Function at 0x14000a940
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1401452e0
push rdi
sub rsp, 0x90
lea rdi, [rsp + 0x30]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x30], 0
movzx eax, byte [0x1405e42d0]
test eax, eax
je 0x1401453af
mov eax, dword [0x1405e39a0]
imul rax, rax, 0x18
xor r9d, r9d
mov r8d, eax
mov rdx, qword [0x1405e39a8]
mov ecx, 0x17
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x140145365
mov eax, dword [0x1405e39a0]
imul rax, rax, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [0x1405e39a8]
call fcn.1400139e0
mov dword [rsp + 0x38], 0
jmp 0x140145379
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [0x1405e39a0]
cmp dword [rsp + 0x38], eax
jae 0x1401453aa
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x18
mov rcx, qword [0x1405e39a8]
mov eax, dword [rcx + rax + 4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x14014536f
jmp 0x1401454be
xor eax, eax
mov word [rsp + 0x3c], ax
xor eax, eax
mov word [rsp + 0x44], ax
jmp 0x1401453cc
movzx eax, word [rsp + 0x44]
inc ax
mov word [rsp + 0x44], ax
movzx eax, word [rsp + 0x44]
movzx ecx, word [0x1405e42d4]
cmp eax, ecx
jge 0x140145479
movzx ecx, word [rsp + 0x44]
call fcn.14001bdb0
mov word [rsp + 0x54], ax
movzx eax, word [rsp + 0x54]
imul rax, rax, 0x18
movzx ecx, word [rsp + 0x3c]
imul rcx, rcx, 0x18
mov rdx, qword [0x1405e39a8]
add rdx, rcx
mov rcx, rdx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
mov r9, rcx
mov r8d, 2
lea rdx, [rsp + 0x44]
mov ecx, 0x17
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
test eax, eax
jge 0x140145461
movzx eax, word [rsp + 0x54]
imul rax, rax, 0x18
movzx ecx, word [rsp + 0x3c]
imul rcx, rcx, 0x18
mov rdx, qword [0x1405e39a8]
add rdx, rcx
mov rcx, rdx
mov r8, rax
xor edx, edx
call fcn.1400139e0
movzx eax, word [rsp + 0x54]
movzx ecx, word [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov word [rsp + 0x3c], ax
jmp 0x1401453bf
mov dword [rsp + 0x38], 0
jmp 0x14014548d
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [0x1405e39a0]
cmp dword [rsp + 0x38], eax
jae 0x1401454be
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x18
mov rcx, qword [0x1405e39a8]
mov eax, dword [rcx + rax + 4]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x140145483
mov eax, dword [0x1405e39c8]
mov ecx, dword [0x1405e8008]
sub ecx, eax
mov eax, ecx
mov dword [0x1405e39cc], eax
mov eax, dword [0x1405e8008]
mov dword [0x1405e39c8], eax
mov eax, dword [0x1405e39d0]
mov ecx, dword [0x1405e7ec8]
sub ecx, eax
mov eax, ecx
mov dword [0x1405e39d4], eax
mov eax, dword [0x1405e7ec8]
mov dword [0x1405e39d0], eax
mov rax, qword [0x1405e39d8]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov qword [0x1405e39e0], rax
mov rax, qword [rsp + 0x30]
mov qword [0x1405e39d8], rax
mov eax, dword [0x1405e39e8]
mov ecx, dword [0x1405e8014]
sub ecx, eax
mov eax, ecx
mov dword [0x1405e39ec], eax
mov eax, dword [0x1405e8014]
mov dword [0x1405e39e8], eax
movzx eax, byte [0x1405e42d0]
test eax, eax
je 0x14014559d
mov eax, dword [0x1405e39a0]
imul rax, rax, 0x18
mov dword [rsp + 0x20], eax
mov r9, qword [0x1405e39b0]
xor r8d, r8d
xor edx, edx
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jge 0x140145598
mov eax, dword [0x1405e39a0]
imul rax, rax, 0x18
mov r8, rax
xor edx, edx
mov rcx, qword [0x1405e39b0]
call fcn.1400139e0
jmp 0x14014565e
xor eax, eax
mov word [rsp + 0x58], ax
xor eax, eax
mov word [rsp + 0x64], ax
jmp 0x1401455ba
movzx eax, word [rsp + 0x64]
inc ax
mov word [rsp + 0x64], ax
movzx eax, word [rsp + 0x64]
movzx ecx, word [0x1405e42d4]
cmp eax, ecx
jge 0x14014565e
movzx ecx, word [rsp + 0x64]
call fcn.14001bdb0
mov word [rsp + 0x74], ax
movzx eax, word [rsp + 0x74]
imul rax, rax, 0x18
movzx ecx, word [rsp + 0x58]
imul rcx, rcx, 0x18
mov rdx, qword [0x1405e39b0]
add rdx, rcx
mov rcx, rdx
mov dword [rsp + 0x20], eax
mov r9, rcx
mov r8d, 2
lea rdx, [rsp + 0x64]
mov ecx, 0x2e
call qword [sym.imp.ntdll.dll_NtPowerInformation]
test eax, eax
jge 0x140145646
movzx eax, word [rsp + 0x74]
imul rax, rax, 0x18
movzx ecx, word [rsp + 0x58]
imul rcx, rcx, 0x18
mov rdx, qword [0x1405e39b0]
add rdx, rcx
mov rcx, rdx
mov r8, rax
xor edx, edx
call fcn.1400139e0
movzx eax, word [rsp + 0x74]
movzx ecx, word [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov word [rsp + 0x58], ax
jmp 0x1401455ad
cmp qword [0x1405e39c0], 0
je 0x140145674
mov rcx, qword [0x1405e39c0]
call sym.ProcessHacker.exe_PhFree
mov rax, qword [0x1405e39b8]
mov qword [0x1405e39c0], rax
mov qword [0x1405e39b8], 0
lea rcx, [0x1405e39b8]
call fcn.14000a430
cmp dword [0x1405e3998], 2
jae 0x1401456b0
mov eax, dword [0x1405e3998]
inc eax
mov dword [0x1405e3998], eax
call fcn.140014960
call fcn.140014210
mov rcx, rsp
lea rdx, [0x1404d1570]
call fcn.140015750
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x90
pop rdi
ret