Function at 0x1400871d8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov r13, rdx
mov rsi, rcx
xor edi, edi
lea rdx, [0x140426250]
lea rcx, [0x14041221c]
mov qword [rbp - 0x31], rdi
mov r15, r9
mov r12, r8
call fcn.14006e060
lea rdx, [0x1404236f4]
mov dword [rbp - 0x29], edi
lea rcx, [0x140408e10]
mov qword [rbp - 0x39], rdi
call fcn.14006cf50
lea rcx, [rbp + 7]
call fcn.140071930
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x59], rdi
mov dword [rbp + 0x6f], edi
test r13, r13
jne 0x140087268
mov ecx, 0x80070057
mov ebx, ecx
call fcn.140075fa0
jmp 0x140087475
test r12, r12
jne 0x140087291
mov ecx, 0x80070057
mov ebx, ecx
call fcn.140075fa0
lea rdx, [0x1404296e8]
lea rcx, [0x1404098d0]
call fcn.14006d290
jmp 0x140087475
test r15, r15
je 0x140087257
mov rbx, qword [0x14042ae50]
lea rcx, [rbp - 0x31]
lea rdx, [rbx + 8]
call fcn.140083630
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140073e30
test rax, rax
je 0x1400872c4
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
jmp 0x1400872c7
mov rax, rdi
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400ab6fc
mov r14, qword [rbp - 0x49]
test r14, r14
jne 0x1400872e8
mov ebx, 0x8007000e
mov ecx, ebx
jmp 0x14008725e
mov rcx, r14
call qword [sym.imp.RPCRT4.dll_UuidCreate]
mov ecx, eax
lea rdx, [rbp + 0x6f]
call fcn.140075530
test eax, eax
jne 0x140087305
mov ebx, dword [rbp + 0x6f]
jmp 0x1400872e1
lea rax, [0x14001c380]
mov dword [rbp - 0x3d], 0x10000
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x41]
mov qword [rbp + 0x27], rsi
mov qword [rbp - 0x11], rax
xor r9d, r9d
lea rax, [rbp + 7]
mov qword [rbp + 0x2f], rbx
mov qword [rbp - 9], rax
mov ecx, 0xb9
lea rax, [rbp - 0x39]
mov qword [rbp - 0x21], 3
lea r8d, [r9 + 0x28]
mov qword [rbp - 1], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x41]
test ebx, ebx
jns 0x140087373
lea rdx, [0x140423b74]
lea rcx, [0x14040fc60]
call fcn.14006dce0
jmp 0x1400872e1
mov rbx, qword [rbp - 0x39]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rcx, rdi
call qword [0x1403b0a10]
lea r8, [rbp - 0x59]
mov rdx, r13
mov rcx, rbx
call rdi
xor edi, edi
mov ebx, eax
test eax, eax
jns 0x1400873a5
mov ecx, eax
jmp 0x14008725e
mov edx, 1
lea r9, [rbp - 0x3d]
lea rcx, [rbp - 0x51]
lea r8d, [rdx + 3]
call fcn.14008f6f0
mov ebx, eax
test eax, eax
js 0x14008739e
mov edx, 2
lea rcx, [rbp - 0x51]
mov r9, r14
lea r8d, [rdx + 0xe]
call fcn.14008f6f0
mov ebx, eax
test eax, eax
js 0x14008739e
mov rcx, qword [rbp - 0x59]
lea rdx, [rbp + 0x6f]
mov r8d, 0x7fffffff
call fcn.140070204
mov ebx, eax
test eax, eax
js 0x14008739e
mov r9, qword [rbp - 0x59]
lea rcx, [rbp - 0x51]
mov r8d, dword [rbp + 0x6f]
mov edx, 3
call fcn.14008f6f0
mov ebx, eax
test eax, eax
js 0x14008739e
mov r8, r12
lea rcx, [rbp - 0x51]
mov rdx, r15
call fcn.14008efe0
mov ebx, eax
test eax, eax
js 0x14008739e
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14008743c
call fcn.140121390
mov qword [rsi + 0x30], rdi
mov rcx, qword [rsi + 0x38]
mov qword [rbp - 0x49], rdi
mov qword [rsi + 0x30], r14
test rcx, rcx
je 0x140087469
call fcn.14006ff44
lea rdx, [0x140424f70]
mov qword [rsi + 0x38], rdi
lea rcx, [0x14040a464]
call fcn.14006e3c0
mov rax, qword [rbp - 0x59]
mov qword [rsi + 0x38], rax
mov qword [rbp - 0x59], rdi
mov ecx, ebx
call fcn.140083bac
lea rcx, [rbp - 0x59]
call fcn.140072490
lea rcx, [rbp - 0x49]
call fcn.1400724b0
lea rcx, [rbp - 0x51]
call fcn.1400aa1ac
lea rcx, [rbp + 7]
call fcn.140072a28
lea rcx, [rbp - 0x39]
call fcn.140072510
lea rcx, [rbp - 0x31]
call fcn.140072004
lea r11, [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret