Function at 0x24394
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, qword [sym.imp.ntoskrnl.exe_NtBuildNumber]
xor r15d, r15d
mov edi, 0x19000
lea ecx, [r15 + 1]
mov r8d, 0x64425349
mov rdx, rdi
mov r12, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r15
je 0x247d5
lea ebp, [r15 + 0xb]
xor r9d, r9d
mov r8d, edi
mov ecx, ebp
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r14d, 0xc0000004
jmp 0x2443b
mov edx, 0x64425349
mov rcx, rbx
add edi, edi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rdx, rdi
mov ecx, 1
mov r8d, 0x64425349
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
cmp rax, r15
je 0x24442
xor r9d, r9d
mov r8d, edi
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov esi, eax
cmp eax, r14d
je 0x243fe
cmp esi, r15d
jge 0x24461
cmp rbx, r15
je 0x247d5
mov edx, 0x64425349
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, r15
cmp rbx, r15
je 0x247d5
mov ebp, r15d
lea r14, [0x00024910]
cmp dword [rbx], r15d
jbe 0x247aa
lea rdi, [rbx + 0x18]
lea r8, [0x00018258]
lea rsi, [0x00018260]
movsx eax, word [rdi + 0x10]
cmp ebp, eax
jne 0x246dd
mov rcx, qword [rdi]
lea rax, [rcx + 0x148]
cmp r13, rax
jbe 0x244f6
mov edx, dword [rdi + 8]
lea rax, [rcx + rdx]
cmp r13, rax
jae 0x244f6
mov dword [rsp + 0x30], edx
mov edx, 3
mov eax, ebp
lea r8, [0x00024930]
mov r9, r14
imul rax, rax, 0x128
lea r12, [rax + rbx + 8]
lea rax, [r12 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea ecx, [rdx + 0x62]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x00018258]
mov rcx, qword [rdi]
lea rax, [rcx + 0x148]
cmp r8, rax
jbe 0x246cc
mov eax, dword [rdi + 8]
add rax, rcx
cmp r8, rax
jae 0x246cc
mov qword [0x00018258], rcx
mov eax, dword [rdi + 8]
lea rcx, [rsp + 0x50]
mov dword [0x00018254], eax
mov eax, ebp
mov word [0x00018260], r15w
imul rax, rax, 0x128
lea r14, [rax + rbx + 0x30]
mov rdx, r14
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
mov r8b, 1
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
cmp eax, r15d
jl 0x245ad
movzx esi, word [rsp + 0x40]
shr esi, 1
cmp esi, 0x103
ja 0x245a6
movzx r8d, word [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
lea rcx, [0x00018260]
call fcn.00013290
mov r11d, esi
lea rsi, [0x00018260]
lea rcx, [rsp + 0x40]
mov word [rsi + r11*2], r15w
call qword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
jmp 0x245ad
lea rsi, [0x00018260]
lea r9, [0x00018470]
mov r8, rsi
mov edx, 0x104
mov rcx, r9
sub r8, r9
lea rax, [rdx + 0x7ffffefa]
cmp rax, r15
je 0x245e6
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x245e6
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x245c2
cmp rdx, r15
jne 0x245ef
sub rcx, 2
mov word [rcx], r15w
mov edx, 0x5c
mov rcx, r9
call sub.ntoskrnl.exe_wcsrchr
cmp rax, r15
je 0x2460c
mov word [rax + 2], r15w
jmp 0x24624
lea r8, [0x00024960]
lea rcx, [0x00018470]
mov edx, 0x104
call fcn.000114ec
mov edx, 0x5c
mov rcx, rsi
call sub.ntoskrnl.exe_wcsrchr
cmp rax, r15
je 0x24643
add rax, 2
mov qword [0x000177d8], rax
jmp 0x2464a
mov qword [0x000177d8], rsi
mov eax, dword [rdi + 8]
mov edx, 3
lea r8, [0x000249a0]
mov dword [rsp + 0x30], eax
mov rax, qword [rdi]
mov qword [rsp + 0x28], r14
lea r14, [0x00024910]
lea ecx, [rdx + 0x62]
mov qword [rsp + 0x20], rax
mov r9, r14
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edx, 3
lea rax, [0x00018470]
lea r8, [0x000249d0]
lea ecx, [rdx + 0x62]
mov r9, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r11, qword [0x000177d8]
mov edx, 3
lea r8, [0x000249f0]
mov r9, r14
lea ecx, [rdx + 0x62]
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r8, [0x00018258]
inc ebp
add rdi, 0x128
cmp ebp, dword [rbx]
jb 0x2448f
cmp r12, r15
je 0x247aa
lea rcx, [0x000198e0]
mov rdx, r12
mov r8d, 0x128
call fcn.00013290
mov r11, qword [0x000198f0]
mov eax, dword [0x000198f8]
mov ebp, 3
lea r8, [0x00024a40]
mov r9, r14
lea esi, [rbp + 0x62]
mov edx, ebp
mov qword [0x00018248], r11
mov ecx, esi
mov dword [0x00018250], eax
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r11d, dword [0x00018250]
lea r8, [0x00024a60]
mov r9, r14
mov edx, ebp
mov ecx, esi
mov dword [rsp + 0x20], r11d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
movsx r9, word [0x00019906]
lea rax, [0x00019908]
lea rdi, str.SystemRootSystem32_ntoskrnl.exe
lea r8, [0x00024a80]
lea edx, [rbp + 0x3d]
add r9, rax
mov rcx, rdi
call fcn.000114ec
lea r8, [0x00024ab0]
mov r9, r14
mov edx, ebp
mov ecx, esi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov edx, 0x64425349
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x247d5
mov edx, 0x64425349
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edx, edx
lea r8, [0x00024a10]
lea ecx, [rdx + 0x65]
mov r9, r14
mov dword [rsp + 0x20], 0x10f
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret