Function at 0x140001290
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14000130e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.failed_to_open_process__err_code___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001e10
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001fe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400015fd
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebp, ebp
cmp qword [rsp + 0x70], rbp
jbe 0x1400015f4
movabs r12, 0x7fffffffffffffff
lea r15, str.50_6C_61_79_65_72_73____________________________07_00_00_00_00_00_00_00_0F
nop word [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400015be
cmp dword [rsp + 0x50], 0x1000
jne 0x1400015a6
cmp dword [rsp + 0x54], 1
je 0x1400015a6
lea rdx, str.current_mbi_state___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001e10
mov rcx, rax
mov edx, 0x1000
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001fe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.current_mbi_protect___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001e10
mov rcx, rax
mov edx, dword [rsp + 0x54]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001fe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x48]
movdqu xmmword [rsp + 0x90], xmm0
xor esi, esi
mov qword [rsp + 0xa0], rsi
test rbx, rbx
je 0x140001470
cmp rbx, r12
ja 0x14000162b
cmp rbx, 0x1000
jb 0x140001435
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140001631
call fcn.140002320
test rax, rax
je 0x1400015b7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001440
mov rcx, rbx
call fcn.140002320
mov rdi, rax
mov qword [rsp + 0x90], rdi
lea rsi, [rdi + rbx]
mov qword [rsp + 0xa0], rsi
mov r8, rbx
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x98], rsi
mov rbx, qword [rsp + 0x48]
jmp 0x140001478
mov rdi, qword [rsp + 0x90]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rdi
mov rdx, qword [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000153b
xor ebx, ebx
mov r10, qword [rsp + 0xa8]
add r10, 0xfffffffffffffff8
je 0x140001572
mov r9, rdi
sub r9, r15
nop dword [rax + rax]
xor eax, eax
lea rcx, [rax + r15]
movsx r8d, byte [rcx]
cmp r8b, 0x3f
je 0x1400014dc
add rcx, r9
movzx edx, byte [rcx + rbx]
cmp edx, r8d
jne 0x140001531
inc rax
cmp rax, 8
jb 0x1400014c2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add ebx, dword [rsp + 0x30]
test rdi, rdi
je 0x14000152a
sub rsi, rdi
mov r8, rdi
cmp rsi, 0x1000
jb 0x14000151f
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub r8, rdi
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400015b7
mov rdx, rsi
mov rcx, rdi
call fcn.14000235c
mov eax, ebx
jmp 0x1400015ff
inc rbx
cmp rbx, r10
jb 0x1400014c0
jmp 0x140001572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.failed_to_read_process_memory__err_code___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001e10
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001fe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
test rdi, rdi
je 0x1400015a6
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x14000159b
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015b7
mov rdx, rsi
mov rcx, rdi
call fcn.14000235c
add rbp, qword [rsp + 0x48]
cmp rbp, qword [rsp + 0x70]
jae 0x1400015f4
jmp 0x140001340
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.virtualqueryex_failed__err_code___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001e10
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001fe0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140002300
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140002150
int3
call fcn.140001100
int3