Function at 0x140011674
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x7e8]
sub rsp, 0x8c0
mov rax, qword [0x1400d6a00]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov qword [rsp + 0x60], rcx
lea rcx, [0x14001fb50]
mov dword [rsp + 0x40], 0x10000
call fcn.140019bfc
mov edx, dword [rsp + 0x40]
mov esi, 0x656e6864
mov r8d, esi
mov dword [rsp + 0x44], eax
xor ecx, ecx
mov edi, eax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r13d, r13d
mov rbx, rax
test rax, rax
je 0x1400119db
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov r8d, dword [rsp + 0x40]
lea r14d, [r13 + 0x10]
mov ecx, r14d
lea r9, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r15d, 0xc0000004
jmp 0x140011769
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [rsp + 0x40]
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x1400119db
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.14001ea80
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, r15d
je 0x14001171e
test eax, eax
js 0x1400119e0
mov eax, dword [0x140079b58]
mov ecx, 1
mov r12d, dword [rbx]
mov r8d, 0x6d7467
imul rdx, rax, 0x640
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
test rax, rax
jne 0x1400117a9
mov eax, 0xc0000023
jmp 0x1400119e0
mov eax, dword [0x140079b58]
xor edx, edx
imul r8, rax, 0x640
call fcn.14001ea80
mov r14d, 0xc0000001
mov esi, r13d
test r12, r12
je 0x1400119d6
add rbx, 0xc
xorps xmm1, xmm1
movzx r15d, word [rbx + 2]
xorps xmm0, xmm0
mov qword [rsp + 0x58], r13
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x50], r13
movups xmmword [rsp + 0x78], xmm1
mov dword [rsp + 0x48], r13d
movups xmmword [rbp - 0x78], xmm1
movups xmmword [rbp - 0x68], xmm1
cmp byte [rbx], dil
jne 0x1400119c4
movzx r13d, word [rbx - 4]
lea r9, [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x68], r13
lea r8, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x78], 0x30
mov qword [rbp - 0x80], rax
lea edx, [rax + 0x40]
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x78], rax
movdqu xmmword [rbp - 0x68], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
xor ecx, ecx
test eax, eax
js 0x1400119a1
mov dword [rsp + 0x30], 2
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], ecx
or r8, 0xffffffffffffffff
mov rcx, qword [rsp + 0x58]
mov edx, r15d
mov dword [rsp + 0x20], 0x1fffff
call qword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
xor ecx, ecx
test eax, eax
js 0x1400119a1
mov edx, 0x400
mov r8d, 0x656e6864
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rax, rax
je 0x14001199d
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call fcn.14001ea80
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x400
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 1
call qword [sym.imp.ntoskrnl.exe_ZwQueryObject]
xor eax, eax
cmp word [rdi], ax
jbe 0x14001198f
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x400
call fcn.14001ea80
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x400
call fcn.14001ea80
mov rax, qword [rsp + 0x60]
or r8, 0xffffffffffffffff
xor ecx, ecx
inc r8
cmp word [rax + r8*2], cx
jne 0x140011913
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe_wcsncpy
movzx r8d, word [rdi]
lea rcx, [rbp - 0x50]
mov rdx, qword [rdi + 8]
shr r8, 1
call sub.ntoskrnl.exe_wcsncpy
lea rcx, [rbp + 0x3b0]
call sub.ntoskrnl.exe__wcslwr
lea rcx, [rbp - 0x50]
call sub.ntoskrnl.exe__wcslwr
lea rax, [rbp - 0x50]
lea r10, [rbp + 0x3b0]
sub r10, rax
movzx r8d, word [rax]
movzx r9d, word [rax + r10]
sub r8d, r9d
jne 0x14001197a
add rax, 2
test r9d, r9d
jne 0x140011963
test r8d, r8d
jne 0x14001198f
mov rdx, r15
mov rcx, r13
call fcn.140017fb8
xor eax, eax
mov r14d, eax
mov edx, 0x656e6864
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
xor r13d, r13d
test rcx, rcx
je 0x1400119b4
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400119c4
call qword [sym.imp.ntoskrnl.exe_ZwClose]
inc esi
add rbx, 0x18
movsxd rcx, esi
cmp rcx, r12
jb 0x1400117d3
mov eax, r14d
jmp 0x1400119e0
mov eax, 0xc00000a0
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.14001e6e0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret