Function at 0x140003c54
Capabilities:
Get system information on windows

Disassembly:
test rcx, rcx
je 0x14000448a
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x150
mov rax, qword [0x14001a0e8]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [rcx + 0x74]
xor r13d, r13d
mov edi, r8d
mov ebp, edx
mov rbx, rcx
test eax, eax
je 0x140003ca0
lea r14, [rcx + rax]
cmp eax, dword [rcx]
jb 0x140003ca3
mov r14, r13
mov eax, dword [rcx + 0x70]
test eax, eax
je 0x140003cb2
lea r15, [rcx + rax]
cmp eax, dword [rcx]
jb 0x140003cb5
mov r15, r13
test r9d, r9d
je 0x140003cec
mov edx, edi
lea rcx, str.Operation_Status:________uL_t
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov ecx, edi
call fcn.140003200
mov rdx, rax
lea rcx, str._ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp edi, 5
je 0x140004460
lea rax, [0x14000f88c]
test r14, r14
mov rdx, r14
lea rcx, [0x14000f890]
cmove rdx, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rdx, str.GlobalLogger
mov rcx, r14
lea rsi, [rbx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140003d5c
cmp qword [rsi], r13
jne 0x140003d5c
test ebp, ebp
lea rax, str.Registry_set_to_start
lea rdx, str.Registry_set_to_stop
mov r12b, 1
cmovne rdx, rax
lea rcx, str.Status:__________________ls_n
jmp 0x140003d88
mov r12b, r13b
test edi, edi
jne 0x140004460
mov rdx, qword [rsi]
lea rcx, str.Logger_Id:______________0x_I64x_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rdx, qword [rbx + 0x68]
lea rcx, str.Logger_Thread_Id:________p_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea r8, [rbx + 0x18]
mov edx, 0x80
lea rcx, [rsp + 0x40]
call fcn.14000183c
lea rdx, [rsp + 0x40]
lea rcx, str.Guid:____________________ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov ecx, dword [rsi]
call fcn.1400039c8
mov edx, dword [rbx + 0x30]
test edx, edx
jne 0x140003de2
lea rcx, str.Buffer_Size:____________default_value_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140003df5
lea rcx, str.Buffer_Size:_____________d_Kb_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x38]
test edx, edx
jne 0x140003e11
lea rcx, str.Maximum_Buffers:________default_value_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140003e24
lea rcx, str.Maximum_Buffers:_________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x34]
test edx, edx
jne 0x140003e40
lea rcx, str.Minimum_Buffers:________default_value_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140003e53
lea rcx, str.Minimum_Buffers:_________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test r12b, r12b
jne 0x140003ef6
mov edx, dword [rbx + 0x50]
lea rcx, str.Number_of_Buffers:_______d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x54]
lea rcx, str.Free_Buffers:____________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x5c]
lea rcx, str.Buffers_Written:_________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x58]
lea rcx, str.Events_Lost:_____________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x60]
lea rcx, str.Log_Buffers_Lost:________d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x64]
lea rcx, str.Real_Time_Buffers_Lost:__d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 4]
lea rcx, str.Real_Time_Consumers:_____d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rbx + 0x28], 1
jne 0x140003f05
lea rcx, str.ClockType:______________PerfCounter_n
jmp 0x140003f28
cmp dword [rbx + 0x28], 2
jne 0x140003f14
lea rcx, str.ClockType:______________SystemTime_n
jmp 0x140003f28
cmp dword [rbx + 0x28], 3
lea rcx, str.ClockType_______________CPU_Cycle_n
je 0x140003f28
lea rcx, str.ClockType:______________Unknown_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.Log_Mode:
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test al, 0x40
je 0x140003f64
lea rcx, str.Nonstoppable
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0x18
jae 0x140003f80
lea rcx, str.Paged
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test al, al
jns 0x140003f9a
lea rcx, str.Secure
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0x19
jae 0x140003fb6
lea rcx, str.System
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0xb
jae 0x140003fd2
lea rcx, str.UserMode
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test eax, eax
jns 0x140003fec
lea rcx, str.AddToTriageDump
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0x13
jae 0x140004008
lea rcx, str.Kd_Filter
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0x1b
jae 0x140004024
lea rcx, str.Independent
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
mov ebp, 0x100
bt eax, 0xa
jae 0x14000403b
lea rcx, str.Buffering_only
jmp 0x1400040e0
test al, 4
je 0x140004055
lea rcx, str.Append
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test al, 0x20
je 0x14000406f
lea rcx, str.Pre_allocate
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 9
jae 0x14000408b
lea rcx, str.DelayOpen
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test al, 2
je 0x140004098
lea rcx, str.Circular
jmp 0x1400040aa
lea rcx, str.NewFile
test al, 8
jne 0x1400040aa
lea rcx, str.Sequential
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
bt eax, 0x12
jae 0x1400040d5
lea rcx, str.Buffer_Interface
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x40]
test ebp, eax
je 0x1400040ec
lea rcx, str.Realtime
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, [0x14000f488]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test dword [rbx + 0x40], 0x10000000
je 0x14000411b
lea rcx, str.No_per_processor_buffering_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp byte [0x14001a6bc], r13b
je 0x140004159
test dword [rbx + 0x40], 0xc00000
je 0x140004159
test dword [rbx + 0x40], 0x400000
lea rax, str.Stop
lea rdx, str.Persist
cmovne rdx, rax
lea rcx, str.Hybrid_Shutdown:_________ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x3c]
mov edi, 0x2000
test edx, edx
je 0x140004186
lea rcx, str.Maximum_File_Size:_______d_Kb_n
test dword [rbx + 0x40], edi
jne 0x140004178
lea rcx, str.Maximum_File_Size:_______d_Mb_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140004199
lea rcx, str.Maximum_File_Size:______not_set_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x44]
test edx, edx
je 0x1400041cf
mov eax, dword [rbx + 0x40]
lea r8, str.secs
shr eax, 4
lea rcx, str.Buffer_Flush_Timer:______d__ls_n
test al, 1
lea rax, [0x140010204]
cmovne r8, rax
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400041e2
lea rcx, str.Buffer_Flush_Timer:_____not_set_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov edx, dword [rbx + 0x40]
mov ecx, dword [rsi]
call fcn.1400036e8
test al, al
jne 0x140004361
cmp dword [rbx + 0x48], r13d
je 0x140004361
lea rcx, str.Enabled_tracing:
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test r14, r14
je 0x140004338
lea rdx, str.NT_Kernel_Logger
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140004244
lea rdx, str.Circular_Kernel_Context_Logger
mov rcx, r14
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140004338
mov eax, dword [rbx + 0x48]
test al, 1
je 0x140004261
lea rcx, str.Process
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
test al, 2
je 0x14000427b
lea rcx, str.Thread
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
test ebp, eax
je 0x140004295
lea rcx, str.Disk
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
bt eax, 9
jae 0x1400042b1
lea rcx, str.File
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
bt eax, 0xc
jae 0x1400042cd
lea rcx, str.PageFaults
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
test edi, eax
je 0x1400042e7
lea rcx, str.HardFaults
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
test al, 4
je 0x140004301
lea rcx, str.ImageLoad
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
bt eax, 0x10
jae 0x14000431d
lea rcx, str.TcpIp
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov eax, dword [rbx + 0x48]
bt eax, 0x11
jae 0x14000434e
lea rcx, str.Registry
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x14000434e
mov edx, dword [rbx + 0x48]
lea rcx, str.0x_08x
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, [0x14000f488]
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov ecx, dword [rsi]
call fcn.140003ad8
test r12b, r12b
je 0x1400043ad
test r15, r15
je 0x140004385
or rax, 0xffffffffffffffff
inc rax
cmp word [r15 + rax*2], r13w
jne 0x140004376
test rax, rax
jne 0x1400043ad
lea rcx, str.Log_Filename:___________default_location_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
lea rcx, str.__________________________SystemRoot__System32LogFilesWMI_trace.log_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x1400043c8
test r15, r15
je 0x1400043c8
mov rdx, r15
lea rcx, str.Log_Filename:____________ls_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
test dword [rbx + 0x40], 0x8000
je 0x1400043da
lea rcx, str.Local_Sequence_numbers_in_use_n
jmp 0x1400043ea
test dword [rbx + 0x40], 0x4000
je 0x1400043f6
lea rcx, str.Global_Sequence_numbers_in_use_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
mov rax, qword [rsi]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], 0x12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea r8d, [r9 + 0x18]
lea ecx, [r9 + 0x1f]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
movzx edx, byte [rsp + 0x30]
mov r8d, r13d
test eax, eax
cmovns r8d, edx
test r8b, r8b
je 0x14000444e
lea rcx, str.SoftReboot_Preserve:____Yes_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
cmp dword [rsp + 0x1b0], r13d
je 0x140004460
mov rcx, qword [rsi]
call fcn.140003578
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14000ae40
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x150
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret