Function at 0x140176648
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140436b28]
xor rax, rsp
mov qword [rbp + 7], rax
and qword [rbp - 0x49], 0
xor edi, edi
and qword [rbp - 0x51], rdi
mov r13, r9
and qword [rbp - 0x69], rdi
mov rsi, r8
and dword [rbp - 0x11], edi
mov r12, rdx
lea eax, [rdi + 3]
mov qword [rbp - 0x29], rdx
mov dword [rbp - 5], eax
lea r8d, [rdi + 0x30]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x41]
lea rax, [0x14002ea18]
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x39], rax
mov r15, rcx
lea rax, [rbp - 0x61]
mov dword [rbp - 0xd], 1
mov qword [rbp - 0x31], rax
xor r9d, r9d
lea rax, [rbp - 0x49]
mov dword [rbp - 9], 2
mov qword [rbp - 0x21], rax
mov ecx, 0xb9
lea rax, [rbp - 0x5d]
mov dword [rbp - 1], 4
mov qword [rbp - 0x19], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x61]
test ebx, ebx
jns 0x1401766fa
mov ecx, ebx
jmp 0x1401767df
mov edx, dword [rbp - 0x5d]
lea r8, [rbp - 0x59]
mov rcx, qword [rbp - 0x49]
call fcn.140079744
mov ebx, eax
test eax, eax
jns 0x140176720
mov ecx, eax
call fcn.140079c40
mov rdi, qword [rbp - 0x59]
jmp 0x1401767e4
mov rdi, qword [rbp - 0x59]
lea r9, [rbp - 0x51]
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.1401780b8
mov ebx, eax
test eax, eax
js 0x1401767dd
mov r14, qword [r15 + 0x18]
xor esi, esi
cmp dword [0x140440928], 1
cmove rsi, qword [0x14043ffc0]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x69]
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x1401767dd
xor esi, esi
lea r14, [rbp - 0x11]
mov r9, qword [rbp - 0x69]
mov rdx, r12
mov r8d, dword [r14]
mov rcx, r15
mov qword [rsp + 0x20], r13
call fcn.1401784c8
mov ebx, eax
test eax, eax
js 0x1401767dd
inc esi
add r14, 4
cmp esi, 5
jb 0x140176786
mov rbx, qword [rbp - 0x51]
mov rax, qword [rbx]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x69]
mov rax, rsi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x1401767e4
mov ecx, eax
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
and qword [rbp - 0x31], 0
lea rax, [rbp - 0x69]
mov r14d, 3
mov qword [rbp - 0x29], rax
mov r12d, 0xb9
mov qword [rbp - 0x41], r14
lea rsi, [0x14001a518]
xor r9d, r9d
lea rdx, [rbp - 0x41]
mov qword [rbp - 0x39], rsi
lea r15d, [r14 + 0x2d]
mov ecx, r12d
mov r8d, r15d
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x31], 0
lea rax, [rbp - 0x51]
xor r9d, r9d
mov qword [rbp - 0x29], rax
mov r8d, r15d
mov qword [rbp - 0x41], r14
lea rdx, [rbp - 0x41]
mov qword [rbp - 0x39], rsi
mov ecx, r12d
call sub.ntdll.dll_NtQuerySystemInformation
test rdi, rdi
je 0x140176871
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x14017688e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14037a9a0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret