Function at 0x14000b9d8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r12, r8
mov rsi, rcx
and dword [rax + 0x18], r13d
mov r15d, 0xc0000001
test r8, r8
je 0x14000ba12
mov rbp, r8
jmp 0x14000bb0c
xor edx, edx
lea r9, [rsp + 0x90]
xor r8d, r8d
lea ebx, [rdx + 0xb]
mov ecx, ebx
call fcn.14000f104
mov ecx, dword [rsp + 0x90]
test ecx, ecx
jne 0x14000ba67
lea rcx, [0x14001dfe0]
mov r8d, 0x18f
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
lea r9, [0x14001e0a0]
lea rdx, [0x14001df10]
mov ecx, 7
call fcn.14000944c
jmp 0x14000bbca
mov rdx, rcx
mov r8d, 0x414e4d5a
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbp, rax
test rax, rax
jne 0x14000ba9c
lea rax, [0x14001e030]
mov r8d, 0x197
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc000009a
jmp 0x14000ba4a
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.1400010a0
mov r8d, dword [rsp + 0x90]
lea r9, [rsp + 0x90]
mov rdx, rbp
mov ecx, ebx
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r15d, eax
test eax, eax
jns 0x14000bb04
lea rax, [0x14001e0c0]
lea r9, [0x14001e0a0]
lea rdx, [0x14001df10]
mov qword [rsp + 0x28], rax
mov r8d, 0x1a1
mov ecx, 7
mov dword [rsp + 0x20], r15d
call fcn.14000944c
jmp 0x14000bbbc
mov rdx, qword [rsp + 0x88]
xor r14d, r14d
cmp dword [rbp], r13d
jbe 0x14000bb88
mov qword [rsp + 0x38], rdx
mov eax, r14d
lea rdi, [rbp + 8]
lea r9, [0x14001e0a0]
lea rdx, [0x14001df10]
mov r8d, 0x1ae
imul rcx, rax, 0x128
add rdi, rcx
lea rax, [0x14001e100]
mov ecx, 1
lea rbx, [rdi + 0x28]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r13
call fcn.14000944c
mov rdx, qword [rsp + 0x88]
mov rcx, rbx
call fcn.140005460
test eax, eax
jne 0x14000bbe5
mov rdx, qword [rsp + 0x88]
inc r14d
cmp r14d, dword [rbp]
jb 0x14000bb15
lea rax, [0x14001e130]
lea r9, [0x14001e0a0]
lea rdx, [0x14001df10]
mov qword [rsp + 0x28], rax
mov r8d, 0x1b9
mov ecx, 7
mov dword [rsp + 0x20], r15d
call fcn.14000944c
test r12, r12
jne 0x14000bbca
mov edx, 0x414e4d5a
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, r13d
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rax, [rdi + 0x28]
lea r9, [0x14001e0a0]
lea rdx, [0x14001df10]
mov qword [rsp + 0x30], rax
lea rax, [0x14001e110]
mov r8d, 0x1b2
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r13
mov r13d, 1
mov ecx, r13d
call fcn.14000944c
lea eax, [r13 + 1]
lea ecx, [rax + 0x7e]
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rdi + 0x30]
movups xmmword [rsi + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x40]
movups xmmword [rsi + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x50]
movups xmmword [rsi + 0x50], xmm1
movups xmm0, xmmword [rdi + 0x60]
movups xmmword [rsi + 0x60], xmm0
movups xmm1, xmmword [rdi + 0x70]
add rsi, rcx
add rdi, rcx
movups xmmword [rsi - 0x10], xmm1
dec rax
jne 0x14000bc28
movups xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov rax, qword [rdi + 0x20]
mov qword [rsi + 0x20], rax
jmp 0x14000bbb7