Function at 0x140178bac
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor ecx, ecx
mov r12d, r8d
mov qword [rbp - 0x40], rcx
mov edi, ecx
mov qword [rbp - 0x48], rcx
mov ebx, ecx
mov esi, ecx
cmp r8d, 0xffffffff
jne 0x140178bf0
lea r14d, [rcx + 1]
jmp 0x140178f7e
or r13, 0xffffffffffffffff
mov r15, r13
inc r15
cmp word [r9 + r15*2], cx
jne 0x140178bf7
mov r14d, r15d
mov qword [rbp - 0x38], r14
cmp r15, r14
je 0x140178c19
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x140178c1e
call fcn.14007ab44
mov rax, r15
sub rax, r14
neg rax
sbb r14d, r14d
and r14d, 0x80070216
mov ecx, r14d
call fcn.14007ab44
mov rax, qword [rbp - 0x38]
cmp r15, rax
je 0x140178c4f
mov ecx, r14d
call fcn.14007ab24
jmp 0x140178f7e
test eax, eax
je 0x140178c71
test r12b, 8
je 0x140178c71
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.14017a0bc
mov r14d, eax
test eax, eax
jns 0x140178c80
mov ecx, eax
jmp 0x140178c45
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.14007a9ec
jmp 0x140178c66
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rdi, rax
test rax, rax
jne 0x140178c9e
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140178c45
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140178ccc
lea r14, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov r15, qword [rbp + 0x68]
test r15, r15
jne 0x140178d29
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, [0x1403c1978]
call fcn.14007a728
mov r14d, eax
test eax, eax
js 0x140178d0c
lea rcx, [0x1403c1978]
mov edx, dword [rbp + 0x58]
lea r8, [rbp - 0x48]
call fcn.14007a880
mov r14d, eax
test eax, eax
jns 0x140178d13
mov ecx, eax
call fcn.14007ab24
mov ecx, r14d
call fcn.14007ab44
test r14d, r14d
jns 0x140178de6
jmp 0x140178c42
test r12b, 4
je 0x140178d5e
mov rax, qword [rbp + 0x48]
cmp dword [rax + 4], ecx
jne 0x140178d5e
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, str._exc_
call fcn.14007a728
mov r14d, eax
test eax, eax
js 0x140178d0c
lea rcx, str._exc_
jmp 0x140178cf9
inc r13
cmp word [r15 + r13*2], cx
jne 0x140178d5e
mov edx, r13d
mov qword [rbp - 0x30], rdx
cmp r13, rdx
je 0x140178d80
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x140178d8b
xor ecx, ecx
call fcn.14007ab44
mov rdx, qword [rbp - 0x30]
mov rax, r13
sub rax, rdx
neg rax
mov rax, qword [rbp - 0x38]
sbb r14d, r14d
and r14d, 0x80070216
cmp r13, rdx
mov ecx, r14d
cmove eax, r13d
mov qword [rbp - 0x38], rax
call fcn.14007ab44
cmp r13, qword [rbp - 0x30]
jne 0x140178c42
mov rax, qword [rbp - 0x38]
test eax, eax
je 0x140178dea
test r12b, 0x10
je 0x140178dea
lea r8, [rbp - 0x48]
mov edx, eax
mov rcx, r15
call fcn.14015ebe8
mov r14d, eax
test eax, eax
js 0x140178c6d
mov r15, qword [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rbx, rax
test rax, rax
je 0x140178c94
mov r13, qword [rbp + 0x70]
test r13, r13
je 0x140178e27
test r12b, 0x40
jne 0x140178e27
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rsi, rax
test rax, rax
je 0x140178c94
mov r15, qword [rbp + 0x48]
test r12b, 1
je 0x140178e9c
mov rdx, qword [rbp + 0x50]
mov r9, rbx
mov rcx, qword [r15 + 0x18]
mov r8, rdi
call fcn.14015fd2c
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178c42
test r13, r13
je 0x140178e8a
test r12b, 0x40
jne 0x140178e8a
cmp dword [0x140438c18], 1
mov r8d, eax
mov rdx, qword [rbp + 0x50]
mov r9, rsi
cmove r8, qword [0x1404383c0]
mov rcx, qword [r15 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x140178c6d
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x40]
call fcn.140077a84
jmp 0x140178f6c
mov rax, qword [r15 + 0x18]
mov qword [rbp - 0x30], rax
mov rax, qword [rax]
mov r14, qword [rax + 0x178]
test r12b, 2
je 0x140179022
mov rcx, r14
call qword [0x1403b8660]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rdx, rdi
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178c42
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
test r12b, 0x20
je 0x140179084
mov r8, rbx
call fcn.14017a218
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178c42
test r13, r13
je 0x140178f3d
test r12b, 0x40
jne 0x140178f3d
cmp dword [0x140438c18], 1
mov r8d, eax
mov rdx, qword [rbp - 0x40]
mov r9, rsi
cmove r8, qword [0x1404383c0]
mov rcx, qword [r15 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x140178c6d
mov r15, qword [rbp + 0x50]
mov rax, qword [r15]
mov r14, qword [rax + 0xa8]
mov rcx, r14
call qword [0x1403b8660]
mov rdx, qword [rbp - 0x40]
xor r8d, r8d
mov rcx, r15
call r14
mov r14d, eax
test eax, eax
js 0x140178c6d
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140178f7e
mov rcx, qword [rbp - 0x40]
call fcn.140077a84
mov ecx, r14d
call fcn.14007ab44
test rsi, rsi
je 0x140178f94
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test rbx, rbx
je 0x140178fa4
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140178fb2
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140178fda
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
xor r9d, r9d
mov qword [rbp - 0x28], 3
lea rax, [0x14001cb78]
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x40]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x140438c18], 1
mov r15, rcx
mov rcx, r14
cmove r15, qword [0x1404383a8]
call qword [0x1403b8660]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rdx, r15
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178c42
cmp dword [0x140438c18], 1
mov r8d, eax
mov r15, qword [rbp + 0x48]
mov r9, rdi
cmove r8, qword [0x1404383b0]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
call fcn.14015fd2c
jmp 0x140178ecf
cmp dword [0x140438c18], 1
mov r8, rax
mov r9, rbx
cmove r8, qword [0x1404383b8]
call fcn.14015fd2c
jmp 0x140178ef7