Function at 0x140009e24
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7e8]
sub rsp, 0x8c0
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov qword [rsp + 0x60], rcx
lea rcx, [0x1400158b0]
mov dword [rsp + 0x40], 0x10000
call fcn.140011294
mov edx, dword [rsp + 0x40]
mov esi, 0x656e6864
mov r8d, esi
mov dword [rsp + 0x44], eax
xor ecx, ecx
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r13d, r13d
mov rbx, rax
test rax, rax
je 0x14000a18b
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015300
mov r8d, dword [rsp + 0x40]
lea r14d, [r13 + 0x10]
mov ecx, r14d
lea r9, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r15d, 0xc0000004
jmp 0x140009f19
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x40]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a18b
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015300
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r15d
je 0x140009ece
test eax, eax
js 0x14000a190
mov eax, dword [0x14001a008]
mov ecx, 1
mov r12d, dword [rbx]
mov r8d, 0x6d7467
imul rdx, rax, 0x640
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
test rax, rax
jne 0x140009f59
mov eax, 0xc0000023
jmp 0x14000a190
mov eax, dword [0x14001a008]
xor edx, edx
imul r8, rax, 0x640
call fcn.140015300
mov r14d, 0xc0000001
mov esi, r13d
test r12, r12
je 0x14000a186
add rbx, 0xc
xorps xmm1, xmm1
movzx r15d, word [rbx + 2]
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x50], r13
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x48], r13d
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
cmp byte [rbx], dil
jne 0x14000a174
movzx r13d, word [rbx - 4]
lea r9, [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x68], r13
lea r8, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 0x30
mov qword [rbp - 0x80], rax
lea edx, [rax + 0x40]
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x78], rax
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
xor ecx, ecx
test eax, eax
js 0x14000a151
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], ecx
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x58]
mov edx, r15d
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
xor ecx, ecx
test eax, eax
js 0x14000a151
mov edx, 0x400
mov r8d, 0x656e6864
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000a14d
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.140015300
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
xor eax, eax
cmp word [rdi], ax
jbe 0x14000a13f
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x400
call fcn.140015300
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x400
call fcn.140015300
mov rax, qword [rsp + 0x60]
or r8, 0xffffffffffffffff
xor ecx, ecx
inc r8
cmp word [rax + r8*2], cx
jne 0x14000a0c3
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe_wcsncpy
movzx r8d, word [rdi]
lea rcx, [rbp - 0x50]
mov rdx, qword [rdi + 8]
shr r8, 1
call sub.ntoskrnl.exe_wcsncpy
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe__wcslwr
lea rcx, [rbp - 0x50]
call sub.ntoskrnl.exe__wcslwr
lea rax, [rbp - 0x50]
lea r10, [rbp + 0x3b0]
sub r10, rax
movzx r8d, word [rax]
movzx r9d, word [rax + r10]
sub r8d, r9d
jne 0x14000a12a
add rax, 2
test r9d, r9d
jne 0x14000a113
test r8d, r8d
jne 0x14000a13f
mov rdx, r15
mov rcx, r13
call fcn.14000f940
xor eax, eax
mov r14d, eax
mov edx, 0x656e6864
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
xor r13d, r13d
test rcx, rcx
je 0x14000a164
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000a174
call qword [sym.imp.ntoskrnl.exe_ZwClose]
inc esi
add rbx, 0x18
movsxd rcx, esi
cmp rcx, r12
jb 0x140009f83
mov eax, r14d
jmp 0x14000a190
mov eax, 0xc00000a0
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140014f80
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret