Function at 0x14017079c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
lea rcx, [rbp - 0x38]
cmp dword [0x1404230f8], 1
mov rbx, r8
mov r14, rdx
mov qword [rbp - 0x60], r12
mov r8d, r12d
mov qword [rbp - 0x58], r12
cmove r8, qword [0x140422770]
lea rdx, [0x1403bc6e8]
mov esi, r12d
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov edi, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x50], r12
call fcn.140068494
mov r15d, eax
test eax, eax
jns 0x140170820
mov ecx, eax
call fcn.140078308
jmp 0x140170a5d
mov edx, 0x5c
lea r8, [rbp - 0x48]
mov rcx, rbx
call fcn.140068298
mov r15d, eax
test eax, eax
js 0x140170814
lea rdx, [rbp - 0x58]
mov rcx, r14
call fcn.1400753a4
mov r13d, r12d
cmp dword [rbp - 0x44], r12d
jle 0x140170a50
mov rax, qword [rbp - 0x40]
lea rdx, str.__s__name_s_
xor r8d, r8d
lea rcx, [rbp - 0x38]
cmp dword [0x1404230f8], 1
cmove r8, qword [0x140422778]
mov r9, qword [rax + r12]
call fcn.140068494
mov r15d, eax
test eax, eax
js 0x140170814
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
test rdi, rdi
je 0x14017089d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test r15, r15
je 0x140170b7b
mov rbx, qword [rbp - 0x60]
mov rdi, r15
test rbx, rbx
je 0x1401708cd
mov rax, qword [rbx]
mov r14, qword [rax + 0x10]
mov rcx, r14
call qword [0x1403a2250]
mov rcx, rbx
call r14
and qword [rbp - 0x60], 0
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x1401708f1
mov rax, qword [rbx]
mov r14, qword [rax + 0x10]
mov rcx, r14
call qword [0x1403a2250]
mov rcx, rbx
call r14
and qword [rbp - 0x50], 0
mov rax, qword [rbp + 0x40]
mov r14, qword [rax + 0x18]
mov rax, qword [r14]
mov rbx, qword [rax + 0x128]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rbp - 0x50]
mov rdx, r15
mov rcx, r14
call rbx
test eax, eax
jne 0x14017093f
mov rbx, qword [rbp - 0x50]
mov rax, qword [rbx]
mov r14, qword [rax]
mov rcx, r14
call qword [0x1403a2250]
lea r8, [rbp - 0x60]
lea rdx, [0x1403bce78]
jmp 0x1401709fd
mov rax, qword [rbp + 0x40]
xor r14d, r14d
cmp dword [0x1404230f8], 1
cmove r14, qword [0x140422778]
mov r15, qword [rax + 0x18]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rbp - 0x60]
mov rdx, r14
mov rcx, r15
call rbx
mov r15d, eax
test eax, eax
js 0x140170814
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax + r12]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rsi, rsi
je 0x1401709a2
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x140170b77
mov rax, qword [rbp + 0x40]
xor r8d, r8d
cmp dword [0x1404230f8], 1
mov r9, rbx
mov rdx, qword [rbp - 0x60]
mov rsi, rbx
cmove r8, qword [0x140422820]
mov rcx, qword [rax + 0x18]
call fcn.1401584f8
mov r15d, eax
test eax, eax
js 0x140170814
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov r14, qword [rax + 0xa8]
mov rcx, r14
call qword [0x1403a2250]
mov rdx, qword [rbp - 0x60]
xor r8d, r8d
mov rcx, rbx
call r14
mov r15d, eax
test eax, eax
js 0x140170814
mov rbx, qword [rbp - 0x58]
test rbx, rbx
je 0x140170a32
mov rax, qword [rbx]
mov r14, qword [rax + 0x10]
mov rcx, r14
call qword [0x1403a2250]
mov rcx, rbx
call r14
and qword [rbp - 0x58], 0
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
call fcn.1400753a4
inc r13d
add r12, 8
cmp r13d, dword [rbp - 0x44]
jl 0x140170851
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp - 0x60]
call fcn.1400753a4
mov ecx, r15d
call fcn.140078324
and qword [rbp - 0x18], 0
lea rax, [0x14003f720]
mov r14d, 3
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x28], r14
mov r13d, 0xb9
mov qword [rbp - 0x10], rax
xor r9d, r9d
lea rdx, [rbp - 0x28]
lea r12d, [r14 + 0x1d]
mov ecx, r13d
mov r8d, r12d
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rbp - 0x38]
test rbx, rbx
je 0x140170ac0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x140170ace
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.140077d50
mov rbx, qword [rbp - 0x40]
test rbx, rbx
je 0x140170af6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x58]
lea rbx, [0x140033aa0]
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov qword [rbp - 0x20], rbx
mov r8, r12
mov qword [rbp - 0x28], r14
lea rdx, [rbp - 0x28]
mov rcx, r13
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x140170b32
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x60]
xor r9d, r9d
mov qword [rbp - 0x10], rax
mov r8, r12
mov qword [rbp - 0x28], r14
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x20], rbx
mov rcx, r13
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rsp + 0xc8]
mov eax, r15d
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor esi, esi
jmp 0x140170b7d
xor edi, edi
mov ecx, 0x8007000e
mov r15d, ecx
jmp 0x140170816