, str.::StringCchCopyN__pwszVolume__cchVolume__pSysInfo__SystemPartition.Buffer___pSysInfo__SystemPartition.Length__sizeof_WCHAR___
jmp 0x14005839e
mov r9d, 0x57
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x140029a95
test byte [rcx + 0x1c], 8
je 0x140029a95
lea edx, [r9 - 0x41]
lea rax, str.pwszVolume
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401053e0]
mov qword [rsp + 0x20], rax
call fcn.1400e4514
nop
jmp 0x140029a95