Function at 0x14005d87c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xb0
xor ebx, ebx
mov r13, r9
mov qword [rbp - 0x51], rbx
mov r12, rdx
mov qword [rbp - 0x61], rbx
mov r15d, ebx
mov qword [rbp - 0x59], rbx
mov r14d, ebx
mov qword [rbp - 0x69], rbx
test rdx, rdx
jne 0x14005d8da
mov ebx, 0x80070057
mov esi, ebx
mov ecx, ebx
call fcn.140078308
mov r12d, r14d
jmp 0x14005dc73
test r8d, r8d
jne 0x14005d8fb
mov ebx, 0x80070057
lea rdx, [0x14041c1ac]
lea rcx, [0x1403fdb80]
mov esi, ebx
call fcn.1400e775c
jmp 0x14005d8cb
test r13, r13
je 0x14005d8c4
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14005d8c4
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14005d8c4
lea rdx, [0x14001b7e0]
mov dword [rbp - 0x11], r8d
mov qword [rbp - 0x21], rdx
xor r9d, r9d
lea rdx, [rbp + 0x5f]
mov qword [rbp + 7], rcx
mov qword [rbp - 0x19], rdx
mov ecx, 0xb9
lea rdx, [rbp - 0x29]
mov qword [rbp - 0x29], 3
lea r8d, [r9 + 0x38]
mov qword [rbp - 9], r13
mov dword [rbp - 1], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x5f]
cmp esi, 0x8007000d
jne 0x14005d961
mov esi, 0xc004f307
jmp 0x14005d965
test esi, esi
jns 0x14005d974
mov ecx, esi
call fcn.140078308
mov r12d, ebx
jmp 0x14005dc73
mov rsi, qword [0x140421b10]
lea rcx, [0x140421ad0]
call fcn.140052798
mov rbx, rax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403a2250]
lea rax, [rbp - 0x59]
mov rdx, rbx
lea r9, [0x1403a9438]
mov qword [rsp + 0x20], rax
lea r8, str.msft:rm_algorithm_volume_1.0
mov rcx, rsi
call rdi
mov esi, eax
test eax, eax
jns 0x14005d9c6
mov ecx, eax
jmp 0x14005d8cd
mov rdi, qword [0x140421b10]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [0x1403a2250]
lea rax, [rbp - 0x69]
xor r9d, r9d
lea r8, [0x1403a9d58]
mov qword [rsp + 0x20], rax
lea rdx, str.msft:spp_stockobjects_plugins_params_named
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005d9bf
lea rdx, [rbp - 0x61]
mov rcx, r12
call fcn.140051ce4
mov esi, eax
test eax, eax
jns 0x14005da1b
mov ecx, eax
jmp 0x14005dc67
mov rax, qword [0x140421ad0]
test rax, rax
je 0x14005dc60
lea r15, [rax + 8]
test r15, r15
je 0x14005da44
mov rcx, r15
call fcn.14006e234
mov r12d, 1
jmp 0x14005da47
mov r12d, r14d
mov r14, qword [rbp - 0x61]
lea r9, [rbp - 0x51]
mov rdx, r14
lea r8, [0x1403a9518]
call fcn.1400ce390
mov esi, eax
test eax, eax
jns 0x14005da70
mov ecx, eax
call fcn.140078308
jmp 0x14005dc73
lea r8, [rbp + 0x57]
mov rcx, r14
lea rdx, str.Volume:GVLK
call fcn.1400e467c
test eax, eax
jns 0x14005da90
mov ecx, 0xc004f306
mov esi, ecx
jmp 0x14005da66
cmp dword [rbp + 0x57], 0
jne 0x14005dac8
lea r8, [rbp + 0x57]
mov rcx, r14
lea rdx, str.Volume:CSVLK
call fcn.1400e467c
lea rdx, [0x140420160]
mov ebx, eax
lea rcx, [0x1404015f8]
call fcn.1400e7410
test ebx, ebx
js 0x14005da87
cmp dword [rbp + 0x57], 0
je 0x14005da87
mov rbx, qword [rbp - 0x51]
lea rax, str.SppBindingAppId
lea rdx, [0x14041d968]
mov qword [rbp - 0x49], rax
lea rcx, [0x1403f6b5c]
mov dword [rbp - 0x41], 2
call fcn.1400e6078
mov qword [rbp - 0x39], rbx
mov rbx, qword [rbp - 0x69]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
mov r8d, 1
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005da64
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingSkuId
mov qword [rbp - 0x49], rax
mov dword [rbp - 0x41], 2
mov qword [rbp - 0x39], r14
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
mov r8d, 1
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
jns 0x14005db7b
lea rdx, [0x14041d3b0]
lea rcx, [0x140402718]
call fcn.1400e7de0
mov ecx, esi
jmp 0x14005da66
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationType
mov qword [rbp - 0x49], rax
lea rax, str.Token
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x41], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
mov r8d, 1
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005da64
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationResponse
mov qword [rbp - 0x49], rax
mov eax, dword [rbp + 0x67]
mov dword [rbp - 0x31], eax
mov rax, qword [rbx]
mov dword [rbp - 0x41], 4
mov qword [rbp - 0x39], r13
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403a2250]
mov r8d, 1
lea rdx, [rbp - 0x49]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005da64
mov rdi, qword [0x140421b60]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [0x1403a2250]
mov rdx, qword [rbp - 0x51]
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005da64
mov rbx, qword [rbp - 0x59]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403a2250]
mov rdx, qword [rbp - 0x69]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
jns 0x14005dc73
jmp 0x14005da64
mov esi, 0x8000ffff
mov ecx, esi
call fcn.140078308
mov r14, qword [rbp - 0x61]
mov r12d, r15d
mov ecx, esi
call fcn.140078324
mov rbx, qword [rbp - 0x69]
test rbx, rbx
je 0x14005dc9d
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
and qword [rbp - 0x69], 0
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x14005dcc0
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
and qword [rbp - 0x59], 0
test r14, r14
je 0x14005dcce
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14005dcdd
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r15, r15
je 0x14005dd02
lea rdx, [0x14041bb84]
lea rcx, [0x14040d0c8]
call fcn.1400e7a9c
test r12d, r12d
je 0x14005dd02
mov rcx, r15
call fcn.140070e60
mov eax, esi
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret