Function at 0x1401aab78
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x118
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x80]
lea rbx, str.RuleSetData
xor esi, esi
mov qword [rsp + 0x70], rax
mov rax, qword gs:[0x58]
mov r13, rcx
mov qword [rbp - 0x68], rdx
or r14, 0xffffffffffffffff
mov edx, 4
mov r15, r9
mov r12, r8
mov qword [rsp + 0x48], rsi
mov rcx, qword [rax]
lea edi, [rsi + 1]
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov eax, dword [rdx + rcx]
cmp dword [0x140423350], eax
jg 0x1401ab014
mov rax, qword [r15]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [0x1403a2250]
lea r9, [rsp + 0x60]
mov rcx, r15
lea r8, [rsp + 0x68]
lea rdx, str.RuleSetData
call rbx
mov ebx, eax
test eax, eax
js 0x1401aaf45
mov rsi, qword [r13 + 0x18]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
cmp dword [rsp + 0x60], edi
jne 0x1401aad27
xor edi, edi
cmp dword [0x140423530], 1
cmove rdi, qword [0x140422a18]
call qword [0x1403a2250]
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, rsi
call rbx
xor esi, esi
mov ebx, eax
test eax, eax
js 0x1401aaf45
mov rax, qword [rsp + 0x48]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x30], r8
lea r9, [0x140423360]
mov qword [rsp + 0x28], rax
mov r8, r15
mov rdx, r12
mov dword [rsp + 0x20], SafeArrayGetDim
mov rcx, r13
call fcn.1401abe84
mov ebx, eax
test eax, eax
js 0x1401aaf45
lea r8, [rsp + 0x40]
lea rdx, str.productSkuId
lea rcx, [rsp + 0x50]
call fcn.1400b5fdc
test al, al
je 0x1401aaf1b
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, r14
inc rax
cmp word [rcx + rax*2], si
jne 0x1401aacee
mov r15d, 0x80070057
cmp rax, 0x26
jne 0x1401aad3d
cmp word [rcx], 0x7b
jne 0x1401aad43
cmp word [rcx + 0x4a], 0x7d
jne 0x1401aad43
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.14006dc40
mov ebx, eax
test eax, eax
jns 0x1401aad4e
mov ecx, eax
jmp 0x1401aad49
xor edi, edi
cmp dword [0x140423530], 1
cmove rdi, qword [0x140422a10]
jmp 0x1401aac61
cmp rax, 0x24
je 0x1401aad14
mov ebx, r15d
mov ecx, r15d
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x1401aad60
mov ecx, ebx
jmp 0x1401aaf47
lea r8, [rsp + 0x40]
lea rdx, [0x1403a9518]
lea rcx, [rsp + 0x50]
call fcn.1400b5fdc
test al, al
je 0x1401aae06
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
mov rax, r14
inc rax
cmp word [rcx + rax*2], si
jne 0x1401aad93
cmp rax, 0x26
jne 0x1401aadc6
cmp word [rcx], 0x7b
jne 0x1401aadcc
cmp word [rcx + 0x4a], 0x7d
jne 0x1401aadcc
add rcx, 2
lea rdx, [rbp - 0x60]
call fcn.14006dc40
mov ebx, eax
test eax, eax
jns 0x1401aadd7
mov ecx, eax
jmp 0x1401aadd2
cmp rax, 0x24
je 0x1401aadb3
mov ebx, r15d
mov ecx, r15d
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x1401aad59
mov rdi, qword [rsp + 0x70]
lea r8, [rbp - 0x50]
mov rcx, rdi
lea rdx, [rbp - 0x60]
call fcn.14017568c
mov ebx, eax
test eax, eax
jns 0x1401aae0b
jmp 0x1401aaf45
mov rdi, qword [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, str.licenseId
lea rcx, [rsp + 0x50]
call fcn.1400b5fdc
test al, al
je 0x1401aaf1b
movsxd rax, dword [rsp + 0x40]
shl rax, 4
add rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
inc r14
cmp word [rcx + r14*2], si
jne 0x1401aae3b
cmp r14, 0x26
jne 0x1401aae6f
cmp word [rcx], 0x7b
jne 0x1401aae75
cmp word [rcx + 0x4a], 0x7d
jne 0x1401aae75
add rcx, 2
lea rdx, [rbp - 0x60]
call fcn.14006dc40
mov ebx, eax
test eax, eax
jns 0x1401aae80
mov ecx, eax
jmp 0x1401aae7b
cmp r14, 0x24
je 0x1401aae5c
mov ebx, r15d
mov ecx, r15d
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x1401aad59
xor edx, edx
lea rcx, [rbp - 0x40]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
movups xmm6, xmmword [rbp - 0x60]
lea r8, [rsp + 0x40]
movups xmm7, xmmword [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea rcx, [rdi + 0x10]
movups xmmword [rbp - 0x40], xmm6
movups xmmword [rbp - 0x30], xmm7
call fcn.1401706b0
test al, al
je 0x1401aaedc
movsxd rax, dword [rsp + 0x40]
mov ebx, esi
shl rax, 5
add rax, qword [rdi + 0x18]
movups xmmword [rax], xmm6
movups xmmword [rax + 0x10], xmm7
jmp 0x1401aaefa
mov edx, dword [rsp + 0x40]
lea r8, [rbp - 0x40]
lea rcx, [rdi + 0x10]
call fcn.1401ad7d0
mov ebx, eax
test eax, eax
jns 0x1401aaefa
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
jns 0x1401aaf0c
mov ecx, ebx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x1401aad59
mov rdi, qword [rbp - 0x68]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call qword [0x1403a2250]
mov rdx, qword [rsp + 0x48]
xor r8d, r8d
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
jns 0x1401aaf4c
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
mov r14d, 3
mov qword [rbp - 0x78], rsi
lea rax, [0x14003a920]
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x78]
lea rax, [rsp + 0x50]
mov r15d, 0xb9
lea r8d, [r14 + 0x1d]
mov qword [rbp - 0x70], rax
xor r9d, r9d
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1401aafb3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x78], r14
lea rax, [0x140033aa0]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x78]
lea rax, [rsp + 0x48]
mov rcx, r15
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x70], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.14035a4e0
lea r11, [rsp + 0x118]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x140423350]
call fcn.14035aa48
cmp dword [0x140423350], r14d
jne 0x1401aac05
xor eax, eax
mov qword [0x140423368], rsi
mov qword [0x140423370], rax
lea rax, str.metaInfoType
mov qword [0x140423360], rax
xor eax, eax
mov qword [0x140423388], rax
lea rax, str.licenseId
mov qword [0x140423378], rax
lea rax, str.licId
mov qword [0x140423380], rax
xor eax, eax
mov qword [0x1404233a0], rax
lea rax, str.licenseType
mov qword [0x140423390], rax
lea rax, [0x1403c62dc]
mov qword [0x140423398], rax
xor eax, eax
mov qword [0x1404233b8], rax
lea rax, str.licenseCategory
mov qword [0x1404233a8], rax
lea rax, str.licCat
mov qword [0x1404233b0], rax
xor eax, eax
mov qword [0x1404233d0], rax
lea rax, str.fileId
mov qword [0x1404233c0], rax
xor eax, eax
mov qword [0x1404233e8], rax
lea rax, [0x1403a9518]
mov qword [0x1404233d8], rax
lea rax, [0x1403bce6c]
mov qword [0x1404233e0], rax
xor eax, eax
mov qword [0x140423400], rax
lea rax, str.productSkuId
mov qword [0x1404233f0], rax
lea rax, str.skuId
mov qword [0x1404233f8], rax
xor eax, eax
mov qword [0x140423418], rax
lea rax, [0x1403c6294]
mov qword [0x140423410], rax
xor eax, eax
mov qword [0x140423430], rax
lea rax, str.phone:policy
mov qword [0x140423420], rax
lea rax, str.phnPol
mov qword [0x140423428], rax
xor eax, eax
mov qword [0x140423448], rax
lea rax, str.stilComment
mov qword [0x140423438], rax
xor eax, eax
mov qword [0x140423460], rax
lea rax, str.stilComment2
mov qword [0x140423450], rax
mov dword [0x140423370], esi
mov dword [0x140423374], r14d
mov dword [0x140423388], edi
mov dword [0x14042338c], edi
mov dword [0x1404233a0], esi
mov dword [0x1404233a4], edi
mov dword [0x1404233b8], esi
mov dword [0x1404233bc], edi
mov qword [0x1404233c8], rsi
mov dword [0x1404233d0], esi
mov dword [0x1404233d4], edi
mov dword [0x1404233e8], edi
mov dword [0x1404233ec], edi
mov dword [0x140423400], edi
mov dword [0x140423404], edi
mov qword [0x140423408], rbx
mov dword [0x140423418], esi
mov dword [0x14042341c], 0x24
mov dword [0x140423430], esi
mov dword [0x140423434], 0x24
mov qword [0x140423440], rsi
mov dword [0x140423448], esi
mov dword [0x14042344c], 0x20
mov qword [0x140423458], rsi
xor eax, eax
mov dword [0x140423460], esi
mov qword [0x140423478], rax
lea rcx, [0x140423350]
lea rax, str.stilToken
mov dword [0x140423464], 0x20
mov qword [0x140423468], rax
mov qword [0x140423470], rsi
mov dword [0x140423478], esi
mov dword [0x14042347c], 0x20
call fcn.14035a9e8
jmp 0x1401aac05