Function at 0x1400e5e18
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor ebx, ebx
lea rcx, str.AsrGetSystemVolumeDevPath
lea ebp, [rbx + 1]
call fcn.1400ed218
mov dword [rsp + 0x58], ebx
mov esi, ebx
test r14, r14
je 0x1400e6020
lea r9, [rsp + 0x58]
mov word [r14], bx
xor r8d, r8d
lea ecx, [rbx + 0x62]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x1400e5edc
cmp eax, 0xc0000023
je 0x1400e5edc
cmp eax, 0x80000005
je 0x1400e5edc
cmp eax, 0xc0000004
je 0x1400e5edc
mov ecx, eax
mov ebp, ebx
call fcn.1400ed2d4
mov ebx, eax
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e6064
test byte [rcx + 0x1c], 8
je 0x1400e6064
lea edx, [rsi + 0x18]
mov r9d, edi
lea rax, str.ntStatus
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013e518]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
jmp 0x1400e6064
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x1400e5f2d
lea r9d, [rax + 0xe]
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e6064
test byte [rcx + 0x1c], 8
je 0x1400e6064
lea edx, [rax + 0x19]
lea rax, str.pSysInfo
jmp 0x1400e604f
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
jns 0x1400e5fb4
mov ecx, eax
mov ebp, ebx
call fcn.1400ed2d4
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x1400e6064
test byte [rax + 0x1c], 8
je 0x1400e6064
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov rdx, rsi
mov ecx, 0x62
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov r9d, eax
mov edx, 0x1a
lea rax, str.NtQuerySystemInformation__SystemSystemPartitionInformation__pSysInfo__cbRequiredSize__cbRequiredSize_
mov rcx, qword [section..data]
jmp 0x1400e5ec2
movzx r9d, word [rsi]
mov edi, 0x104
mov r8, qword [rsi + 8]
mov edx, edi
shr r9, 1
mov rcx, r14
call fcn.14003c4e0
test eax, eax
jns 0x1400e6064
mov ecx, eax
mov ebp, ebx
call fcn.1400ed2a0
mov ebx, eax
mov rax, qword [section..data]
lea rdx, section..data
cmp rax, rdx
je 0x1400e6064
test byte [rax + 0x1c], 8
je 0x1400e6064
movzx r9d, word [rsi]
mov edx, edi
mov r8, qword [rsi + 8]
mov rcx, r14
shr r9, 1
call fcn.14003c4e0
mov r9d, eax
mov edx, 0x1b
lea rax, str.::StringCchCopyN__pwszVolume__cchVolume__pSysInfo__SystemPartition.Buffer___pSysInfo__SystemPartition.Length__sizeof_WCHAR___
jmp 0x1400e5fa8
mov r9d, 0x57
mov ebp, ebx
mov ebx, r9d
mov rcx, qword [section..data]
lea rdx, section..data
cmp rcx, rdx
je 0x1400e6064
test byte [rcx + 0x1c], 8
je 0x1400e6064
lea edx, [r9 - 0x41]
lea rax, str.pwszVolume
mov rcx, qword [rcx + 0x10]
lea r8, [0x14013e518]
mov qword [rsp + 0x20], rax
call fcn.1400d9dd4
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
lea rcx, str.AsrGetSystemVolumeDevPath
call fcn.1400ed25c
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret