Function at 0x18000e070
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
push r13
push r14
sub rsp, 0x50
mov eax, dword [rcx + 0x16]
xor ebx, ebx
xor r13d, r13d
mov r14, rdx
mov r12, rcx
test al, 1
je 0x18000e0b1
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop r12
ret
mov r9, rax
movzx eax, word [rcx]
mov qword [rsp + 0x70], rbp
test eax, eax
je 0x18000e0f2
lea rdx, [rcx + 0xb6]
mov r8d, eax
nop word [rax + rax]
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x18000e0de
mov eax, dword [rdx]
add rax, r9
jmp 0x18000e0e2
mov eax, dword [rdx]
add eax, ecx
cmp rax, rbx
cmova rbx, rax
add rdx, 0x28
dec r8
jne 0x18000e0d0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov r11d, dword [rsp + 0x24]
mov eax, dword [r12 + 0x1e]
lea rbp, [rax + r11 - 1]
lea rax, [r11 - 1]
lea rcx, [r11 + rbx - 1]
not rax
and rbp, rax
lea rax, [r11 - 1]
not rax
and rcx, rax
cmp rbp, rcx
je 0x18000e13c
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000e2af
mov rcx, qword [r12 + 0xe]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
mov qword [rsp + 0x78], rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000e190
lea r9d, [rax + 4]
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000e190
lea ecx, [rax + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18000e2aa
lea rcx, [rsi + rbp]
mov qword [rsp + 0x80], rdi
movabs rdi, 0xffffffff00000000
mov rax, rsi
and rcx, rdi
and rax, rdi
cmp rax, rcx
jae 0x18000e206
mov ecx, 0x10
call fcn.18000ea64
mov rbx, rax
test rax, rax
je 0x18000e2e6
mov qword [rax], r13
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbp
xor ecx, ecx
mov qword [rax + 8], rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x18000e2c7
lea rcx, [rax + rbp]
and rax, rdi
and rcx, rdi
cmp rax, rcx
jb 0x18000e1b4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000e2e6
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rbp
mov dword [rax + 0x28], 1
lea rax, [0x18000e020]
mov qword [rdi + 0x60], 0
mov qword [rdi + 0x30], rax
lea rax, [0x18000e030]
mov qword [rdi + 0x38], rax
lea rax, [0x18000e040]
mov qword [rdi + 0x40], rax
lea rax, [0x18000e050]
mov qword [rdi + 0x48], rax
lea rax, [0x18000e060]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x24]
mov qword [rdi + 0x78], r13
mov dword [rdi + 0x70], eax
mov edx, dword [r12 + 0x22]
cmp r14, rdx
jae 0x18000e2fc
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.18000e5f0
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop r12
ret
mov rcx, rbx
lea rdx, [0x18000e030]
xor r8d, r8d
call fcn.18000d9c0
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000e2a0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r13
jmp 0x18000e2ca
mov r9d, 4
mov r8d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r12 + 0x22]
mov rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.18000ee60
mov qword [rdi], rbx
mov r9, rdi
mov r8, r12
mov rdx, r14
mov rcx, r12
mov qword [rbx + 0xe], rsi
call fcn.18000da30
test eax, eax
je 0x18000e298
mov rax, qword [rdi]
mov rdx, qword [rax + 0xe]
sub rdx, qword [r12 + 0xe]
je 0x18000e35f
mov rcx, rdi
call fcn.18000ddd0
mov dword [rdi + 0x2c], eax
jmp 0x18000e366
mov dword [rdi + 0x2c], 1
mov rcx, rdi
call fcn.18000de90
test eax, eax
je 0x18000e298
mov rcx, rdi
call fcn.18000db70
test eax, eax
je 0x18000e298
mov rax, qword [rdi]
mov rbp, qword [rdi + 8]
mov ecx, dword [rax + 0x72]
test ecx, ecx
je 0x18000e3c9
mov rbx, qword [rcx + rbp + 0x18]
test rbx, rbx
je 0x18000e3c9
mov rax, qword [rbx]
test rax, rax
je 0x18000e3c9
nop word [rax + rax]
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x18000e3b0
mov rax, qword [rdi]
mov ecx, dword [rax + 0xa]
test ecx, ecx
je 0x18000e412
cmp dword [rdi + 0x28], 0
lea rax, [rsi + rcx]
je 0x18000e406
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x18000e3f7
mov ecx, 0x45a
jmp 0x18000e292
mov dword [rdi + 0x24], 1
mov rax, rdi
jmp 0x18000e2a2
mov qword [rdi + 0x68], rax
mov rax, rdi
jmp 0x18000e2a2
mov qword [rdi + 0x68], 0
mov rax, rdi
jmp 0x18000e2a2