Function at 0x140185bec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x29]
lea r8d, [rdx + 0x48]
call sub.msvcrt.dll_memset
lea r14, [rsi + 0x20]
mov rdx, rdi
mov rcx, r14
lea r8, [rbp - 0x69]
xor ebx, ebx
call fcn.140187354
test al, al
je 0x140185dff
movsxd rax, dword [rbp - 0x69]
mov rcx, qword [0x1403d9ec0]
mov rsi, qword [rsi + 0x28]
lea r14, [rax + rax*8]
cmp rcx, qword [rdi + 0x10]
jne 0x140185c70
mov rax, qword [0x1403d9ec8]
cmp rax, qword [rdi + 0x18]
je 0x140185c89
movups xmm0, xmmword [rdi + 0x10]
movdqu xmmword [rsi + r14*8 + 0x10], xmm0
mov rax, qword [0x1403d9ec8]
mov rcx, qword [0x1403d9ec0]
cmp rcx, qword [rdi + 0x20]
jne 0x140185c95
cmp rax, qword [rdi + 0x28]
je 0x140185ca0
movups xmm0, xmmword [rdi + 0x20]
movdqu xmmword [rsi + r14*8 + 0x20], xmm0
cmp qword [rdi + 0x30], rbx
je 0x140185d1a
lea r15, [rsi + r14*8]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
je 0x140185cd4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
and qword [r15 + 0x30], 0
mov r13, qword [rdi + 0x30]
test r13, r13
jne 0x140185ce5
xor ebx, ebx
and qword [r15 + 0x30], rbx
jmp 0x140185d0b
mov ebx, dword [r13 - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [r15 + 0x30]
mov edx, ebx
mov rcx, r13
call fcn.14007a9ac
mov ebx, eax
test eax, eax
jns 0x140185d0b
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140185f5b
cmp qword [rdi + 0x38], 0
je 0x140185d95
lea r15, [rsi + r14*8]
mov rbx, qword [r15 + 0x38]
test rbx, rbx
je 0x140185d4f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
and qword [r15 + 0x38], 0
mov r13, qword [rdi + 0x38]
test r13, r13
jne 0x140185d60
xor ebx, ebx
and qword [r15 + 0x38], rbx
jmp 0x140185d86
mov ebx, dword [r13 - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [r15 + 0x38]
mov edx, ebx
mov rcx, r13
call fcn.14007a9ac
mov ebx, eax
test eax, eax
jns 0x140185d86
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140185f5b
cmp qword [rdi + 0x40], 0
je 0x140185f62
lea rsi, [rsi + r14*8]
mov rbx, qword [rsi + 0x40]
test rbx, rbx
je 0x140185dce
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
and qword [rsi + 0x40], 0
mov rdi, qword [rdi + 0x40]
test rdi, rdi
jne 0x140185de2
xor ebx, ebx
and qword [rsi + 0x40], rbx
jmp 0x140185f50
mov ebx, dword [rdi - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [rsi + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.14007a9ac
jmp 0x140185f43
movups xmm0, xmmword [rdi]
mov rsi, qword [rdi + 0x30]
movups xmm1, xmmword [rdi + 0x10]
movdqu xmmword [rbp - 0x29], xmm0
movups xmm0, xmmword [rdi + 0x20]
movdqu xmmword [rbp - 0x19], xmm1
movdqu xmmword [rbp - 9], xmm0
test rsi, rsi
je 0x140185e56
mov ebx, dword [rsi - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [rbp + 7]
mov edx, ebx
mov rcx, rsi
call fcn.14007a9ac
mov ebx, eax
test eax, eax
jns 0x140185e47
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140185f5b
mov rsi, qword [rdi + 0x38]
test rsi, rsi
je 0x140185e93
mov ebx, dword [rsi - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [rbp + 0xf]
mov edx, ebx
mov rcx, rsi
call fcn.14007a9ac
mov ebx, eax
test eax, eax
jns 0x140185e84
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140185f5b
mov rdi, qword [rdi + 0x40]
test rdi, rdi
je 0x140185ed0
mov ebx, dword [rdi - 4]
xor ecx, ecx
call fcn.14007ace8
lea r8, [rbp + 0x17]
mov edx, ebx
mov rcx, rdi
call fcn.14007a9ac
mov ebx, eax
test eax, eax
jns 0x140185ec1
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
js 0x140185f5b
lea r8, [rbp - 0x69]
mov rcx, r14
lea rdx, [rbp - 0x29]
call fcn.140187354
test al, al
je 0x140185f34
mov rdx, qword [r14 + 8]
xor r9d, r9d
movsxd rax, dword [rbp - 0x69]
mov qword [rbp - 0x61], 3
lea r8d, [r9 + 0x28]
lea rcx, [rax + rax*8]
lea rax, [rdx + rcx*8]
lea rcx, [0x140048c1c]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x59], rcx
lea rax, [rbp - 0x29]
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x51], rcx
lea rdx, [rbp - 0x61]
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
xor ebx, ebx
jmp 0x140185f50
mov edx, dword [rbp - 0x69]
lea r8, [rbp - 0x29]
mov rcx, r14
call fcn.1401875ec
mov ebx, eax
test eax, eax
jns 0x140185f50
mov ecx, eax
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
test ebx, ebx
jns 0x140185f62
mov ecx, ebx
call fcn.14007ac40
mov ecx, ebx
call fcn.14007ace8
lea rcx, [rbp - 0x29]
call fcn.140185690
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140388a50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret