Function at 0x14005de50
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xa8
xor ebx, ebx
mov r13, rdx
mov qword [rbp - 0x59], rbx
mov r12d, ebx
mov qword [rbp + 0x57], rbx
mov r14d, ebx
mov qword [rbp - 0x61], rbx
mov r15d, ebx
mov qword [rbp - 0x69], rbx
test rdx, rdx
jne 0x14005deaa
mov ecx, 0x80070057
mov esi, ecx
call fcn.1400790f8
jmp 0x14005e20c
test r8d, r8d
je 0x14005de99
test r9, r9
je 0x14005de99
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x14005de99
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x14005de99
lea rdx, [0x140002b78]
mov qword [rbp - 0x15], r9
mov qword [rbp - 0x29], rdx
xor r9d, r9d
lea rdx, [rbp + 0x5f]
mov dword [rbp - 0x19], r8d
mov qword [rbp - 0x21], rdx
lea rdx, [rbp - 0x31]
mov qword [rbp - 9], rcx
mov ecx, 0xb9
lea r8d, [r9 + 0x30]
mov qword [rbp - 0x31], 3
mov dword [rbp - 0xd], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x5f]
cmp esi, 0x8007000d
jne 0x14005df15
mov esi, 0xc004f307
jmp 0x14005df19
test esi, esi
jns 0x14005df1d
mov ecx, esi
jmp 0x14005dea0
mov rsi, qword [0x14042eaf0]
lea rcx, [0x14042eab0]
call fcn.140052ac8
mov rbx, rax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403af620]
lea rax, [rbp - 0x61]
mov rdx, rbx
lea r9, [0x1403b8af0]
mov qword [rsp + 0x20], rax
lea r8, str.msft:rm_algorithm_volume_1.0
mov rcx, rsi
call rdi
mov esi, eax
test eax, eax
jns 0x14005df6f
mov ecx, eax
jmp 0x14005dea0
mov rdi, qword [0x14042eaf0]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [0x1403af620]
lea rax, [rbp - 0x69]
xor r9d, r9d
lea r8, [0x1403b8d10]
mov qword [rsp + 0x20], rax
lea rdx, str.msft:spp_stockobjects_plugins_params_named
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005df68
lea rdx, [rbp + 0x57]
mov rcx, r13
call fcn.140051f90
mov esi, eax
test eax, eax
jns 0x14005dfc9
mov ecx, eax
call fcn.1400790f8
jmp 0x14005e208
mov rax, qword [0x14042eab0]
test rax, rax
je 0x14005e1e9
lea r12, [rax + 8]
test r12, r12
je 0x14005dfed
mov rcx, r12
call fcn.14006ec14
test r12, r12
mov r15, qword [rbp + 0x57]
lea r9, [rbp - 0x59]
mov rdx, r15
lea r8, str.applicationId
setne r14b
call fcn.1400d0dd4
mov esi, eax
test eax, eax
js 0x14005df68
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:GVLK
call fcn.1400e7038
test eax, eax
jns 0x14005e033
mov ecx, 0xc004f306
jmp 0x14005de9e
cmp dword [rbp + 0x57], 0
jne 0x14005e056
lea r8, [rbp + 0x57]
mov rcx, r15
lea rdx, str.Volume:CSVLK
call fcn.1400e7038
test eax, eax
js 0x14005e029
cmp dword [rbp + 0x57], 0
je 0x14005e029
mov rax, qword [rbp - 0x59]
lea rcx, str.SppBindingAppId
mov rbx, qword [rbp - 0x69]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x51], rcx
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403af620]
mov r13d, 1
lea rdx, [rbp - 0x51]
mov r8d, r13d
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005df68
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingSkuId
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x49], 2
mov qword [rbp - 0x41], r15
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403af620]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005df68
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationType
mov qword [rbp - 0x51], rax
lea rax, str.Token
mov qword [rbp - 0x41], rax
mov dword [rbp - 0x49], 2
mov rax, qword [rbx]
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403af620]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
js 0x14005df68
mov rbx, qword [rbp - 0x69]
lea rax, str.SppBindingActivationResponse
mov qword [rbp - 0x51], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x41], rax
mov eax, dword [rbp + 0x67]
mov dword [rbp - 0x39], eax
mov rax, qword [rbx]
mov dword [rbp - 0x49], 4
mov rdi, qword [rax + 0x48]
mov rcx, rdi
call qword [0x1403af620]
mov r8d, r13d
lea rdx, [rbp - 0x51]
mov rcx, rbx
call rdi
lea rdx, [0x14042a8b8]
mov esi, eax
lea rcx, [0x140403ffc]
call fcn.1400e977c
test esi, esi
js 0x14005df19
mov rdi, qword [0x14042eb40]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [0x1403af620]
mov rdx, qword [rbp - 0x59]
mov rcx, rdi
call rbx
mov esi, eax
test eax, eax
js 0x14005df68
mov rbx, qword [rbp - 0x61]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403af620]
mov rdx, qword [rbp - 0x69]
mov rcx, rbx
call rdi
lea rdx, [0x140428a4c]
mov esi, eax
lea rcx, [0x14041aa08]
call fcn.1400e9438
test esi, esi
jns 0x14005e20c
jmp 0x14005df19
mov esi, 0x8000ffff
mov ecx, esi
call fcn.1400790f8
lea rdx, [0x14042907c]
lea rcx, [0x14040b120]
call fcn.1400e90f0
mov r15, qword [rbp + 0x57]
mov ecx, esi
call fcn.140079118
mov rbx, qword [rbp - 0x69]
test rbx, rbx
je 0x14005e25c
lea rdx, [0x14042d170]
lea rcx, [0x14040ec78]
call fcn.1400e8db8
mov rax, qword [rbx]
lea rdx, [0x14042a2d0]
lea rcx, [0x14040fdb8]
mov rdi, qword [rax + 0x10]
call fcn.1400e9ac8
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rbx
call rdi
and qword [rbp - 0x69], 0
mov rbx, qword [rbp - 0x61]
test rbx, rbx
je 0x14005e27f
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403af620]
mov rcx, rbx
call rdi
and qword [rbp - 0x61], 0
test r15, r15
je 0x14005e28d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x59]
test rcx, rcx
je 0x14005e29c
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
je 0x14005e2ae
test r14d, r14d
je 0x14005e2ae
mov rcx, r12
call fcn.1400719a0
mov eax, esi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret