Function at 0x140020b45
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140057c80
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140097d3f]
call fcn.140021040
mov dword [rbp + 0x44], 0
mov edx, 4
lea rcx, [rbp + 0x24]
call fcn.140020b7c
lea r9, [rbp + 0x44]
mov r8d, 4
lea rdx, [rbp + 0x24]
mov ecx, 0xc4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
jl 0x140057dc8
lea rcx, str._t___SystemKernelVaShadowInformation_r_n
call fcn.140020f41
mov eax, dword [rbp + 0x24]
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowEnabled
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 1
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowUserGlobal
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 2
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowPcid
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 3
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowInvpcid
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 4
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowRequired
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 5
and eax, 1
movzx edx, al
lea rcx, str.KvaShadowRequiredAvailable
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 6
and eax, 0x3f
mov edx, eax
lea rcx, str._tInvalidPteBit__lu_r_n
call fcn.140020f41
mov eax, dword [rbp + 0x24]
shr eax, 0xc
and eax, 1
movzx edx, al
lea rcx, str.L1DataCacheFlushSupported
call fcn.140020398
mov eax, dword [rbp + 0x24]
shr eax, 0xd
and eax, 1
movzx edx, al
lea rcx, str.L1TerminalFaultMitigationPresent
call fcn.140020398
jmp 0x140057dd7
mov edx, dword [rbp + 0x64]
lea rcx, str.Cannot_query_Kernel_VA_Shadow_information
call fcn.140020249
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140020b7c
mov dword [rbp + 0x44], 8
lea r9, [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
lea rdx, [rbp + 8]
mov ecx, 0xc9
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0xc0000002
je 0x140057e18
cmp dword [rbp + 0x64], 0xc0000003
jne 0x140057e2c
mov edx, dword [rbp + 0x64]
lea rcx, str.Speculation_control_information_class_not_present
call fcn.140020249
jmp 0x1400581d1
cmp dword [rbp + 0x64], 0
je 0x140057e46
mov edx, dword [rbp + 0x64]
lea rcx, str.Cannot_query_speculation_control_information
call fcn.140020249
jmp 0x1400581d1
mov eax, dword [rbp + 0x44]
cmp rax, 8
je 0x140057e6d
mov eax, dword [rbp + 0x44]
cmp rax, 4
je 0x140057e6d
mov r8d, dword [rbp + 0x44]
lea rdx, str.Unknown_speculation_control_information_size__lu_r_n
mov ecx, 1
call fcn.1400204b0
lea rcx, str._t___SystemSpeculationControlInformation_r_n
call fcn.140020f41
mov eax, dword [rbp + 8]
and eax, 1
movzx edx, al
lea rcx, str.BpbEnabled
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 1
and eax, 1
movzx edx, al
lea rcx, str.BpbDisabledSystemPolicy
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 2
and eax, 1
movzx edx, al
lea rcx, str.BpbDisabledNoHardwareSupport
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 3
and eax, 1
movzx edx, al
lea rcx, str.SpecCtrlEnumerated
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 4
and eax, 1
movzx edx, al
lea rcx, str.SpecCmdEnumerated
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 5
and eax, 1
movzx edx, al
lea rcx, str.IbrsPresent
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 6
and eax, 1
movzx edx, al
lea rcx, str.StibpPresent
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 7
and eax, 1
movzx edx, al
lea rcx, str.SmepPresent
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 8
and eax, 1
movzx edx, al
lea rcx, str.SpeculativeStoreBypassDisableAvailable
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 9
and eax, 1
movzx edx, al
lea rcx, str.SpeculativeStoreBypassDisableSupported
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xa
and eax, 1
movzx edx, al
lea rcx, str.SpeculativeStoreBypassDisabledSystemWide
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xb
and eax, 1
movzx edx, al
lea rcx, str.SpeculativeStoreBypassDisabledKernel
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xc
and eax, 1
movzx edx, al
lea rcx, str.SpeculativeStoreBypassDisableRequired
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xd
and eax, 1
movzx edx, al
lea rcx, str.BpbDisabledKernelToUser
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xe
and eax, 1
movzx edx, al
lea rcx, str.SpecCtrlRetpolineEnabled
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0xf
and eax, 1
movzx edx, al
lea rcx, str.SpecCtrlImportOptimizationEnabled
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x10
and eax, 1
movzx edx, al
lea rcx, str.EnhancedIbrs
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x11
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfStatusAvailable
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x12
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfProcessorNotAffected
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x13
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfMigitationEnabled
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x14
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfMigitationNotEnabled_Hardware
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x15
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfMigitationNotEnabled_LoadOption
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x16
and eax, 1
movzx edx, al
lea rcx, str.HvL1tfMigitationNotEnabled_CoreScheduler
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x17
and eax, 1
movzx edx, al
lea rcx, str.EnhancedIbrsReported
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x18
and eax, 1
movzx edx, al
lea rcx, str.MdsHardwareProtected
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x19
and eax, 1
movzx edx, al
lea rcx, str.MbClearEnabled
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x1a
and eax, 1
movzx edx, al
lea rcx, str.MbClearReported
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x1b
and eax, 3
mov edx, eax
lea rcx, str._t_tTsxCtrlStatus__lu_r_n
call fcn.140020f41
mov eax, dword [rbp + 8]
shr eax, 0x1d
and eax, 1
movzx edx, al
lea rcx, str.TsxCtrlReported
call fcn.140020398
mov eax, dword [rbp + 8]
shr eax, 0x1e
and eax, 1
movzx edx, al
lea rcx, str.TaaHardwareImmune
call fcn.140020398
mov eax, dword [rbp + 0x44]
cmp rax, 8
jne 0x1400581d1
lea rcx, str._t___SystemSpeculationControlInformation_v2_r_n
call fcn.140020f41
mov eax, dword [rbp + 0xc]
and eax, 1
movzx edx, al
lea rcx, str.SbdrSsdpHardwareProtected
call fcn.140020398
mov eax, dword [rbp + 0xc]
shr eax, 1
and eax, 1
movzx edx, al
lea rcx, str.FbsdpHardwareProtected
call fcn.140020398
mov eax, dword [rbp + 0xc]
shr eax, 2
and eax, 1
movzx edx, al
lea rcx, str.PsdpHardwareProtected
call fcn.140020398
mov eax, dword [rbp + 0xc]
shr eax, 3
and eax, 1
movzx edx, al
lea rcx, str.FbClearEnabled
call fcn.140020398
mov eax, dword [rbp + 0xc]
shr eax, 4
and eax, 1
movzx edx, al
lea rcx, str.FbClearReported
call fcn.140020398
lea rcx, [rbp - 0x20]
lea rdx, [0x14007e450]
call fcn.140020d66
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret