Function at 0x140009cf4
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7e8]
sub rsp, 0x8c0
mov rax, qword [0x140076ea0]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov qword [rsp + 0x60], rcx
lea rcx, [0x1400158f0]
mov dword [rsp + 0x40], 0x10000
call fcn.140011164
mov edx, dword [rsp + 0x40]
mov esi, 0x656e6864
mov r8d, esi
mov dword [rsp + 0x44], eax
xor ecx, ecx
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r13d, r13d
mov rbx, rax
test rax, rax
je 0x14000a05b
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015340
mov r8d, dword [rsp + 0x40]
lea r14d, [r13 + 0x10]
mov ecx, r14d
lea r9, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r15d, 0xc0000004
jmp 0x140009de9
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x40]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x14000a05b
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140015340
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r15d
je 0x140009d9e
test eax, eax
js 0x14000a060
mov eax, dword [0x14001a008]
mov ecx, 1
mov r12d, dword [rbx]
mov r8d, 0x6d7467
imul rdx, rax, 0x640
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
test rax, rax
jne 0x140009e29
mov eax, 0xc0000023
jmp 0x14000a060
mov eax, dword [0x14001a008]
xor edx, edx
imul r8, rax, 0x640
call fcn.140015340
mov r14d, 0xc0000001
mov esi, r13d
test r12, r12
je 0x14000a056
add rbx, 0xc
xorps xmm1, xmm1
movzx r15d, word [rbx + 2]
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x50], r13
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x48], r13d
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
cmp byte [rbx], dil
jne 0x14000a044
movzx r13d, word [rbx - 4]
lea r9, [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x68], r13
lea r8, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 0x30
mov qword [rbp - 0x80], rax
lea edx, [rax + 0x40]
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x78], rax
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
xor ecx, ecx
test eax, eax
js 0x14000a021
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], ecx
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x58]
mov edx, r15d
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
xor ecx, ecx
test eax, eax
js 0x14000a021
mov edx, 0x400
mov r8d, 0x656e6864
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14000a01d
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.140015340
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
xor eax, eax
cmp word [rdi], ax
jbe 0x14000a00f
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x400
call fcn.140015340
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x400
call fcn.140015340
mov rax, qword [rsp + 0x60]
or r8, 0xffffffffffffffff
xor ecx, ecx
inc r8
cmp word [rax + r8*2], cx
jne 0x140009f93
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe_wcsncpy
movzx r8d, word [rdi]
lea rcx, [rbp - 0x50]
mov rdx, qword [rdi + 8]
shr r8, 1
call sub.ntoskrnl.exe_wcsncpy
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe__wcslwr
lea rcx, [rbp - 0x50]
call sub.ntoskrnl.exe__wcslwr
lea rax, [rbp - 0x50]
lea r10, [rbp + 0x3b0]
sub r10, rax
movzx r8d, word [rax]
movzx r9d, word [rax + r10]
sub r8d, r9d
jne 0x140009ffa
add rax, 2
test r9d, r9d
jne 0x140009fe3
test r8d, r8d
jne 0x14000a00f
mov rdx, r15
mov rcx, r13
call fcn.14000f8b0
xor eax, eax
mov r14d, eax
mov edx, 0x656e6864
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
xor r13d, r13d
test rcx, rcx
je 0x14000a034
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000a044
call qword [sym.imp.ntoskrnl.exe_ZwClose]
inc esi
add rbx, 0x18
movsxd rcx, esi
cmp rcx, r12
jb 0x140009e53
mov eax, r14d
jmp 0x14000a060
mov eax, 0xc00000a0
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140014fb0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret