Function at 0x14017a8cc
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140436b28]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa0]
mov r12, r8
mov r15, qword [rbp + 0xa8]
mov rbx, rdx
mov qword [rbp - 0x70], rax
mov r13, rcx
xor eax, eax
mov qword [rsp + 0x48], r9
xor edx, edx
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov edi, eax
lea r8d, [rax + 0x48]
mov qword [rsp + 0x60], rax
mov esi, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8, [rbp - 0x68]
lea rdx, [rbp]
call fcn.14017b91c
mov r14d, eax
test eax, eax
jns 0x14017a96d
mov ecx, eax
call fcn.140079c40
jmp 0x14017aaa8
cmp dword [rsp + 0x38], esi
je 0x14017a98a
lea r8, [rbp - 0x68]
mov rcx, r15
lea rdx, [rbp]
call fcn.14017d390
mov r14d, eax
test eax, eax
js 0x14017a961
mov r15, qword [r13 + 0x18]
xor r14d, r14d
cmp dword [0x140440928], 1
cmove r14, qword [0x14043ffe0]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r15
call rax
xor ebx, ebx
mov r14d, eax
test eax, eax
js 0x14017a961
mov eax, dword [rbp + 0x98]
test al, 0x40
je 0x14017ac01
xor r12d, r12d
cmp dword [0x140440928], 1
jne 0x14017a9f9
mov r9, qword [0x1404400c0]
mov r8, qword [0x1404400b8]
jmp 0x14017a9ff
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [rbp + 0x90], 4
jne 0x14017abd6
lea rdx, [0x1403c7714]
mov rcx, qword [rsp + 0x48]
mov r8d, dword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140078d44
mov r14d, eax
test eax, eax
js 0x14017a961
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x14017aa69
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x14017a963
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov r14, qword [rax + 0xd8]
mov rax, qword [0x1403c1610]
mov rcx, r14
call rax
mov rax, r14
mov rdx, rdi
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x14017a961
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.140076ce8
mov ecx, r14d
call fcn.140079c60
mov r15d, 3
lea rax, [0x14003bd58]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], r15
mov ebx, 0xb9
mov qword [rbp - 0x80], rax
lea r13d, [r15 + 0x1d]
xor r12d, r12d
mov r8d, r13d
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x140020d18]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8d, r13d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x14017ab44
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
test rdi, rdi
je 0x14017ab52
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14017ab80
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
mov ebx, 0xb9
lea rax, [0x14001a1d8]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8, r13
mov rcx, rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14037a9a0
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x140440928], 1
mov r9d, 1
mov rdx, qword [rsp + 0x30]
mov r8, r12
cmove r8, qword [0x1404400b0]
mov rcx, qword [r13 + 0x18]
call fcn.14017ce00
jmp 0x14017aa8f
test al, al
jns 0x14017ac55
xor r12d, r12d
cmp dword [0x140440928], 1
jne 0x14017ac21
mov r9, qword [0x1404400c8]
mov r8, qword [0x1404400b8]
jmp 0x14017ac27
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [rbp + 0x90], 4
jne 0x14017abd6
lea rdx, [0x1403c9d90]
jmp 0x14017aa2c
bt eax, 8
jae 0x14017acc1
xor r12d, r12d
cmp dword [0x140440928], 1
jne 0x14017ac77
mov r9, qword [0x1404400d0]
mov r8, qword [0x1404400b8]
jmp 0x14017ac7d
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [rbp + 0x90], 8
jne 0x14017abd6
mov rcx, qword [rsp + 0x48]
lea rdx, str._I64u
mov r8, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140078d44
jmp 0x14017aa3e
bt eax, 9
jae 0x14017ad3d
mov ebx, 1
xor r12d, r12d
cmp dword [0x140440928], ebx
jne 0x14017ace7
mov r9, qword [0x1404400d8]
mov r8, qword [0x1404400b8]
jmp 0x14017aced
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x14017ad2f
mov eax, edx
and eax, ebx
test al, al
jne 0x14017ad2f
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
shr rdx, 1
call fcn.140079744
jmp 0x14017aa3e
cmp dword [0x140440928], ebx
mov r9d, ebx
jmp 0x14017abe3
bt eax, 0xa
jae 0x14017af4c
cmp dword [0x140440928], 1
jne 0x14017ad60
mov r9, qword [0x1404400e0]
mov r8, qword [0x1404400b8]
jmp 0x14017ad66
mov r9, rbx
mov r8, rbx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov r8d, dword [rbp + 0x90]
mov rcx, r13
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.14017c1a4
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [rsp + 0x54], ebx
je 0x14017aa9a
cmp dword [rsp + 0x38], ebx
je 0x14017aa9a
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], bx
jne 0x14017adc5
cmp rax, 0x26
jne 0x14017ae06
cmp word [r12], 0x7b
jne 0x14017ae11
cmp word [r12 + 0x4a], 0x7d
jne 0x14017ae11
lea rcx, [r12 + 2]
lea rdx, [rbp - 0x50]
call fcn.14006f11c
xor r12d, r12d
mov ebx, eax
test eax, eax
jns 0x14017ae20
mov ecx, eax
call fcn.140079c40
jmp 0x14017ae20
cmp rax, 0x24
jne 0x14017ae11
mov rcx, r12
jmp 0x14017adeb
mov ecx, 0x80070057
mov ebx, ecx
call fcn.140079c40
xor r12d, r12d
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
js 0x14017aa9a
movups xmm0, xmmword [rbp - 0x68]
lea r8, [rsp + 0x38]
lea rdx, [0x1403dc174]
lea rcx, [rsp + 0x50]
movdqu xmmword [rbp - 0x40], xmm0
call fcn.1400ba40c
test al, al
je 0x14017aeae
movsxd rax, dword [rsp + 0x38]
shl rax, 4
add rax, qword [rsp + 0x58]
mov r14, qword [rax + 8]
test r14, r14
jne 0x14017ae72
mov r14d, r12d
mov qword [rbp - 0x20], r12
jmp 0x14017ae99
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140079c60
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, r14
call fcn.140079998
mov r14d, eax
test eax, eax
jns 0x14017ae99
mov ecx, eax
call fcn.140079c40
mov ecx, r14d
call fcn.140079c60
test r14d, r14d
jns 0x14017aeae
mov ecx, r14d
jmp 0x14017a963
lea r8, [rsp + 0x38]
lea rdx, str.pid2
lea rcx, [rsp + 0x50]
call fcn.1400ba40c
test al, al
je 0x14017af3a
movsxd r15, dword [rsp + 0x38]
mov rax, qword [rsp + 0x58]
add r15, r15
mov r14, qword [rax + r15*8 + 8]
test r14, r14
jne 0x14017aee8
mov r14d, r12d
mov qword [rbp - 0x18], r12
jmp 0x14017af0f
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140079c60
lea r8, [rbp - 0x18]
mov edx, ebx
mov rcx, r14
call fcn.140079998
mov r14d, eax
test eax, eax
jns 0x14017af0f
mov ecx, eax
call fcn.140079c40
mov ecx, r14d
call fcn.140079c60
test r14d, r14d
js 0x14017aea6
mov rax, qword [rsp + 0x58]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax + r15*8 + 8]
call fcn.14006a9b4
mov r14d, eax
test eax, eax
js 0x14017a961
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call fcn.14017cfac
jmp 0x14017aa8f
xor r12d, r12d
bt eax, 0xb
jae 0x14017afbe
cmp dword [0x140440928], 1
jne 0x14017af6e
mov r9, qword [0x1404400e8]
mov r8, qword [0x1404400b8]
jmp 0x14017af74
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [rbp + 0x90], 0x10
jne 0x14017abd6
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.140069384
mov rsi, qword [rsp + 0x60]
test eax, eax
js 0x14017abd6
mov rcx, rsi
jmp 0x14017aa4e
bt eax, 0xc
jae 0x14017aff4
cmp dword [0x140440928], 1
jne 0x14017b00d
mov r9, qword [0x1404400f0]
jmp 0x14017b004
test ebx, ebx
je 0x14017aa9a
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov edx, ebx
call fcn.1400687ac
jmp 0x14017aa3e
cmp dword [0x140440928], 1
jne 0x14017b00d
mov r9, qword [0x1404400f8]
mov r8, qword [0x1404400b8]
jmp 0x14017b013
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x14017a961
cmp dword [0x140440928], 1
mov r8, r12
mov ebx, dword [rbp + 0x90]
mov r9d, ebx
cmove r8, qword [0x140440100]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14017ce00
mov r14d, eax
test eax, eax
jns 0x14017afd6
jmp 0x14017a961