Function at 0x14003aa60
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r13, r9
mov r15d, r8d
mov rdi, rdx
mov ebx, ecx
mov rax, qword [0x14010c038]
xor rax, rsp
mov qword [rsp + 0xd0], rax
test rdx, rdx
je 0x14003aaae
mov edx, 0x100
mov rcx, rdi
call fcn.1400925ac
cmp rax, 0x100
je 0x14003aed0
cmp byte [0x140115cc0], 0
je 0x14003aec3
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [r13], 0xffffffffffffffff
cmp byte [0x140115cc1], 1
mov r12d, 1
adc r12d, 0
test ebx, ebx
cmovne r12d, ebx
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test rdi, rdi
je 0x14003ac94
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rdi
call fcn.140058750
movzx eax, byte [rsi + 0x17]
test al, al
js 0x14003ae58
mov rcx, rax
add rcx, rcx
test rcx, rcx
je 0x14003ab4e
lea rdx, [rcx - 2]
cmp word [rsi + rcx - 2], 0x5c
mov rcx, rdx
je 0x14003ab30
cmp rdx, 0xfffffffffffffffe
jne 0x14003ae7f
test al, al
js 0x14003ae67
mov word [rsp + 0x40], 0
mov byte [rsp + 0x57], 0
movzx eax, byte [rsp + 0x57]
test al, al
jns 0x14003ab70
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14003ac94
mov eax, 0x300
mov ecx, r15d
and ecx, eax
cmp ecx, eax
je 0x14003ac94
cmp r12d, 2
lea rax, [0x140115f20]
lea rcx, [0x140116120]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14003ac94
xorps xmm0, xmm0
lea rsi, [rsp + 0xa0]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x14003ac94
cmp byte [0x140115f10], 0
setne al
bt r15d, 8
jb 0x14003ac94
mov ecx, r15d
shr ecx, 9
and ecx, 1
or cl, al
je 0x14003ac94
cmp r12d, 2
lea rax, str.SOFTWAREClasses
lea rdi, str.SOFTWARE
cmove rdi, rax
movzx r14d, byte [rsp + 0x57]
test r14b, r14b
mov qword [rsp + 0x38], r13
jns 0x14003b1c6
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov dword [rsp + 0x24], r15d
mov ebp, 1
xor r13d, r13d
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rsi, qword [rdi + 8]
mov r15, r14
sub r15, rsi
jb 0x14003ac73
mov rdx, qword [rdi]
mov rcx, rbx
mov r8, rsi
call fcn.14008df08
test eax, eax
je 0x14003b040
add rdi, 0x28
inc r13
cmp r13, rbp
jb 0x14003ac51
cmp dword [rsp + 0x20], 0
mov r15d, dword [rsp + 0x24]
mov r13, qword [rsp + 0x38]
jne 0x14003b1d0
cmp r12d, 2
jne 0x14003aca8
cmp word [0x140115f20], 0
jne 0x14003b08b
movabs r14, 0x7fffffffffffffef
cmp r12d, 1
jne 0x14003acc6
cmp word [0x140116120], 0
jne 0x14003b118
cmp r12d, 2
lea rax, [0x140116330]
lea rdi, str.RegistryMachine_
cmove rdi, rax
mov rcx, rdi
call fcn.140092480
cmp rax, r14
ja 0x14003b1b9
mov rbx, rax
cmp rax, 0xb
jae 0x14003ae0d
mov byte [rsp + 0xb7], bl
lea rsi, [rsp + 0xa0]
test rbx, rbx
je 0x14003ad24
cmp rbx, 3
jne 0x14003ae42
movzx eax, word [rdi + 4]
mov word [rsi + 4], ax
mov eax, dword [rdi]
mov dword [rsi], eax
mov word [rsi + rbx*2], 0
lea rdi, [rsp + 0xa0]
movzx r9d, byte [rdi + 0x17]
test r9b, r9b
cmovs r9, qword [rdi + 8]
mov r8, qword [rdi]
cmovns r8, rdi
lea rsi, [rsp + 0x40]
mov rcx, rsi
xor edx, edx
call fcn.140058350
cmp byte [rdi + 0x17], 0
jns 0x14003ad68
mov rcx, qword [rsp + 0xa0]
call fcn.140078974
mov rbx, qword [rsp + 0x140]
cmp byte [rsp + 0x57], 0
jns 0x14003ad7c
mov rsi, qword [rsp + 0x40]
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov rdx, rsi
call qword [0x140115cd8]
lea r8, [rsp + 0x60]
mov dword [r8], 0x30
mov qword [r8 + 8], 0
mov dword [r8 + 0x18], 0x40
mov qword [r8 + 0x10], rdi
xorps xmm0, xmm0
movaps xmmword [r8 + 0x20], xmm0
mov rcx, r13
mov edx, r15d
xor r9d, r9d
call qword [0x140115ce0]
test rbx, rbx
jne 0x14003b039
test eax, eax
setns sil
cmp byte [rsp + 0x57], 0
jns 0x14003ade7
mov rcx, qword [rsp + 0x40]
call fcn.140078974
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400797f0
mov eax, esi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140078938
mov rsi, rax
mov qword [rsp + 0xa0], rax
add r14, 0x11
or r14, rbp
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xa8], rbx
mov r8, rbx
add r8, rbx
mov rcx, rsi
mov rdx, rdi
call fcn.14007bca0
jmp 0x14003ad24
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jmp 0x14003ab2d
mov rax, qword [rsp + 0x40]
mov word [rax], 0
mov qword [rsp + 0x48], 0
jmp 0x14003ab62
sar rdx, 1
inc rdx
lea rdi, [rsp + 0x40]
mov rcx, rdi
xor r8d, r8d
call fcn.140059250
movzx eax, byte [rdi + 0x17]
test al, al
js 0x14003aed7
mov rcx, rax
mov r8, 0xffffffffffffffff
test rcx, rcx
je 0x14003aee9
add rcx, rcx
xor edx, edx
cmp word [rdi + rdx], 0x5c
jne 0x14003aee3
add rdx, 2
cmp rcx, rdx
jne 0x14003aeb1
jmp 0x14003aee9
call fcn.14003a730
test al, al
jne 0x14003aabb
xor esi, esi
jmp 0x14003ade7
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jmp 0x14003aea0
sar rdx, 1
mov r8, rdx
test al, al
jns 0x14003b010
cmp r8, 0xffffffffffffffff
je 0x14003b204
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.140059060
mov al, byte [rsp + 0x57]
test al, al
js 0x14003af3a
lea rcx, [rsp + 0x40]
movzx edx, al
test rdx, rdx
je 0x14003ab62
add rdx, rdx
xor esi, esi
cmp word [rcx + rsi], 0x5c
je 0x14003af46
add rsi, 2
cmp rdx, rsi
jne 0x14003af25
jmp 0x14003ab62
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x14003af17
cmp rdx, rsi
je 0x14003ab62
cmp rsi, 0xfffffffffffffffe
je 0x14003ab62
sar rsi, 1
lea rbx, [rsp + 0x40]
lea rdx, [rsi + 1]
test al, al
js 0x14003af94
movzx ecx, word [rsp + rsi*2 + 0x42]
cmp cx, 0x5c
jne 0x14003afab
movzx eax, al
cmp rax, rsi
jbe 0x14003b02f
mov r8d, 1
mov rcx, rbx
call fcn.140059060
mov al, byte [rsp + 0x57]
jmp 0x14003af61
mov rax, qword [rsp + 0x40]
movzx ecx, word [rax + rsi*2 + 2]
cmp cx, 0x5c
jne 0x14003b009
mov rax, qword [rsp + 0x48]
jmp 0x14003af77
movzx ebp, al
mov rax, rbx
cmp rbp, rdx
jbe 0x14003ab62
add rsi, rsi
lea rdx, [rbp - 4]
add rdx, rbp
cmp cx, 0x5c
je 0x14003afe2
cmp rdx, rsi
je 0x14003ab62
movzx ecx, word [rax + rsi + 4]
add rsi, 2
jmp 0x14003afc8
lea rax, [rbp - 2]
add rax, rbp
cmp rax, rsi
je 0x14003ab62
cmp rsi, 0xfffffffffffffffc
je 0x14003ab62
add rsi, 2
sar rsi, 1
jmp 0x14003af8e
mov rbp, qword [rsp + 0x48]
jmp 0x14003afb1
cmp r8, 0xffffffffffffffff
jne 0x14003aefb
lea rcx, [rsp + 0x40]
mov word [rcx], 0
mov byte [rcx + 0x17], 0
xor eax, eax
jmp 0x14003af14
lea rcx, [rsp + 0x40]
call fcn.1400c54b0
mov dword [rbx], eax
jmp 0x14003add0
movzx ecx, word [rbx + rsi*2]
cmp cx, 0x5c
je 0x14003b053
test cx, cx
jne 0x14003ac73
lea rax, [rbx + rsi*2]
mov edx, dword [rdi + 0x10]
mov dword [rsp + 0x20], edx
cmp edx, 1
je 0x14003b2b8
cmp dword [rsp + 0x20], 2
jne 0x14003b2c9
lea rdx, str.WOW6432Node
mov qword [rsp + 0x30], rdx
mov rdx, rax
mov qword [rsp + 0x28], rax
jmp 0x14003b2c9
movabs rsi, 0x7fffffffffffffef
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1400ec9c0]
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [0x140116330]
call fcn.140092480
cmp rax, rsi
ja 0x14003b1b9
mov rbx, rax
cmp rax, 0xb
jae 0x14003b21c
mov byte [rsp + 0xb7], bl
lea rdi, [rsp + 0xa0]
test rbx, rbx
je 0x14003b109
cmp rbx, 3
jne 0x14003b251
movzx eax, word [0x140116334]
mov word [rdi + 4], ax
mov eax, dword [0x140116330]
mov dword [rdi], eax
mov word [rdi + rbx*2], 0
lea rdx, [0x140115f20]
jmp 0x14003b195
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0xb0], rax
movaps xmm0, xmmword [0x1400ec9c0]
movaps xmmword [rsp + 0xa0], xmm0
lea rcx, [0x140116330]
call fcn.140092480
cmp rax, r14
ja 0x14003b1b9
mov rbx, rax
cmp rax, 0xb
jae 0x14003b26b
mov byte [rsp + 0xb7], bl
lea rdi, [rsp + 0xa0]
test rbx, rbx
je 0x14003b188
cmp rbx, 3
jne 0x14003b29e
movzx eax, word [0x140116334]
mov word [rdi + 4], ax
mov eax, dword [0x140116330]
mov dword [rdi], eax
mov word [rdi + rbx*2], 0
lea rdx, [0x140116120]
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.140023cd0
lea rdx, [0x1400f32b8]
mov rcx, rsi
call fcn.140023cd0
jmp 0x14003ad2a
lea rcx, [rsp + 0xa0]
call fcn.1400c5490
lea rbx, [rsp + 0x40]
jmp 0x14003ac2e
cmp byte [rsp + 0x57], 0
js 0x14003b2f8
lea rax, [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
sub rdx, rax
sar rdx, 1
lea rcx, [rsp + 0x40]
mov r8, qword [rsp + 0x30]
call fcn.140023ca0
mov r15d, dword [rsp + 0x24]
jmp 0x14003ac94
mov rax, qword [rsp + 0x40]
mov word [rax], 0
mov qword [rsp + 0x48], 0
jmp 0x14003af07
lea rbp, [rbx + 8]
and rbp, 0xfffffffffffffff8
mov rcx, rbp
add rcx, rbp
call fcn.140078938
mov rdi, rax
mov qword [rsp + 0xa0], rax
add rsi, 0x11
or rsi, rbp
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [0x140116330]
mov rcx, rdi
call fcn.14007bca0
jmp 0x14003b109
lea rsi, [rbx + 8]
and rsi, 0xfffffffffffffff8
lea rcx, [rsi + rsi]
call fcn.140078938
mov rdi, rax
mov qword [rsp + 0xa0], rax
add r14, 0x11
or r14, rsi
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xa8], rbx
mov r8, rbx
add r8, rbx
lea rdx, [0x140116330]
mov rcx, rdi
call fcn.14007bca0
jmp 0x14003b188
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rbx
cmp cx, 0x5c
jne 0x14003b2e2
lea rbx, [rax + 2]
dec r15
cmp word [rax + 2], 0x5c
mov rax, rbx
je 0x14003b2cf
jmp 0x14003b2e5
mov rbx, rax
mov rbp, qword [rdi + 0x20]
mov rdi, qword [rdi + 0x18]
xor r13d, r13d
mov r14, r15
jmp 0x14003ac7a
mov rax, qword [rsp + 0x40]
jmp 0x14003b1e0