Function at 0x140074610
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
cmp qword [rcx + 0x68], 0
mov rbx, rcx
jne 0x140074774
movsx r8d, byte [0x14015deb8]
mov edx, 4
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
shl r8, 3
mov qword [rsp + 0x98], rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
movsx r8d, byte [0x14015deb8]
xor r9d, r9d
shl r8d, 3
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140074758
movsx edi, byte [0x14015deb8]
xor r11d, r11d
xor edx, edx
cmp edi, 4
jb 0x1400746f2
mov eax, edi
mov r9d, edi
and eax, 3
xorps xmm2, xmm2
sub r9d, eax
movdqa xmm1, xmm2
mov r8d, 2
movq xmm0, qword [rsi + rdx*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rsi + rax*8]
add edx, 4
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rsi + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rsi + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r9d
jb 0x1400746a1
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
xor r8d, r8d
xor r9d, r9d
cmp edx, edi
jae 0x140074740
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x140074731
mov eax, edi
lea rcx, [rsi + rdx*8]
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov r10d, eax
lea edx, [rdx + rax*2]
nop word [rax + rax]
add r8, qword [rcx]
add r9, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r10, 1
jne 0x140074720
cmp edx, edi
jae 0x140074739
add r11, qword [rsi + rdx*8]
lea rax, [r9 + r8]
add r11, rax
mov rax, r11
sub rax, qword [rbx + 0x618]
mov qword [rbx + 0x620], rax
mov qword [rbx + 0x618], r11
mov rcx, qword [sym.ProcessJacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x98]
jmp 0x1400747c0
mov rax, qword [rcx + 0x70]
mov rcx, qword [rax + 0x48]
test rcx, rcx
je 0x1400747c0
mov r9d, 0x10
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400747c0
mov rcx, qword [rsp + 0x30]
mov rax, rcx
sub rax, qword [rbx + 0x618]
mov qword [rbx + 0x620], rax
mov qword [rbx + 0x618], rcx
mov rax, qword [rbx + 0x618]
or edi, 0xffffffff
test rax, rax
je 0x1400747fc
xor r8d, r8d
mov dword [rsp + 0x40], 0x10009
lea edx, [rdi + 2]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call sym.ProcessJacker.exe_PhFormat
mov rcx, qword [rbx + 0x7c0]
mov qword [rbx + 0x7c0], rax
jmp 0x14007480e
mov rcx, qword [rbx + 0x7c0]
mov qword [rbx + 0x7c0], 0
test rcx, rcx
je 0x140074828
add rcx, 0xfffffffffffffff0
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140074828
call fcn.1400ae900
mov rax, qword [rbx + 0x620]
test rax, rax
je 0x140074862
xor r8d, r8d
mov dword [rsp + 0x60], 0x10009
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea edx, [r8 + 1]
call sym.ProcessJacker.exe_PhFormat
mov rcx, qword [rbx + 0x7c8]
mov qword [rbx + 0x7c8], rax
jmp 0x140074874
mov rcx, qword [rbx + 0x7c8]
mov qword [rbx + 0x7c8], 0
test rcx, rcx
je 0x14007488c
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x14007488c
call fcn.1400ae900
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret