Function at 0x1000a0db8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x1000a0e17
bt dword [rcx + 0x1c], 9
jae 0x1000a0e17
cmp byte [rcx + 0x19], 4
jb 0x1000a0e17
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0xf
call fcn.10001c854
xor ebp, ebp
mov dword [rsp + 0x20], ebp
cmp rsi, rbp
jne 0x1000a0e3a
lea r8, [0x10000a268]
lea rcx, [0x10000a238]
mov edx, 0xbd
call fcn.10009a050
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
mov qword [rsi], rbp
call sub.msvcrt.dll_memset
xor edx, edx
lea r9, [rsp + 0x20]
lea ecx, [rdx + 0x62]
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebp
mov ebx, eax
jge 0x1000a0ec2
cmp eax, 0xc0000023
je 0x1000a0ec2
cmp eax, 0x80000005
je 0x1000a0ec2
cmp eax, 0xc0000004
je 0x1000a0ec2
bts ebx, 0x1c
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000a1056
test byte [rcx + 0x1c], 8
je 0x1000a102f
cmp byte [rcx + 0x19], 2
jb 0x1000a102f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x10
mov r9d, ebx
call fcn.10001c878
jmp 0x1000a1028
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
cmp rax, rbp
jne 0x1000a0ede
mov ebx, 0x8007000e
jmp 0x1000a1013
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rdi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebp
mov ebx, eax
jge 0x1000a0f50
bts ebx, 0x1c
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000a101a
test byte [rcx + 0x1c], 8
je 0x1000a101a
cmp byte [rcx + 0x19], 2
jb 0x1000a101a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x11
mov r9d, ebx
call fcn.10001c878
jmp 0x1000a1013
movzx ecx, word [rdi]
lea rax, [rcx + 2]
cmp rax, 0x208
jbe 0x1000a0f69
mov ebx, 0xd0000023
jmp 0x1000a1013
test cl, 1
je 0x1000a0f86
lea r8, [0x10000a280]
lea rcx, [0x10000a238]
mov edx, 0xee
call fcn.10009a050
movzx ecx, word [rdi]
lea eax, [rcx + 8]
cmp eax, dword [rsp + 0x20]
jbe 0x1000a0f99
mov ebx, 0x8000ffff
jmp 0x1000a1013
shr rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x1000a0fb1
mov ebx, 0x80070057
mov word [rsp + 0x30], bp
jmp 0x1000a0ffd
mov r9, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rax, [rsp + 0x30]
mov ebx, ebp
sub r9, r8
cmp rcx, rbp
je 0x1000a0fec
movzx r8d, word [r9 + rax]
cmp r8w, bp
je 0x1000a0fec
dec rdx
mov word [rax], r8w
dec rcx
add rax, 2
cmp rdx, rbp
jne 0x1000a0fc9
cmp rdx, rbp
jne 0x1000a0ffa
sub rax, 2
mov ebx, 0x8007007a
mov word [rax], bp
cmp ebx, ebp
jl 0x1000a1013
lea rcx, [rsp + 0x30]
xor r8d, r8d
mov rdx, rsi
call fcn.10009bac4
mov ebx, eax
mov rcx, qword [0x1001653b8]
cmp rdi, rbp
je 0x1000a102f
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x1000a1056
bt dword [rcx + 0x1c], 9
jae 0x1000a1056
cmp byte [rcx + 0x19], 4
jb 0x1000a1056
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000039a8]
mov edx, 0x12
call fcn.10001c854
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret