Function at 0x140091874
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14016a508]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov rcx, qword [0x14016a048]
lea rbp, [0x14016a048]
cmp rcx, rbp
je 0x1400918d7
test dword [rcx + 0x1c], 0x200
je 0x1400918d7
cmp byte [rcx + 0x19], 4
jb 0x1400918d7
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e9e8]
mov edx, 0xf
call fcn.14000c0e8
and dword [rsp + 0x20], 0
test rsi, rsi
jne 0x1400918f9
lea r8, str.pwszSystemDevicePath
mov edx, 0xbf
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140088f60
and qword [rsi], 0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
xor edx, edx
lea r9, [rsp + 0x20]
xor r8d, r8d
lea ecx, [rdx + 0x62]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov ebx, 0xc0000023
test eax, eax
jns 0x14009198d
cmp eax, ebx
je 0x14009198d
cmp eax, 0x80000005
je 0x14009198d
cmp eax, 0xc0000004
je 0x14009198d
mov ecx, eax
call fcn.14002a600
mov ebx, eax
mov rcx, qword [0x14016a048]
cmp rcx, rbp
je 0x140091adf
test byte [rcx + 0x1c], 8
je 0x140091ab6
cmp byte [rcx + 0x19], 2
jb 0x140091ab6
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e9e8]
mov edx, 0x10
mov r9d, eax
call fcn.14000c114
jmp 0x140091aaf
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x1400919af
mov ebx, 0x8007000e
jmp 0x140091aaf
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, rdi
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rdi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x140091a27
mov ecx, eax
call fcn.14002a600
mov ebx, eax
mov rcx, qword [0x14016a048]
cmp rcx, rbp
je 0x140091aa0
test byte [rcx + 0x1c], 8
je 0x140091aa0
cmp byte [rcx + 0x19], 2
jb 0x140091aa0
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e9e8]
mov edx, 0x11
mov r9d, eax
call fcn.14000c114
jmp 0x140091aa0
movzx edx, word [rdi]
lea rax, [rdx + 2]
cmp rax, 0x208
jbe 0x140091a3f
mov ecx, ebx
call fcn.14002a600
jmp 0x140091a9e
test dl, 1
je 0x140091a5c
lea r8, str.pSysInfo__SystemPartition.Length___sizeof_WCHAR___0
mov edx, 0xf0
lea rcx, str.base_stor_blbutil_systemutils.cpp
call fcn.140088f60
movzx ecx, word [rdi]
lea eax, [rcx + 8]
cmp eax, dword [rsp + 0x20]
jbe 0x140091a6f
mov ebx, 0x8000ffff
jmp 0x140091aa0
mov r8, qword [rdi + 8]
mov r9, rcx
shr r9, 1
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.140089a78
mov ebx, eax
test eax, eax
js 0x140091aa0
xor r8d, r8d
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14008a470
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [0x14016a048]
cmp rcx, rbp
je 0x140091adf
test dword [rcx + 0x1c], 0x200
je 0x140091adf
cmp byte [rcx + 0x19], 4
jb 0x140091adf
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014e9e8]
mov edx, 0x12
call fcn.14000c0e8
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400071e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret