Function at 0x1400a2e00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 8], rax
xor r14d, r14d
mov qword [rsp + 0x68], rdx
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r14
mov r13d, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r14
call fcn.1400a3518
mov ebx, eax
test eax, eax
js 0x1400a3144
lea r8d, [r14 + 0x18]
lea rdx, [rbp - 0x38]
lea ecx, [r14 + 7]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
mov ebx, eax
test eax, eax
js 0x1400a3144
mov rcx, qword gs:[0x60]
lea r8d, [r14 + 0x6a]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
jne 0x1400a2eb6
mov eax, 0xc0000017
jmp 0x1400a3184
mov bl, r14b
mov r15d, r14d
cmp dword [rbp - 0x38], r14d
jbe 0x1400a3127
lea r8, [rbp - 0x20]
lea rdx, [rsp + 0x40]
mov ecx, r15d
call fcn.14009e430
test eax, eax
js 0x1400a30db
mov r8, qword [rsp + 0x70]
cmp qword [rsp + 0x38], r14
jne 0x1400a2f38
mov rdx, qword [r8 + 4]
lea rcx, [rbp - 0x1c]
cmp rdx, qword [rcx]
jne 0x1400a2f10
mov rdx, qword [r8 + 0xc]
cmp rdx, qword [rcx + 8]
jne 0x1400a2f10
mov edx, dword [r8 + 0x14]
cmp edx, dword [rcx + 0x10]
jne 0x1400a2f10
mov eax, r14d
jmp 0x1400a2f15
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
je 0x1400a2f38
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400a30db
mov rax, qword [rsp + 0x58]
mov esi, dword [r8 + 4]
test rax, rax
je 0x1400a2fe0
cmp esi, 1
jne 0x1400a2fe5
mov eax, dword [rax]
lea r8, [0x1401696b0]
lea edx, [rsi + 0x34]
mov r9d, r15d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_swprintf_s]
lea rcx, [rbp - 0x58]
mov rdx, rdi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp - 0x58]
lea r9, [rbp - 0x48]
lea r8, [rsp + 0x78]
lea rcx, [rsp + 0x60]
mov edx, 0x80000000
mov dword [rsp + 0x28], r14d
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x78], 0x30
mov qword [rbp - 0x80], r14
mov dword [rbp - 0x70], 0x40
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_ZwOpenFile]
test eax, eax
js 0x1400a3090
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntdll.dll_ZwClose]
mov bl, sil
jmp 0x1400a3090
cmp esi, 1
je 0x1400a2fed
test esi, esi
jne 0x1400a3090
mov r12, r14
test esi, esi
jne 0x1400a3000
mov r12, qword [rsp + 0x48]
test rax, rax
cmovne r12, rax
mov rax, qword [rsp + 0x40]
mov ecx, r14d
mov dword [rsp + 0x30], ecx
cmp dword [rax + 4], r14d
jbe 0x1400a3090
lea r14, [rax + 0x48]
mov eax, dword [r14]
test eax, eax
je 0x1400a3072
lea r8, [0x1401696b0]
mov r9d, r15d
mov edx, UnregisterTraceGuids
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_swprintf_s]
cmp esi, 1
jne 0x1400a304c
mov rcx, qword [rsp + 0x48]
mov rax, qword [r14 - 0x10]
cmp qword [rcx], rax
jmp 0x1400a306c
mov rdx, qword [r12]
cmp rdx, qword [r14 + 0x18]
jne 0x1400a3065
mov rdx, qword [r12 + 8]
cmp rdx, qword [r14 + 0x20]
jne 0x1400a3065
xor eax, eax
jmp 0x1400a306a
sbb eax, eax
sbb eax, reloc.ADVAPI32.dll_TraceEvent
test eax, eax
je 0x1400a308b
mov ecx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
inc ecx
add r14, 0x90
mov dword [rsp + 0x30], ecx
cmp ecx, dword [rax + 4]
jae 0x1400a308d
jmp 0x1400a3016
mov bl, 1
xor r14d, r14d
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x1400a30e8
cmp bl, 1
jne 0x1400a30db
mov rcx, rdi
call fcn.1400a31b4
mov r13, rax
test rax, rax
je 0x1400a30d8
mov rdx, rax
mov rcx, rsi
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x1400a30ec
mov bl, r14b
inc r15d
cmp r15d, dword [rbp - 0x38]
jb 0x1400a2ec6
test bl, bl
je 0x1400a3127
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14009f1f0
test eax, eax
js 0x1400a311a
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rdi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x68]
mov ebx, r14d
mov qword [rax], rdi
jmp 0x1400a3144
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
mov ebx, 0xc000000d
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp qword [rsp + 0x38], r14
je 0x1400a3165
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test r13, r13
je 0x1400a3182
mov rcx, qword gs:[0x60]
mov r8, r13
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, ebx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x160]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret