Function at 0x1400137a4
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x20
and dword [rbp + 0x28], 0
lea rdi, [rbp + 0x20]
xor eax, eax
lea r9, [rbp + 0x28]
lea rdx, [rbp + 0x20]
lea r8d, [rax + 4]
mov ecx, r8d
rep stosb byte [rdi], al
mov ecx, 0xc4
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400138a1
lea rcx, str._t___SystemKernelVaShadowInformation_r_n
call fcn.140003224
mov dl, byte [rbp + 0x20]
lea rcx, str.KvaShadowEnabled
mov ebx, 1
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowUserGlobal
shr edx, 1
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowPcid
shr edx, 2
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowInvpcid
shr edx, 3
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowRequired
shr edx, 4
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.KvaShadowRequiredAvailable
shr edx, 5
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str._tInvalidPteBit__lu_r_n
shr edx, 6
and edx, 0x3f
call fcn.140003224
mov edx, dword [rbp + 0x20]
lea rcx, str.L1DataCacheFlushSupported
shr edx, 0xc
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x20]
lea rcx, str.L1TerminalFaultMitigationPresent
shr edx, 0xd
and dl, bl
call fcn.14001374c
jmp 0x1400138b7
mov ebx, 1
lea rdx, str.Cannot_query_kernel_va_shadow_information__NTSTATUS__0x_lX__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400103f0
xor eax, eax
mov dword [rbp + 0x28], 8
lea rdi, [rbp + 0x30]
lea r9, [rbp + 0x28]
lea rdx, [rbp + 0x30]
lea ecx, [rax + 8]
rep stosb byte [rdi], al
mov ecx, 0xc9
lea r8d, [rax + 8]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea edx, [rax + 0x3ffffffe]
cmp edx, ebx
jbe 0x140013bf0
test eax, eax
je 0x1400138fe
lea rdx, str.Cannot_query_speculation_control_information__NTSTATUS__0x_lX__r_n
jmp 0x140013bf7
mov r8d, dword [rbp + 0x28]
lea eax, [r8 - 4]
test eax, 0xfffffffb
je 0x14001391b
lea rdx, str.Unknown_speculation_control_information_size__lu_r_n
mov ecx, ebx
call fcn.1400103f0
lea rcx, str._t___SystemSpeculationControlInformation_r_n
call fcn.140003224
mov dl, byte [rbp + 0x30]
lea rcx, str.BpbEnabled
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledSystemPolicy
shr edx, 1
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledNoHardwareSupport
shr edx, 2
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlEnumerated
shr edx, 3
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCmdEnumerated
shr edx, 4
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.IbrsPresent
shr edx, 5
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.StibpPresent
shr edx, 6
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SmepPresent
shr edx, 7
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableAvailable
shr edx, 8
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableSupported
shr edx, 9
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisabledSystemWide
shr edx, 0xa
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisabledKernel
shr edx, 0xb
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpeculativeStoreBypassDisableRequired
shr edx, 0xc
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.BpbDisabledKernelToUser
shr edx, 0xd
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlRetpolineEnabled
shr edx, 0xe
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.SpecCtrlImportOptimizationEnabled
shr edx, 0xf
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.EnhancedIbrs
shr edx, 0x10
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfStatusAvailable
shr edx, 0x11
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfProcessorNotAffected
shr edx, 0x12
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationEnabled
shr edx, 0x13
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_Hardware
shr edx, 0x14
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_LoadOption
shr edx, 0x15
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.HvL1tfMigitationNotEnabled_CoreScheduler
shr edx, 0x16
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.EnhancedIbrsReported
shr edx, 0x17
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.MdsHardwareProtected
shr edx, 0x18
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.MbClearEnabled
shr edx, 0x19
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.MbClearReported
shr edx, 0x1a
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str._t_tTsxCtrlStatus__lu_r_n
shr edx, 0x1b
and edx, 3
call fcn.140003224
mov edx, dword [rbp + 0x30]
lea rcx, str.TsxCtrlReported
shr edx, 0x1d
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x30]
lea rcx, str.TaaHardwareImmune
shr edx, 0x1e
and dl, bl
call fcn.14001374c
cmp dword [rbp + 0x28], 8
jne 0x140013c01
lea rcx, str._t___SystemSpeculationControlInformation_v2_r_n
call fcn.140003224
mov dl, byte [rbp + 0x34]
lea rcx, str.SbdrSsdpHardwareProtected
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x34]
lea rcx, str.FbsdpHardwareProtected
shr edx, 1
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x34]
lea rcx, str.PsdpHardwareProtected
shr edx, 2
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x34]
lea rcx, str.FbClearEnabled
shr edx, 3
and dl, bl
call fcn.14001374c
mov edx, dword [rbp + 0x34]
lea rcx, str.FbClearReported
shr edx, 4
and dl, bl
call fcn.14001374c
jmp 0x140013c01
lea rdx, str.Speculation_control_information_class_not_present__NTSTATUS__0x_lX__r_n
mov r8d, eax
mov ecx, ebx
call fcn.1400103f0
add rsp, 0x20
pop rdi
pop rbx
pop rbp
ret