Function at 0x18006e33c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, rcx
xor r14d, r14d
mov dword [rax - 0x78], r14d
xor ebx, ebx
mov qword [rax - 0x68], rbx
and qword [rax + 0x18], rbx
xor r15d, r15d
mov dword [rax - 0x74], r15d
xor r13d, r13d
test rcx, rcx
je 0x18006e576
test rdx, rdx
je 0x18006e576
lea rax, [rdx + 0x28]
cmp rax, rdx
jb 0x18006e564
lea rsi, [rax + 7]
cmp rsi, rax
jb 0x18006e3a6
and rsi, 0xfffffffffffffff8
xor eax, eax
jmp 0x18006e3af
or rsi, 0xffffffffffffffff
mov eax, 0x80070216
test eax, eax
jns 0x18006e3d8
mov r9d, 0x175
lea r8, str.WER_Heap:_u:_ERROR_Arithmetic_overflow_when_aligning_block_size_n
xor edx, edx
mov ecx, 0x96
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
jmp 0x18006e5a7
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemInfo]
nop dword [rax + rax]
mov r12d, dword [rsp + 0x3c]
test r12d, r12d
jne 0x18006e414
mov r9d, 0x187
lea r8, str.WER_Heap:_u:_ERROR_Invalid_page_size__GetSystemInfo__may_have_failed_n
jmp 0x18006e3c0
mov rcx, rdi
call fcn.18006e7fc
test eax, eax
jne 0x18006e42f
mov r9d, 0x18d
lea r8, str.WER_Heap:_u:_ERROR_Failed_to_lock_the_heap_n
jmp 0x18006e3c0
cmp qword [rdi + 0x38], 0
jne 0x18006e443
mov r14d, 1
mov dword [rsp + 0x20], r14d
jmp 0x18006e4a7
cmp qword [rdi + 0x40], 0
je 0x18006e46d
lea rdx, [rsi - 0x28]
mov rcx, rdi
call fcn.18006e770
mov rbx, rax
mov qword [rsp + 0x30], rax
xor r13d, r13d
test rax, rax
setne r13b
mov dword [rsp + 0x28], r13d
test rbx, rbx
jne 0x18006e4a2
xor edx, edx
mov rax, qword [rdi + 0x38]
div r12
mov ecx, r12d
sub ecx, edx
mov eax, ecx
cmp rax, rsi
jb 0x18006e497
cmp ecx, r12d
je 0x18006e497
mov rbx, qword [rdi + 0x38]
mov qword [rsp + 0x30], rbx
jmp 0x18006e4a2
mov r14d, 1
mov dword [rsp + 0x20], r14d
test r14d, r14d
je 0x18006e4d1
mov r9d, 4
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualAlloc]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18006e529
test r13d, r13d
jne 0x18006e4e5
lea rax, [rsi + rbx]
mov qword [rdi + 0x38], rax
lea ecx, [rsi - 0x28]
mov qword [rbx + 0x18], rcx
lea rsi, [rbx + 0x28]
mov qword [rbx + 0x10], rsi
mov dword [rbx + 0x20], 1
and qword [rbx + 8], 0
mov rax, qword [rdi + 0x28]
mov qword [rbx], rax
cmp qword [rdi + 0x20], 0
jne 0x18006e50b
mov qword [rdi + 0x20], rbx
mov rax, qword [rdi + 0x28]
test rax, rax
je 0x18006e518
mov qword [rax + 8], rbx
mov qword [rdi + 0x28], rbx
mov r15d, 1
mov dword [rsp + 0x24], r15d
jmp 0x18006e531
mov rsi, qword [rsp + 0xb0]
mov rcx, rdi
call fcn.18006e848
test r15d, r15d
jne 0x18006e55f
test rbx, rbx
je 0x18006e55f
test r14d, r14d
je 0x18006e55f
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualFree]
nop dword [rax + rax]
mov rax, rsi
jmp 0x18006e5a9
mov r9d, 0x16a
lea r8, str.WER_Heap:_u:_ERROR_Arithmetic_overflow_when_calculating_block_size_n
jmp 0x18006e3c0
mov r9d, 0x15d
lea r8, str.WER_Heap:_u:_ERROR_Invalid_arguments_n
xor edx, edx
mov ecx, 0x96
call qword [sym.imp.ntdll.dll_DbgPrintEx]
nop dword [rax + rax]
mov ecx, 0x57
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret