Function at 0x140013148
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x60
and dword [rax + 8], 0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
jne 0x140013181
mov byte [0x140044cc1], al
lea rcx, str.___Running_system_diagnostics_r_n
call fcn.140002fc8
nop
and qword [rsp + 0x90], 0
and dword [rsp + 0x88], 0
lea r9, [rsp + 0x88]
mov r8d, 8
lea rdx, [rsp + 0x90]
lea ecx, [r8 + 0x2a]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x1400131d3
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
mov rsi, qword [rsp + 0x90]
mov rdx, rsi
lea rcx, str.__System_range_start__llX_r_n
call fcn.140002fc8
lea rcx, str.__Speculation_mitigation_state_flags_r_n
call fcn.140002fc8
call fcn.14001226c
call fcn.1400018cc
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400132b5
lea rcx, str.__List_of_loaded_drivers_r_n_t____ImageBase___ImageSize___FileName__r_n
call fcn.140002fc8
xor ebx, ebx
mov dword [rsp + 0x40], ebx
cmp ebx, dword [rdi]
jae 0x14001325f
mov eax, ebx
imul r8, rax, 0x128
lea rax, [rdi + 0x30]
add rax, r8
movzx edx, word [r8 + rdi + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, dword [r8 + rdi + 0x20]
mov r8, qword [r8 + rdi + 0x18]
lea rcx, str._t_lu__p__lu__s_r_n
call fcn.140002fc8
inc ebx
jmp 0x140013222
lea rcx, str.__List_of_device_and_driver_objects_in_the_common_locations_r_n
call fcn.140002fc8
call fcn.1400130ac
mov rdx, rdi
mov rcx, rsi
call fcn.140012f70
lea rcx, str.__Analyzing_process_working_set_r_n
call fcn.140002fc8
mov rdx, rdi
mov rcx, rsi
call fcn.1400126c8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400132c6
lea rdx, str.Cannot_allocate_memory_r_n
mov ecx, 1
call fcn.140011090
lea rcx, str.__List_of_registered_minifilters_r_n
call fcn.140002fc8
call fcn.140012db4
lea rcx, str.__Physical_memory_layout_r_n
call fcn.140002fc8
call fcn.140011ba8
mov rsi, rax
test rax, rax
je 0x1400133fd
mov edx, dword [rax]
lea rcx, str.ResourceList_Count__lx_r_n
call fcn.140002fc8
xor ebx, ebx
mov dword [rsp + 0x48], ebx
cmp ebx, dword [rsi]
jae 0x1400133e1
lea rax, [rbx + rbx*8]
lea r14, [rsi + rax*4]
mov r8d, dword [r14 + 0x10]
mov edx, ebx
lea rcx, str.pDesc__lu_.PartialResourceList.Count__lu_r_n
call fcn.140002fc8
xor edi, edi
mov dword [rsp + 0x44], edi
cmp edi, dword [r14 + 0x10]
jae 0x1400133da
lea r9, [rdi + rdi*4]
movzx ecx, byte [r14 + r9*4 + 0x14]
lea eax, [rcx - 3]
test al, 0xfb
je 0x140013364
movzx r9d, word [r14 + r9*4 + 0x16]
mov r8d, ecx
mov edx, edi
lea rcx, str._lu_Type_0x_04lX__Flags_0x_04lX_r_n
call fcn.140002fc8
jmp 0x1400133d3
mov edx, dword [r14 + r9*4 + 0x20]
mov qword [rsp + 0x50], rdx
movzx r8d, word [r14 + r9*4 + 0x16]
mov eax, r8d
and eax, 0xe00
cmp eax, 0x200
je 0x14001339d
cmp eax, 0x400
je 0x140013397
cmp eax, 0x800
jne 0x1400133a6
shl rdx, 0x20
jmp 0x1400133a1
shl rdx, 0x10
jmp 0x1400133a1
shl rdx, 8
mov qword [rsp + 0x50], rdx
mov r9, qword [r14 + r9*4 + 0x18]
mov rax, rdx
shr rax, 0x14
lea rcx, [r9 + rdx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov edx, edi
lea rcx, str._lu_Flags_0x_04lX_0x_016llX::0x_016llX__length_0x_016llX___llu_Mb__r_n
call fcn.140002fc8
inc edi
jmp 0x14001332c
inc ebx
jmp 0x140013304
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x140013414
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret