Function at 0x140009db0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp + 0x40]
sub rsp, 0x160
mov rbx, rcx
lea rax, str.SetProcessMitigationPolicy
xor r8d, r8d
mov qword [rcx + 8], rax
mov qword [rcx], r8
lea rax, str.QueryUnbiasedInterruptTimePrecise
mov qword [rcx + 0x18], rax
lea rax, str.QueryInterruptTime
mov qword [rcx + 0x28], rax
lea rsi, [rbx + 0x100]
mov qword [rcx + 0x10], r8
lea rax, str.QueryInterruptTimePrecise
mov qword [rcx + 0x38], rax
lea rdi, [rbx + 0x110]
mov qword [rcx + 0x20], r8
lea rax, str.NtQueryDirectoryFile
mov qword [rcx + 0x30], r8
mov qword [rcx + 0x40], r8
lea rcx, str.SetThreadDescription
mov qword [rbx + 0x48], rcx
lea rcx, str.NtQueryInformationFile
mov qword [rbx + 0x58], rcx
lea rcx, str.NtSetInformationFile
mov qword [rbx + 0x68], rcx
lea rcx, str.NtQuerySystemInformation
mov qword [rbx + 0x78], rcx
lea rcx, str.NtQueryObject
mov qword [rbx + 0x88], rcx
lea rcx, str.NtSuspendProcess
mov qword [rbx + 0x98], rcx
lea rcx, str.NtResumeProcess
mov qword [rbx + 0xa8], rcx
lea rcx, str.NtQueryInformationProcess
mov qword [rbx + 0xb8], rcx
lea rcx, str.NtQueryVolumeInformationFile
mov qword [rbx + 0xc8], rcx
lea rcx, str.SetProcessDEPPolicy
mov qword [rbx + 0xd8], rcx
lea rcx, str.NtWow64ReadVirtualMemory64
mov qword [rbx + 0xe8], rcx
lea rcx, str.NtQueryVirtualMemory
mov qword [rbx + 0xf8], rcx
lea rcx, str.NtCreateFile
mov qword [rbx + 0x128], rcx
lea rcx, str.NtClose
mov qword [rbx + 0x138], rcx
lea rcx, str.SetSearchPathMode
mov qword [rbx + 0x148], rcx
lea rcx, str.RtlGetNtVersionNumbers
mov qword [rbx + 0x158], rcx
lea rcx, str.NtQueryInformationByName
mov qword [rbx + 0x168], rcx
lea rcx, str.NtQueryFullAttributesFile
mov qword [rbx + 0x178], rcx
lea rcx, str.NtFsControlFile
mov qword [rsi + 8], rax
lea rax, str.NtQueryDirectoryFileEx
mov qword [rbx + 0x188], rcx
lea rcx, str.ProcessIdToSessionId
mov qword [rbx + 0x50], r8
mov qword [rbx + 0x60], r8
mov qword [rbx + 0x70], r8
mov qword [rbx + 0x80], r8
mov qword [rbx + 0x90], r8
mov qword [rbx + 0xa0], r8
mov qword [rbx + 0xb0], r8
mov qword [rbx + 0xc0], r8
mov qword [rbx + 0xd0], r8
mov qword [rbx + 0xe0], r8
mov qword [rbx + 0xf0], r8
mov qword [rsi], r8
mov qword [rdi], r8
mov qword [rdi + 8], rax
mov qword [rbx + 0x120], r8
mov qword [rbx + 0x130], r8
mov qword [rbx + 0x140], r8
mov qword [rbx + 0x150], r8
mov qword [rbx + 0x160], r8
mov qword [rbx + 0x170], r8
mov qword [rbx + 0x180], r8
mov qword [rbx + 0x190], r8
mov qword [rbx + 0x198], rcx
lea r13, [rbx + 0x200]
lea rcx, str.InitializeProcThreadAttributeList
mov qword [rbx + 0x1a0], r8
mov qword [rbx + 0x1a8], rcx
lea rax, [0x1400da210]
lea rcx, str.UpdateProcThreadAttribute
mov qword [rbx + 0x1b0], r8
mov qword [rbx + 0x1b8], rcx
lea rcx, str.DeleteProcThreadAttributeList
mov qword [rbx + 0x1c8], rcx
lea rcx, str.NtCompareTokens
mov qword [rbx + 0x1d8], rcx
lea rcx, str.NtQueryEaFile
mov qword [rbx + 0x1e8], rcx
lea rcx, str.NtSetEaFile
mov qword [rbx + 0x1f8], rcx
lea rcx, str.NtQuerySecurityObject
mov qword [rbx + 0x218], rcx
lea rcx, str.RtlGetOwnerSecurityDescriptor
mov qword [rbx + 0x228], rcx
lea rcx, str.LdrRegisterDllNotification
mov qword [rbx + 0x238], rcx
lea rcx, str.LdrUnregisterDllNotification
mov qword [rbx + 0x248], rcx
lea rcx, str.LdrFindEntryForAddress
mov qword [rbx + 0x258], rcx
lea rcx, str.NtPowerInformation
mov qword [rbx + 0x268], rcx
lea rcx, str.NtSetInformationProcess
mov qword [rbx + 0x278], rcx
lea rcx, str.NtCreateDirectoryObjectEx
mov qword [rbx + 0x288], rcx
lea rcx, str.NtCreateSymbolicLinkObject
mov qword [rbx + 0x298], rcx
lea rcx, str.RtlUnicodeToUTF8N
mov qword [rbx + 0x2a8], rcx
lea rcx, str.NtQueryInformationThread
mov qword [rbx + 0x2b8], rcx
lea rcx, str.NtOpenFile
mov qword [rbx + 0x2c8], rcx
lea rcx, str.NtQueryLicenseValue
mov qword [rbx + 0x2d8], rcx
lea rcx, str.NtQuerySection
mov qword [rbx + 0x2e8], rcx
mov qword [rbx + 0x1c0], r8
mov qword [rbx + 0x1d0], r8
mov qword [rbx + 0x1e0], r8
mov qword [rbx + 0x1f0], r8
mov qword [r13], r8
mov qword [r13 + 8], rax
mov qword [rbx + 0x210], r8
mov qword [rbx + 0x220], r8
mov qword [rbx + 0x230], r8
mov qword [rbx + 0x240], r8
mov qword [rbx + 0x250], r8
mov qword [rbx + 0x260], r8
mov qword [rbx + 0x270], r8
mov qword [rbx + 0x280], r8
mov qword [rbx + 0x290], r8
mov qword [rbx + 0x2a0], r8
mov qword [rbx + 0x2b0], r8
mov qword [rbx + 0x2c0], r8
mov qword [rbx + 0x2d0], r8
mov qword [rbx + 0x2e0], r8
mov eax, dword [0x7ffe026c]
mov dword [rbp - 0x80], eax
mov eax, dword [0x7ffe0270]
movzx ecx, word [rbp - 0x80]
mov dword [rbp - 0x7c], eax
mov eax, dword [0x7ffe0260]
mov rdx, qword [rbp - 0x80]
shr rdx, 0x20
mov word [rbp - 0x6e], dx
mov word [rbp - 0x66], dx
mov dword [rbp - 0x78], eax
mov word [rbp - 0x70], cx
mov word [rbp - 0x6c], ax
mov word [rbp - 0x6a], r8w
mov word [rbp - 0x68], cx
mov word [rbp - 0x64], ax
xor eax, eax
mov word [rbp - 0x62], r8w
movups xmm0, xmmword [rbp - 0x70]
mov qword [rbp - 0x54], rax
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x60], r8
movups xmmword [rbx + 0x2f0], xmm0
mov dword [rbp - 0x58], r8d
movups xmm1, xmmword [rbp - 0x60]
mov dword [rbp - 0x4c], eax
movsd xmm0, qword [rbp - 0x50]
movups xmmword [rbx + 0x300], xmm1
xorps xmm1, xmm1
movsd qword [rbx + 0x310], xmm0
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movups xmm0, xmmword [rbp - 0x70]
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbx + 0x318], xmm0
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx + 0x328], xmm1
movups xmmword [rbx + 0x338], xmm0
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
lea rcx, str.ntdll.dll
mov qword [rbx + 0x348], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
test rax, rax
je 0x14000a4f3
lea rax, [rbx + 0x2e0]
mov qword [rsp + 0x118], rax
lea r9, [rbx + 0x70]
lea rax, [rbx + 0x2d0]
mov qword [rsp + 0x110], rax
lea r8, [rbx + 0x60]
lea rax, [rbx + 0x2c0]
mov qword [rsp + 0x108], rax
lea rdx, [rbx + 0x50]
lea rax, [rbx + 0x2b0]
mov qword [rsp + 0x100], rax
lea rax, [rbx + 0x2a0]
mov qword [rsp + 0xf8], rax
lea rax, [rbx + 0x290]
mov qword [rsp + 0xf0], rax
lea rax, [rbx + 0x280]
mov qword [rsp + 0xe8], rax
lea rax, [rbx + 0x270]
mov qword [rsp + 0xe0], rax
lea rax, [rbx + 0x260]
mov qword [rsp + 0xd8], rax
lea rax, [rbx + 0x250]
mov qword [rsp + 0xd0], rax
lea rax, [rbx + 0x240]
mov qword [rsp + 0xc8], rax
lea rax, [rbx + 0x230]
mov qword [rsp + 0xc0], rax
lea rax, [rbx + 0x220]
mov qword [rsp + 0xb8], rax
lea rax, [rbx + 0x210]
mov qword [rsp + 0xb0], rax
lea rax, [rbx + 0x1f0]
mov qword [rsp + 0xa8], rax
lea rax, [rbx + 0x1e0]
mov qword [rsp + 0xa0], rax
lea rax, [rbx + 0x1d0]
mov qword [rsp + 0x98], rax
lea rax, [rbx + 0x180]
mov qword [rsp + 0x90], rax
lea rax, [rbx + 0x170]
mov qword [rsp + 0x88], rax
lea rax, [rbx + 0x160]
mov qword [rsp + 0x80], rax
lea rax, [rbx + 0x150]
mov qword [rsp + 0x78], rax
lea rax, [rbx + 0x130]
mov qword [rsp + 0x70], rax
lea rax, [rbx + 0x120]
mov qword [rsp + 0x68], rax
lea rax, [rbx + 0xf0]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rax
lea rax, [rbx + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rbx + 0xc0]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 0xb0]
mov qword [rsp + 0x38], rax
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rbx + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rbx + 0x80]
mov qword [rsp + 0x20], rax
call fcn.14000a510
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a4fe
lea rcx, [rbx + 0x1c0]
mov rdx, rbx
mov qword [rsp + 0x40], rcx
lea r9, [rbx + 0xd0]
lea rcx, [rbx + 0x1b0]
mov qword [rsp + 0x38], rcx
lea r8, [rbx + 0x40]
lea rcx, [rbx + 0x1a0]
mov qword [rsp + 0x30], rcx
lea rcx, [rbx + 0x190]
mov qword [rsp + 0x28], rcx
lea rcx, [rbx + 0x140]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.14000b180
lea rcx, str.KernelBase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a506
lea r9, [rbx + 0x30]
mov qword [rsp + 0x20], r13
lea r8, [rbx + 0x20]
mov rcx, rax
lea rdx, [rbx + 0x10]
call fcn.14000b460
cmp qword [rsi], 0
je 0x14000a4c3
cmp qword [rdi], 0
je 0x14000a4e7
lea r11, [rsp + 0x160]
mov rax, rbx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rax, [0x140009d30]
mov qword [rdi], rax
jmp 0x14000a4c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000a424
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000a48c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000a4b7