Function at 0x1400e031c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
lea rcx, str.AsrGetSystemVolumeDevPath
lea ebp, [rbx + 1]
call fcn.1400e6f98
mov dword [rsp + 0x58], ebx
mov esi, ebx
test r14, r14
je 0x1400e050c
lea r9, [rsp + 0x58]
mov word [r14], bx
xor r8d, r8d
lea ecx, [rbx + 0x62]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
test eax, eax
jns 0x1400e03da
cmp eax, 0xc0000023
je 0x1400e03da
cmp eax, 0x80000005
je 0x1400e03da
cmp eax, 0xc0000004
je 0x1400e03da
mov ecx, eax
mov ebp, ebx
call fcn.1400e704c
mov ebx, eax
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e0550
test byte [rcx + 0x1c], 8
je 0x1400e0550
lea edx, [rsi + 0x18]
mov r9d, edi
lea rax, str.ntStatus
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401365b0]
mov qword [rsp + 0x20], rax
call fcn.1400d4cec
jmp 0x1400e0550
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov rsi, rax
test rax, rax
jne 0x1400e0425
lea r9d, [rax + 0xe]
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e0550
test byte [rcx + 0x1c], 8
je 0x1400e0550
lea edx, [rax + 0x19]
lea rax, str.pSysInfo
jmp 0x1400e053b
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400e04a0
mov ecx, eax
mov ebp, ebx
call fcn.1400e704c
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x1400e0550
test byte [rax + 0x1c], 8
je 0x1400e0550
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r9d, eax
mov edx, 0x1a
lea rax, str.NtQuerySystemInformation__SystemSystemPartitionInformation__pSysInfo__cbRequiredSize__cbRequiredSize_
mov rcx, qword [section..data]
jmp 0x1400e03c0
movzx r9d, word [rsi]
mov edi, 0x104
mov r8, qword [rsi + 8]
mov edx, edi
shr r9, 1
mov rcx, r14
call fcn.140038b4c
test eax, eax
jns 0x1400e0550
mov ecx, eax
mov ebp, ebx
call fcn.1400e7018
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x1400e0550
test byte [rax + 0x1c], 8
je 0x1400e0550
movzx r9d, word [rsi]
mov edx, edi
mov r8, qword [rsi + 8]
mov rcx, r14
shr r9, 1
call fcn.140038b4c
mov r9d, eax
mov edx, 0x1b
lea rax, str.::StringCchCopyN__pwszVolume__cchVolume__pSysInfo__SystemPartition.Buffer___pSysInfo__SystemPartition.Length__sizeof_WCHAR___
jmp 0x1400e0494
mov r9d, 0x57
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e0550
test byte [rcx + 0x1c], 8
je 0x1400e0550
lea edx, [r9 - 0x41]
lea rax, str.pwszVolume
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401365b0]
mov qword [rsp + 0x20], rax
call fcn.1400d4cec
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
lea rcx, str.AsrGetSystemVolumeDevPath
call fcn.1400e6fd8
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret