Function at 0x1400dc0c8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, rdx
xor r14d, r14d
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x28], r14d
xor edx, edx
lea r8d, [r14 + 0x2c]
lea rcx, [rbp - 0x24]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.8073
lea r13, str.SOFTWAREMicrosoftSQMClientWindowsCommonDatapoints
mov rdx, r13
mov r12, 0xffffffff80000002
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.form
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
lea r15d, [r14 + 1]
test eax, eax
js 0x1400dc560
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r8d, word [rbp - 0x28]
test r8w, r8w
jne 0x1400dc1d9
lea eax, [r12 - 2]
xor ecx, ecx
cpuid
cmp eax, 0x80000001
jb 0x1400dc1d9
lea eax, [r12 - 1]
xor ecx, ecx
cpuid
bt edx, 0x1d
jae 0x1400dc1d9
lea r8d, [r14 + 9]
mov word [rbp - 0x28], r8w
movzx r8d, r8w
lea rdx, str.arch
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.1400d7bf4
test eax, eax
js 0x1400dc266
lea rsi, [rdi + 8]
mov r8, qword [rbp - 0x60]
lea rdx, str.sysmfg
mov rcx, rsi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov r8, qword [rbp - 0x80]
lea rdx, str.syspro
mov rcx, rsi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov r8, qword [rbp - 0x50]
lea rdx, [0x140128d80]
mov rcx, rsi
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
lea rcx, [rsp + 0x70]
call fcn.1400d79c0
test eax, eax
js 0x1400dc293
lea rcx, [rdi + 8]
mov r8, qword [rsp + 0x70]
lea rdx, [0x140128d88]
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.10433
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
test eax, eax
je 0x1400dc2cd
mov r8d, eax
lea rdx, [0x140128c30]
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x140128d9c]
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.proccnt
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.MHz
lea rdx, str.HardwareDescriptionSystemCentralProcessor0
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.proclsp
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.4573
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.wscpusc
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.4572
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.wsdsksc
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rsi, [0x14011a1b8]
mov r9, rsi
lea r8, str.ProcessorNameString
lea rdx, str.HardwareDescriptionSystemCentralProcessor0
mov rcx, r12
call fcn.1400d772c
test eax, eax
js 0x1400dc40c
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x1400dc40c
cmp dword [rsp + 0x4c], r14d
jbe 0x1400dc40c
lea rcx, [rdi + 8]
lea rdx, str.wscpudn
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.4575
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.wsdgsc
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.9290
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.aoac
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
js 0x1400dc560
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, str.SystemSKU
lea rdx, str.HardwareDescriptionSystemBIOS
mov rcx, r12
call fcn.1400d772c
test eax, eax
js 0x1400dc4d4
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x1400dc4d4
cmp dword [rsp + 0x5c], r14d
jbe 0x1400dc4d4
lea rcx, [rdi + 8]
lea rdx, str.bssku
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, rsi
lea r8, str.ComputerHardwareId
lea rdx, str.SystemCurrentControlSetControlSystemInformation
mov rcx, r12
call fcn.1400d772c
test eax, eax
js 0x1400dc52c
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x1400dc52c
cmp dword [rsp + 0x6c], r14d
jbe 0x1400dc52c
lea rcx, [rdi + 8]
lea rdx, str.chid
call fcn.1400db078
mov ebx, eax
test eax, eax
js 0x1400dc560
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.12728
mov rdx, r13
mov rcx, r12
call fcn.1400d756c
mov r8d, eax
lea rdx, str.sdksz
mov rcx, rdi
call fcn.1400d69a4
mov ebx, eax
test eax, eax
cmovns ebx, r14d
mov edx, r15d
lea rcx, [rbp - 0x40]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rsp + 0x60]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rsp + 0x50]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rsp + 0x70]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rbp - 0x50]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rbp - 0x80]
call fcn.1400d9748
nop
mov edx, r15d
lea rcx, [rbp - 0x60]
call fcn.1400d9748
mov eax, ebx
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret