Function at 0x14002fe90
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400e2e38]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rcx
mov word [rsp + 0x70], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x72]
call fcn.140082240
mov rax, qword [0x1400ec150]
test rax, rax
jne 0x14002ff11
mov ecx, 0x310
call fcn.140051b7c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14002ff08
mov rcx, rax
call fcn.140023810
jmp 0x14002ff0a
xor eax, eax
mov qword [0x1400ec150], rax
lea rdx, str.FindInstallSection__
mov rcx, rax
call fcn.140023be0
lea rbx, [rsi + 0x20]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
jne 0x140030148
lea r9, [rsi + 8]
xor r8d, r8d
lea rdx, str.Manufacturer
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
jne 0x14002ff63
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140030148
mov qword [rsp + 0x20], 0
mov r9d, pe_nt_image_headers64
lea r8, [rsp + 0x70]
mov edx, 1
lea rcx, [rsi + 8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
jne 0x14002ff95
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140030148
lea r8, [rsi + 0x220]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x14002ffeb
lea r9, [rsi + 8]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
jne 0x14003000f
lea r9, [rsi + 8]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
jne 0x14003000f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140030148
lea r9, [rsi + 8]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
jne 0x14003000f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140030148
mov qword [rsp + 0x20], 0
mov r9d, pe_nt_image_headers64
lea r8, [rsp + 0x70]
mov edx, 1
lea rcx, [rsi + 8]
call qword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
jne 0x140030041
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140030148
mov rdi, qword [rsi + 0x430]
mov word [rbx], 0
lea r8, [rsp + 0x70]
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.14007dab0
lea r9, [rsi + 8]
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x14003007d
xor eax, eax
jmp 0x140030148
call fcn.140023250
test eax, eax
je 0x14003010e
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x40]
cmp cx, 9
jne 0x1400300d4
test rbx, rbx
je 0x1400300b9
lea r8, str..NTamd64
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.14007f050
lea r9, [rsi + 8]
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140030142
xor eax, eax
jmp 0x140030148
cmp cx, 6
jne 0x140030142
test rbx, rbx
je 0x1400300f3
lea r8, str..NTia64
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.14007f050
lea r9, [rsi + 8]
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140030142
xor eax, eax
jmp 0x140030148
test rbx, rbx
je 0x140030127
lea r8, str..NTx86
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.14007f050
lea r9, [rsi + 8]
mov r8, rdi
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x140030142
xor eax, eax
jmp 0x140030148
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14007d3d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret