Function at 0x14005f2c0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa8
xor ebx, ebx
mov r13, rdx
mov qword [rbp - 0x59], rbx
mov r12d, ebx
mov qword [rbp + 0x57], rbx
mov r14d, ebx
mov qword [rbp - 0x61], rbx
mov r15d, ebx
mov qword [rbp - 0x69], rbx
test rdx, rdx
jne 0x14005f31a
mov ecx, 0x80070057
mov esi, ecx
call fcn.14007ab24
jmp 0x14005f67c
test r8d, r8d
je 0x14005f309
test r9, r9
je 0x14005f309
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14005f309
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14005f309
lea rdx, [0x140002eb8]
mov qword [rbp - 0x15], r9
mov qword [rbp - 0x29], rdx
xor r9d, r9d
lea rdx, [rbp + 0x5f]
mov dword [rbp - 0x19], r8d
mov qword [rbp - 0x21], rdx
lea rdx, [rbp - 0x31]
mov qword [rbp - 9], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x31], 3
mov dword [rbp - 0xd], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x5f]
cmp esi, 0x8007000d
jne 0x14005f385
mov esi, 0xc004f307
jmp 0x14005f389
test esi, esi
jns 0x14005f38d
mov ecx, esi
jmp 0x14005f310
mov rsi, qword [0x1404379e0]
lea rcx, [0x1404379a0]
call fcn.140053ec4
mov rbx, rax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403b8660]
lea rax, [rbp - 0x61]
mov rdx, rbx
lea r9, [0x1403c1b40]
mov qword [rsp + 0x20], rax
lea r8, str.msft:rm_algorithm_volume_1.0
mov rcx, rsi
call rdi
mov esi, eax
test eax, eax
jns 0x14005f3df
mov ecx, eax
jmp 0x14005f310
mov rdi, qword [0x1404379e0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [0x1403b8660]
lea rax, [rbp - 0x69]
xor r9d, r9d
lea r8, [0x1403c1d60]
mov qword [rsp + 0x20], rax
lea rdx, str.msft:spp_stockobjects_plugins_params_named
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005f3d8
lea rdx, [rbp + 0x57]
mov rcx, r13
call fcn.140053350
mov esi, eax
test eax, eax
jns 0x14005f439
mov ecx, eax
call fcn.14007ab24
jmp 0x14005f678
mov rax, qword [0x1404379a0]
test rax, rax
je 0x14005f659
lea r12, [rax + 8]
test r12, r12
je 0x14005f45d
mov rcx, r12
call fcn.1400703bc
test r12, r12
mov r15, qword [rbp + 0x57]
lea r9, [rbp - 0x59]
mov rdx, r15
lea r8, str.applicationId
setne r14b
call fcn.1400d3820
mov esi, eax
test eax, eax
js 0x14005f3d8
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:GVLK
call fcn.1400ea330
test eax, eax
jns 0x14005f4a3
mov ecx, 0xc004f306
jmp 0x14005f30e
cmp dword [rbp + 0x57], 0
jne 0x14005f4c6
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:CSVLK
call fcn.1400ea330
test eax, eax
js 0x14005f499
cmp dword [rbp + 0x57], 0
je 0x14005f499
mov rax, qword [rbp - 0x59]
lea rcx, str.SppBindingAppId
mov rbx, qword [rbp - 0x69]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x51], rcx
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403b8660]
mov r13d, 1
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005f3d8
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingSkuId
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x49], 2
mov qword [rbp - 0x41], r15
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403b8660]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005f3d8
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationType
mov qword [rbp - 0x51], rax
lea rax, str.Token
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403b8660]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005f3d8
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationResponse
mov qword [rbp - 0x51], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x41], rax
mov eax, dword [rbp + 0x67]
mov dword [rbp - 0x39], eax
mov rax, qword [rbx]
mov dword [rbp - 0x49], 4
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403b8660]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
lea rdx, [0x140433828]
mov esi, eax
lea rcx, [0x14040cffc]
call fcn.1400ebd6c
test esi, esi
js 0x14005f389
mov rdi, qword [0x140437a30]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [0x1403b8660]
mov rdx, qword [rbp - 0x59]
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005f3d8
mov rbx, qword [rbp - 0x61]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403b8660]
mov rdx, qword [rbp - 0x69]
mov rcx, rbx
call rdi
lea rdx, [0x1404319f4]
mov esi, eax
lea rcx, [0x140423828]
call fcn.1400ed82c
test esi, esi
jns 0x14005f67c
jmp 0x14005f389
mov esi, 0x8000ffff
mov ecx, esi
call fcn.14007ab24
lea rdx, [0x140432034]
lea rcx, [0x140414130]
call fcn.1400ed4d4
mov r15, qword [rbp + 0x57]
mov ecx, esi
call fcn.14007ab44
mov rbx, qword [rbp - 0x69]
test rbx, rbx
je 0x14005f6cc
lea rdx, [0x140436070]
lea rcx, [0x140417c78]
call fcn.1400ed188
mov rax, qword [rbx]
lea rdx, [0x140433248]
lea rcx, [0x140418d78]
mov rdi, qword [rax + 0x10]
call fcn.1400edb90
mov rcx, rdi
call qword [0x1403b8660]
mov rcx, rbx
call rdi
and qword [rbp - 0x69], 0
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14005f6ef
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403b8660]
mov rcx, rbx
call rdi
and qword [rbp - 0x61], 0
test r15, r15
je 0x14005f6fd
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14005f70c
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x14005f71e
test r14d, r14d
je 0x14005f71e
mov rcx, r12
call fcn.14007329c
mov eax, esi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret