Function at 0x14004c900
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140192040]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rbx, r8
mov rdi, rcx
mov qword [rsp + 0x58], rcx
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov dword [rsp + 0x30], 1
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14004c995
lea rdx, str.Failed_to_open_the_process.
lea rcx, [0x140451ee0]
call fcn.14000ac70
mov rcx, rax
call fcn.14000af20
jmp 0x14004cda5
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15, qword [rbp - 0x60]
mov qword [rsp + 0x38], r15
mov r13, qword [rbp - 0x58]
mov qword [rsp + 0x48], r13
mov rdx, rbx
lea rcx, [rbp]
call fcn.1400082a0
nop
lea rsi, [rbp]
mov r8, qword [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rsi, r8
lea rcx, [rbp]
cmova rcx, r8
mov r14, qword [rbp + 0x10]
add r14, rcx
lea rbx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rbx, r8
cmp rbx, r14
je 0x14004ca06
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.1400cffdc
mov byte [rbx + rsi], al
inc rbx
cmp rbx, r14
jne 0x14004c9f3
cmp r15, r13
jae 0x14004cd63
movabs r14, 0x7fffffffffffffff
nop dword [rax]
mov r9d, 0x30
lea r8, [rsp + 0x68]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14004cd63
cmp dword [rbp - 0x78], 0x1000
jne 0x14004cd51
mov eax, dword [rbp - 0x74]
cmp eax, 1
je 0x14004cd51
cmp eax, 0x100
je 0x14004cd51
mov rsi, qword [rbp - 0x80]
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
xor ebx, ebx
mov qword [rbp - 0x28], rbx
test rsi, rsi
je 0x14004cae0
cmp rsi, r14
ja 0x14004cde1
cmp rsi, 0x1000
jb 0x14004cab9
lea rcx, [rsi + 0x27]
cmp rcx, rsi
jbe 0x14004cddb
call fcn.1400ba398
mov rcx, rax
test rax, rax
je 0x14004cdcf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14004cac1
mov rcx, rsi
call fcn.1400ba398
mov qword [rbp - 0x38], rax
lea rbx, [rsi + rax]
mov qword [rbp - 0x28], rbx
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400ebd20
mov qword [rbp - 0x30], rbx
xor ebx, ebx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, qword [rbp - 0x38]
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rbp - 0x38]
test eax, eax
je 0x14004cd18
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
mov r8, qword [rbp - 0x30]
cmp rsi, r8
jne 0x14004cb39
mov rcx, rbx
mov qword [rbp - 0x10], rbx
mov r14d, 0xf
mov qword [rbp - 8], r14
mov byte [rbp - 0x20], 0
jmp 0x14004cb54
sub r8, rsi
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.14000bec0
mov rsi, qword [rbp - 0x38]
mov r14, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
lea r15, [rbp - 0x20]
mov r12, qword [rbp - 0x20]
cmp r14, 0xf
cmova r15, r12
lea r13, [rbp - 0x20]
cmova r13, r12
add r13, rcx
lea rbx, [rbp - 0x20]
cmp r14, 0xf
cmova rbx, r12
cmp rbx, r13
je 0x14004cba7
sub r15, rbx
movsx ecx, byte [rbx]
call fcn.1400cffdc
mov byte [rbx + r15], al
inc rbx
cmp rbx, r13
jne 0x14004cb83
mov rsi, qword [rbp - 0x38]
mov r14, qword [rbp - 8]
mov rcx, qword [rbp - 0x10]
mov r12, qword [rbp - 0x20]
lea r13, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r13, qword [rbp]
lea rax, [rbp - 0x20]
cmp r14, 0xf
cmova rax, r12
mov qword [rsp + 0x60], rax
mov r15, qword [rbp + 0x10]
cmp r15, rcx
ja 0x14004ccc3
sub rcx, r15
test r15, r15
jne 0x14004cbdf
xor ebx, ebx
jmp 0x14004cc50
inc rcx
add rcx, rax
mov qword [rsp + 0x50], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call fcn.1400ec0c0
mov rbx, rax
test rax, rax
je 0x14004ccc3
nop dword [rax]
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1400ec160
test eax, eax
je 0x14004cc44
inc rbx
mov r8, qword [rsp + 0x50]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call fcn.1400ec0c0
mov rbx, rax
test rax, rax
jne 0x14004cc10
jmp 0x14004ccc3
sub rbx, qword [rsp + 0x60]
cmp rbx, 0xffffffffffffffff
je 0x14004ccc3
nop
mov rcx, qword [rsp + 0x68]
add rcx, rbx
mov qword [rsp + 0x60], rcx
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x14004cc71
mov qword [rdx], rcx
add qword [rdi + 8], 8
jmp 0x14004cc7e
lea r8, [rsp + 0x60]
mov rcx, rdi
call fcn.140051550
lea r9, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r9, qword [rbp]
lea rcx, [rbp - 0x20]
mov r12, qword [rbp - 0x20]
mov r14, qword [rbp - 8]
cmp r14, 0xf
cmova rcx, r12
lea r8, [rbx + 1]
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x10]
call fcn.14000fcf0
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14004cc50
mov rsi, qword [rbp - 0x38]
cmp r14, 0xf
jbe 0x14004ccff
lea rdx, [r14 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14004ccf3
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cde7
mov rcx, r12
call fcn.1400ba390
mov rsi, qword [rbp - 0x38]
movabs r14, 0x7fffffffffffffff
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x38]
test rsi, rsi
je 0x14004cd51
mov rdx, qword [rbp - 0x28]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004cd49
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cdcf
mov rcx, rsi
call fcn.1400ba390
add r15, qword [rbp - 0x80]
mov qword [rsp + 0x38], r15
cmp r15, r13
jb 0x14004ca20
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14004cda5
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cd9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004cdd5
call fcn.1400ba390
nop
mov rax, rdi
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1400ba370
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c975c
nop
call fcn.1400c975c
nop
call fcn.1400016d0
int3
call fcn.140014c40
nop
call fcn.1400c975c
int3