Function at 0x140057bc8
Capabilities:
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
lea rdx, [0x140059870]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
test rax, rax
jne 0x140057c2d
mov r8d, dword [str.sboxS]
lea ecx, [rax + 1]
mov edi, 0x1000
mov edx, edi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140057c40
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1010450
call fcn.1400149e8
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
and dword [rbp + 0x20], 0
lea r9, [rbp + 0x20]
mov r8d, edi
mov rdx, rbx
mov ecx, 0xb
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
je 0x140057c75
cmp eax, 0xc0000004
je 0x140057c75
mov edx, dword [str.sboxS]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x140057c2b
mov edx, dword [str.sboxS]
mov rcx, rbx
mov rdi, qword [rbx + 0x18]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rdx, [0x1400598b0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rbx, rax
test rax, rax
je 0x140057c2b
mov r8d, dword [0x14005204c]
mov esi, 0xa
cmp r8d, 0x4f7c
jb 0x140057d6b
mov rdx, rax
lea rcx, [0x1400598e0]
mov r14, rdi
call sub.ntoskrnl.exe_DbgPrint
mov edx, esi
xor edi, edi
mov dword [rbp + 0x20], edx
add rbx, rsi
mov r8b, byte [rbx]
lea eax, [r8 - 0x44]
test al, 0xf3
jne 0x140057d57
cmp r8b, 0x50
je 0x140057d57
movzx ecx, byte [rbx + 1]
sub ecx, 0x39
je 0x140057d23
cmp ecx, 0x50
jne 0x140057d57
cmp byte [rbx + 2], 0x20
jae 0x140057d57
test rdi, rdi
je 0x140057d57
movsxd rax, dword [rbx + 3]
lea rcx, [rbx + 7]
add rcx, rax
cmp rdi, rcx
jne 0x140057d57
lea rax, [rdi - 0x20]
jmp 0x140057c2d
movsxd rcx, dword [rbx + 3]
cmp r8b, 0x44
jne 0x140057d43
cmp byte [rbx + 2], 0x90
jne 0x140057d43
lea eax, [rcx - 1]
cmp eax, 0x3ffffe
ja 0x140057d43
lea rdi, [r14 + rcx]
jmp 0x140057d50
cmp byte [rbx + 2], 0x20
jae 0x140057d57
lea rdi, [rbx + 7]
add rdi, rcx
add edx, 6
add rbx, 6
inc edx
inc rbx
mov dword [rbp + 0x20], edx
cmp edx, 0x200
jb 0x140057ce0
cmp dword [0x14005204c], 0x2739
jb 0x140057e5e
lea rdx, [0x1400598b0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rbp - 0x10]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov r8d, dword [0x14005204c]
lea rcx, [0x140059930]
mov rdx, rax
lea rbx, [rsi + rax]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov dword [rbp + 0x20], esi
mov r8b, byte [rbx]
lea ecx, [r8 - 0x44]
test cl, 0xf3
jne 0x140057e29
cmp r8b, 0x50
je 0x140057e29
movzx ecx, byte [rbx + 1]
sub ecx, 0x89
je 0x140057e0e
cmp ecx, 4
jne 0x140057e29
movsxd rcx, dword [rbx + 3]
cmp r8b, 0x44
jne 0x140057df8
cmp byte [rbx + 2], 0x90
jne 0x140057df8
lea eax, [rcx - 1]
cmp eax, 0x3ffffe
ja 0x140057df8
lea rdx, [rdi + rcx]
jmp 0x140057e05
cmp byte [rbx + 2], 0x20
jae 0x140057e29
lea rdx, [rbx + 7]
add rdx, rcx
add esi, 6
add rbx, 6
jmp 0x140057e29
cmp byte [rbx + 2], 0x20
jae 0x140057e29
test rdx, rdx
je 0x140057e29
movsxd rax, dword [rbx + 3]
lea rcx, [rbx + 7]
add rcx, rax
cmp rdx, rcx
je 0x140057e42
inc esi
inc rbx
mov dword [rbp + 0x20], esi
cmp esi, 0xa0
jae 0x140057c2b
jmp 0x140057db5
cmp dword [0x14005204c], 0x4512
sbb rax, rax
and eax, 0x40
add rax, 0xffffffffffffffe0
add rax, rdx
jmp 0x140057c2d
xor ecx, ecx
mov dword [rbp + 0x20], ecx
mov al, byte [rbx]
sub al, 0x48
test al, 0xfb
jne 0x140057e7b
movsxd rax, dword [rbx + 3]
lea rdx, [rbx + 7]
add rdx, rax
cmp rdx, rdi
je 0x140057ed4
inc ecx
inc rbx
mov dword [rbp + 0x20], ecx
cmp ecx, 0x20
jb 0x140057e63
xor edx, edx
cmp rdi, rdx
jne 0x140057c2b
or r10d, 0xffffffff
xor r8d, r8d
mov ecx, r10d
mov dword [rbp + 0x20], r8d
mov edx, r10d
mov al, byte [rbx]
sub al, 0x4a
cmp al, 1
ja 0x140057ec2
cmp byte [rbx + 1], 0x83
jne 0x140057ec2
cmp byte [rbx + 8], 0
jne 0x140057ec2
mov eax, dword [rbx + 4]
cmp ecx, r10d
jne 0x140057eda
mov ecx, eax
inc r8d
inc rbx
mov dword [rbp + 0x20], r8d
cmp r8d, 0x20
jae 0x140057edc
jmp 0x140057ea4
add rbx, 7
jmp 0x140057e8a
mov edx, eax
mov r9d, 0x400000
cmp ecx, r9d
jae 0x140057eec
cmp edx, r9d
jb 0x140057f59
mov eax, r8d
sub rbx, rax
xor eax, eax
mov dword [rbp + 0x20], eax
add rbx, 8
cmp byte [rbx - 8], 0x48
jne 0x140057f3a
mov r8b, byte [rbx - 7]
cmp r8b, 0x83
jne 0x140057f26
cmp byte [rbx - 6], 0xbc
jne 0x140057f3a
cmp byte [rbx - 5], 0x18
jne 0x140057f3a
cmp byte [rbx], 0
jne 0x140057f3a
cmp ecx, r10d
jne 0x140057f3a
mov ecx, dword [rbx - 4]
jmp 0x140057f3a
cmp r8b, 0x8d
jne 0x140057f3a
cmp byte [rbx - 6], 0x8b
jne 0x140057f3a
cmp edx, r10d
jne 0x140057f3a
mov edx, dword [rbx - 5]
inc eax
inc rbx
mov dword [rbp + 0x20], eax
cmp eax, 0x20
jb 0x140057efb
cmp ecx, r9d
jae 0x140057c2b
cmp edx, r9d
jae 0x140057c2b
lfence
mov eax, ecx
add rax, rdi
jmp 0x140057c2d