Function at 0x1400d7860
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
lea rcx, str.AsrGetSystemVolumeDevPath
lea ebp, [rbx + 1]
call fcn.140008368
mov dword [rsp + 0x58], ebx
mov esi, ebx
test r14, r14
je 0x1400d7a50
lea r9, [rsp + 0x58]
mov word [r14], bx
xor r8d, r8d
lea ecx, [rbx + 0x62]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
jns 0x1400d791e
cmp eax, 0xc0000023
je 0x1400d791e
cmp eax, 0x80000005
je 0x1400d791e
cmp eax, 0xc0000004
je 0x1400d791e
mov ecx, eax
mov ebp, ebx
call fcn.1400de218
mov ebx, eax
mov rcx, qword [0x140154180]
lea rdx, [0x140154180]
cmp rcx, rdx
je 0x1400d7a94
test byte [rcx + 0x1c], 8
je 0x1400d7a94
lea edx, [rsi + 0x18]
mov r9d, edi
lea rax, str.ntStatus
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ef890]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
jmp 0x1400d7a94
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
jne 0x1400d7969
lea r9d, [rax + 0xe]
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rdx, [0x140154180]
cmp rcx, rdx
je 0x1400d7a94
test byte [rcx + 0x1c], 8
je 0x1400d7a94
lea edx, [rax + 0x19]
lea rax, str.pSysInfo
jmp 0x1400d7a7f
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rax
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400d79e4
mov ecx, eax
mov ebp, ebx
call fcn.1400de218
mov ebx, eax
mov rax, qword [0x140154180]
lea rdx, [0x140154180]
cmp rax, rdx
je 0x1400d7a94
test byte [rax + 0x1c], 8
je 0x1400d7a94
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r9d, eax
mov edx, 0x1a
lea rax, str.NtQuerySystemInformation__SystemSystemPartitionInformation__pSysInfo__cbRequiredSize__cbRequiredSize_
mov rcx, qword [0x140154180]
jmp 0x1400d7904
movzx r9d, word [rsi]
mov edi, 0x104
mov r8, qword [rsi + 8]
mov edx, edi
shr r9, 1
mov rcx, r14
call fcn.14004b548
test eax, eax
jns 0x1400d7a94
mov ecx, eax
mov ebp, ebx
call fcn.1400de1e4
mov ebx, eax
mov rax, qword [0x140154180]
lea rdx, [0x140154180]
cmp rax, rdx
je 0x1400d7a94
test byte [rax + 0x1c], 8
je 0x1400d7a94
movzx r9d, word [rsi]
mov edx, edi
mov r8, qword [rsi + 8]
mov rcx, r14
shr r9, 1
call fcn.14004b548
mov r9d, eax
mov edx, 0x1b
lea rax, str.::StringCchCopyN__pwszVolume__cchVolume__pSysInfo__SystemPartition.Buffer___pSysInfo__SystemPartition.Length__sizeof_WCHAR___
jmp 0x1400d79d8
mov r9d, 0x57
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [0x140154180]
lea rdx, [0x140154180]
cmp rcx, rdx
je 0x1400d7a94
test byte [rcx + 0x1c], 8
je 0x1400d7a94
lea edx, [r9 - 0x41]
lea rax, str.pwszVolume
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ef890]
mov qword [rsp + 0x20], rax
call fcn.1400cc0d8
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
lea rcx, str.AsrGetSystemVolumeDevPath
call fcn.1400084a8
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret