Function at 0x1401b3d70
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xd8
mov rax, qword [0x140436b28]
xor rax, rsp
mov qword [rbp - 1], rax
mov rax, qword [rbp + 0x7f]
lea rbx, str.RuleSetData
xor r14d, r14d
mov qword [rbp - 0x51], rax
mov rax, qword gs:[0x58]
or rsi, 0xffffffffffffffff
mov qword [rbp - 0x29], rdx
mov r13, rcx
mov edx, 4
mov r15, r9
mov r12, r8
mov qword [rbp - 0x79], r14
mov rcx, qword [rax]
lea edi, [rsi + 2]
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], r14
mov eax, dword [rdx + rcx]
cmp dword [0x140440b80], eax
jg 0x1401b4174
mov rax, qword [r15]
mov rbx, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r9, [rbp - 0x61]
lea r8, [rbp - 0x59]
mov rcx, r15
lea rdx, str.RuleSetData
call rax
mov ebx, eax
test eax, eax
js 0x1401b40b9
mov r14, qword [r13 + 0x18]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
mov rax, qword [0x1403c1610]
cmp dword [rbp - 0x61], edi
jne 0x1401b3f15
xor edi, edi
cmp dword [0x140440d60], 1
cmove rdi, qword [0x140440258]
call rax
lea r8, [rbp - 0x79]
mov rdx, rdi
mov rcx, r14
mov rax, rbx
call rax
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x1401b40b9
mov rax, qword [rbp - 0x79]
lea r8, [rbp - 0x71]
mov qword [rsp + 0x30], r8
lea r9, [0x140440b90]
mov qword [rsp + 0x28], rax
mov r8, r15
mov rdx, r12
mov dword [rsp + 0x20], SafeArrayGetDim
mov rcx, r13
call fcn.1401b519c
mov ebx, eax
test eax, eax
js 0x1401b40b9
lea r8, [rsp + 0x40]
lea rdx, str.productSkuId
lea rcx, [rbp - 0x71]
call fcn.1400ba40c
test al, al
je 0x1401b408a
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rbp - 0x69]
mov rcx, qword [rax + 8]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1401b3edb
mov r15d, 0x80070057
cmp rax, 0x26
jne 0x1401b3f2b
cmp word [rcx], 0x7b
jne 0x1401b3f31
cmp word [rcx + 0x4a], 0x7d
jne 0x1401b3f31
add rcx, 2
lea rdx, [rbp - 0x11]
call fcn.14006f11c
mov ebx, eax
test eax, eax
jns 0x1401b3f3c
mov ecx, eax
jmp 0x1401b3f37
xor edi, edi
cmp dword [0x140440d60], 1
cmove rdi, qword [0x140440250]
jmp 0x1401b3e53
cmp rax, 0x24
je 0x1401b3f02
mov ebx, r15d
mov ecx, r15d
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
jns 0x1401b3f4e
mov ecx, ebx
jmp 0x1401b40bb
lea r8, [rsp + 0x40]
lea rdx, str.applicationId
lea rcx, [rbp - 0x71]
call fcn.1400ba40c
test al, al
je 0x1401b3ff2
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rbp - 0x69]
mov rcx, qword [rax + 8]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1401b3f7f
cmp rax, 0x26
jne 0x1401b3fb3
cmp word [rcx], 0x7b
jne 0x1401b3fb9
cmp word [rcx + 0x4a], 0x7d
jne 0x1401b3fb9
add rcx, 2
lea rdx, [rbp - 0x21]
call fcn.14006f11c
mov ebx, eax
test eax, eax
jns 0x1401b3fc4
mov ecx, eax
jmp 0x1401b3fbf
cmp rax, 0x24
je 0x1401b3fa0
mov ebx, r15d
mov ecx, r15d
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
js 0x1401b3f47
mov rdi, qword [rbp - 0x51]
lea r8, [rbp - 0x11]
mov rcx, rdi
lea rdx, [rbp - 0x21]
call fcn.14017d390
mov ebx, eax
test eax, eax
jns 0x1401b3ff6
jmp 0x1401b40b9
mov rdi, qword [rbp - 0x51]
lea r8, [rsp + 0x40]
lea rdx, str.licenseId
lea rcx, [rbp - 0x71]
call fcn.1400ba40c
test al, al
je 0x1401b408a
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rbp - 0x69]
mov rcx, qword [rax + 8]
inc rsi
cmp word [rcx + rsi*2], r14w
jne 0x1401b4020
cmp rsi, 0x26
jne 0x1401b4054
cmp word [rcx], 0x7b
jne 0x1401b405a
cmp word [rcx + 0x4a], 0x7d
jne 0x1401b405a
add rcx, 2
lea rdx, [rbp - 0x21]
call fcn.14006f11c
mov ebx, eax
test eax, eax
jns 0x1401b4065
mov ecx, eax
jmp 0x1401b4060
cmp rsi, 0x24
je 0x1401b4041
mov ebx, r15d
mov ecx, r15d
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
js 0x1401b3f47
lea r8, [rbp - 0x11]
mov rcx, rdi
lea rdx, [rbp - 0x21]
call fcn.1401b54a0
mov ebx, eax
test eax, eax
js 0x1401b40b9
mov rdi, qword [rbp - 0x29]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x79]
mov rax, rbx
xor r8d, r8d
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
jns 0x1401b40c0
mov ecx, eax
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
mov esi, 3
mov qword [rbp - 0x39], r14
lea rax, [0x140021a18]
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
lea rax, [rbp - 0x71]
mov r15d, 0xb9
lea r12d, [rsi + 0x1d]
mov qword [rbp - 0x31], rax
mov r8d, r12d
xor r9d, r9d
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
mov rdi, qword [rbp - 0x59]
test rdi, rdi
je 0x1401b4124
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x59], r14
lea rax, [0x14001aed8]
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x49]
lea rax, [rbp - 0x79]
mov qword [rbp - 0x39], r14
xor r9d, r9d
mov qword [rbp - 0x31], rax
mov r8, r12
mov rcx, r15
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14037a9a0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x140440b80]
call fcn.14037adcc
cmp dword [0x140440b80], esi
jne 0x1401b3ded
xorps xmm0, xmm0
mov qword [0x140440b98], r14
lea rax, str.metaInfoType
mov dword [0x140440ba0], r14d
mov qword [0x140440b90], rax
xor eax, eax
mov qword [0x140440bb8], rax
lea rax, str.licenseId
movups xmmword [0x140440ba8], xmm0
mov qword [0x140440ba8], rax
lea rax, str.licId
mov qword [0x140440bb0], rax
xor eax, eax
mov qword [0x140440bd0], rax
lea rax, str.licenseType
movups xmmword [0x140440bc0], xmm0
mov qword [0x140440bc0], rax
lea rax, [0x1403e571c]
mov qword [0x140440bc8], rax
xor eax, eax
mov qword [0x140440be8], rax
lea rax, str.licenseCategory
movups xmmword [0x140440bd8], xmm0
mov qword [0x140440bd8], rax
lea rax, str.licCat
mov qword [0x140440be0], rax
xor eax, eax
mov qword [0x140440c00], rax
lea rax, str.fileId
movups xmmword [0x140440bf0], xmm0
mov qword [0x140440bf0], rax
xor eax, eax
mov qword [0x140440c18], rax
lea rax, str.applicationId
movups xmmword [0x140440c08], xmm0
mov qword [0x140440c08], rax
lea rax, [0x1403dc32c]
mov qword [0x140440c10], rax
xor eax, eax
mov qword [0x140440c30], rax
lea rax, str.productSkuId
movups xmmword [0x140440c20], xmm0
mov qword [0x140440c20], rax
lea rax, str.skuId
mov qword [0x140440c28], rax
xor eax, eax
mov qword [0x140440c48], rax
lea rax, [0x1403e56f4]
movups xmmword [0x140440c38], xmm0
mov qword [0x140440c40], rax
xor eax, eax
mov qword [0x140440c60], rax
lea rax, str.phone:policy
movups xmmword [0x140440c50], xmm0
mov qword [0x140440c50], rax
lea rax, str.phnPol
mov qword [0x140440c58], rax
xor eax, eax
mov qword [0x140440c78], rax
lea rax, str.stilComment
movups xmmword [0x140440c68], xmm0
mov qword [0x140440c68], rax
mov dword [0x140440ba4], esi
mov dword [0x140440bb8], edi
mov dword [0x140440bbc], edi
mov dword [0x140440bd0], r14d
mov dword [0x140440bd4], edi
mov dword [0x140440be8], r14d
mov dword [0x140440bec], edi
mov qword [0x140440bf8], r14
mov dword [0x140440c00], r14d
mov dword [0x140440c04], edi
mov dword [0x140440c18], edi
mov dword [0x140440c1c], edi
mov dword [0x140440c30], edi
mov dword [0x140440c34], edi
mov qword [0x140440c38], rbx
mov dword [0x140440c48], r14d
mov dword [0x140440c4c], 0x24
mov dword [0x140440c60], r14d
mov dword [0x140440c64], 0x24
xor eax, eax
mov qword [0x140440c70], r14
mov qword [0x140440c90], rax
lea rcx, [0x140440b80]
movups xmmword [0x140440c80], xmm0
lea rax, str.stilComment2
mov dword [0x140440c78], r14d
mov qword [0x140440c80], rax
xor eax, eax
mov qword [0x140440ca8], rax
lea rax, str.stilToken
movups xmmword [0x140440c98], xmm0
mov qword [0x140440c98], rax
mov dword [0x140440c7c], 0x20
mov qword [0x140440c88], r14
mov dword [0x140440c90], r14d
mov dword [0x140440c94], 0x20
mov qword [0x140440ca0], r14
mov dword [0x140440ca8], r14d
mov dword [0x140440cac], 0x20
call fcn.14037ad5c
jmp 0x1401b3ded