Function at 0x1400067a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
lea rcx, str.AsrGetSystemVolumeDevPath
lea ebp, [rbx + 1]
call fcn.140007418
mov dword [rsp + 0x58], ebx
mov esi, ebx
test r14, r14
je 0x14004915e
lea r9, [rsp + 0x58]
mov word [r14], bx
xor r8d, r8d
lea ecx, [rbx + 0x62]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
jns 0x140006801
cmp eax, 0xc0000023
jne 0x140049002
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
je 0x140049058
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140049094
movzx r9d, word [rsi]
mov edi, 0x104
mov r8, qword [rsi + 8]
mov edx, edi
shr r9, 1
mov rcx, r14
call fcn.140006720
test eax, eax
js 0x140049130
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
lea rcx, str.AsrGetSystemVolumeDevPath
call fcn.1400073f0
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
cmp eax, 0x80000005
je 0x140006801
cmp eax, 0xc0000004
je 0x140006801
mov ecx, eax
mov ebp, ebx
call fcn.1400e332c
mov ebx, eax
mov rcx, qword [0x14015a290]
lea rdx, [0x14015a290]
cmp rcx, rdx
je 0x140006859
test byte [rcx + 0x1c], 8
je 0x140006859
mov edx, 0x18
lea rax, str.ntStatus
mov r9d, edi
jmp 0x140049115
mov r9d, 0xe
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [0x14015a290]
lea rdx, [0x14015a290]
cmp rcx, rdx
je 0x140006859
test byte [rcx + 0x1c], 8
je 0x140006859
lea edx, [r9 + 0xb]
lea rax, str.pSysInfo
jmp 0x140049195
mov ecx, eax
mov ebp, ebx
call fcn.1400e332c
mov ebx, eax
mov rax, qword [0x14015a290]
lea rdx, [0x14015a290]
cmp rax, rdx
je 0x140006859
test byte [rax + 0x1c], 8
je 0x140006859
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r9d, eax
mov edx, 0x1a
lea rax, str.NtQuerySystemInformation__SystemSystemPartitionInformation__pSysInfo__cbRequiredSize__cbRequiredSize_
jmp 0x14004910e
movzx r9d, word [rsi]
mov rdx, rdi
mov r8, qword [rsi + 8]
mov rcx, r14
shr r9, 1
call fcn.140006720
mov r9d, eax
mov edx, 0x1b
lea rax, str.::StringCchCopyN__pwszVolume__cchVolume__pSysInfo__SystemPartition.Buffer___pSysInfo__SystemPartition.Length__sizeof_WCHAR___
mov rcx, qword [0x14015a290]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401304d8]
mov qword [rsp + 0x20], rax
call fcn.1400d5cb0
nop
jmp 0x140006859
mov ecx, eax
mov ebp, ebx
call fcn.1400e32f8
mov ebx, eax
mov rax, qword [0x14015a290]
lea rdx, [0x14015a290]
cmp rax, rdx
je 0x140006859
test byte [rax + 0x1c], 8
je 0x140006859
jmp 0x1400490e9
mov r9d, 0x57
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [0x14015a290]
lea rdx, [0x14015a290]
cmp rcx, rdx
je 0x140006859
test byte [rcx + 0x1c], 8
je 0x140006859
lea edx, [r9 - 0x41]
lea rax, str.pwszVolume
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401304d8]
mov qword [rsp + 0x20], rax
call fcn.1400d5cb0
nop
jmp 0x140006859