Function at 0x14002cdb0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov rsi, r9
mov r13d, r8d
mov rbx, rdx
mov ebp, ecx
mov rax, qword [0x140145040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
test rdx, rdx
je 0x14002cdfe
mov edx, 0x100
mov rcx, rbx
call fcn.1400b5d48
cmp rax, 0x100
je 0x14002d642
cmp byte [0x140157aac], 0
je 0x14002cf1a
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsi], 0xffffffffffffffff
xor edi, edi
cmp byte [0x140157aad], 1
adc edi, 1
test ebp, ebp
cmovne edi, ebp
movabs r12, 0x7ffffffffffffff7
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test rbx, rbx
je 0x14002d12d
lea r14, [rsp + 0x40]
mov rcx, r14
mov rdx, rbx
call fcn.140013d00
mov cl, byte [r14 + 0x17]
test cl, cl
mov rax, qword [r14]
mov rdx, qword [r14 + 8]
movzx r15d, cl
mov r9, r15
cmovs r9, rdx
mov rbx, r14
cmovs rbx, rax
add r9, r9
test r9, r9
je 0x14002cfcc
lea r8, [r9 - 2]
cmp word [rbx + r9 - 2], 0x5c
mov r9, r8
je 0x14002ce98
cmp r8, 0xfffffffffffffffe
je 0x14002cfcc
sar r8, 1
lea r12, [r8 + 1]
test cl, cl
jns 0x14002cf43
cmp rdx, r8
jbe 0x14002cf2c
mov qword [rsp + 0x48], r12
lea rax, [rax + r12*2]
mov word [rax], 0
mov cl, byte [rsp + 0x57]
test cl, cl
js 0x14002cf35
movzx ecx, cl
lea rdx, [rsp + 0x40]
xor eax, eax
mov r8, 0xffffffffffffffff
test rcx, rcx
movabs r12, 0x7ffffffffffffff7
je 0x14002cf6a
add rcx, rcx
xor r9d, r9d
cmp word [rdx + r9], 0x5c
jne 0x14002cf64
add r9, 2
cmp rcx, r9
jne 0x14002cf07
jmp 0x14002cf6a
call fcn.14002d810
test al, al
jne 0x14002ce0b
jmp 0x14002d642
sub r12, rdx
jne 0x14002d519
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov al, 1
jmp 0x14002ceeb
cmp r8, r15
jae 0x14002d509
mov byte [rsp + 0x57], r12b
mov rax, r14
jmp 0x14002ced0
cmp r8, 0xffffffffffffffff
jne 0x14002cf78
jmp 0x14002d787
sar r9, 1
mov r8, r9
test al, al
je 0x14002cf59
cmp r8, 0xffffffffffffffff
je 0x14002d792
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14008be50
lea rbx, [rsp + 0x40]
movzx eax, byte [rbx + 0x17]
test al, al
cmovs rax, qword [rbx + 8]
mov rcx, qword [rbx]
cmovns rcx, rbx
test rax, rax
je 0x14002cff1
add rax, rax
xor r14d, r14d
cmp word [rcx + r14], 0x5c
je 0x14002cfb9
add r14, 2
cmp rax, r14
jne 0x14002cfa6
jmp 0x14002cff1
cmp rax, r14
je 0x14002cff1
cmp r14, 0xfffffffffffffffe
je 0x14002cff1
sar r14, 1
jmp 0x14002d493
test cl, cl
js 0x14002cfe3
mov word [rsp + 0x40], 0
mov byte [rsp + 0x57], 0
xor eax, eax
movzx eax, al
jmp 0x14002cffe
mov word [rax], 0
mov qword [rsp + 0x48], 0
mov al, byte [rsp + 0x57]
test al, al
jns 0x14002cfde
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14002d12d
bt r13d, 8
jae 0x14002d01c
mov eax, r13d
and eax, 0x200
jne 0x14002d12d
cmp edi, 2
lea rax, [0x140157ab0]
lea rcx, [0x140157cb0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x14002d12d
xorps xmm0, xmm0
lea rbx, [rsp + 0xa0]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbx], 0
je 0x14002d12d
cmp byte [0x1401580b0], 0
setne al
bt r13d, 8
jb 0x14002d12d
mov ecx, r13d
shr ecx, 9
and ecx, 1
or cl, al
je 0x14002d12d
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rbp, str.SOFTWARE
cmove rbp, rax
movzx r14d, byte [rsp + 0x57]
test r14b, r14b
jns 0x14002d652
mov rcx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r8d, 1
xor ebx, ebx
xor eax, eax
mov qword [rsp + 0x30], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], r13d
mov r13, r8
mov r12, qword [rbp + 8]
mov r15, r14
sub r15, r12
jb 0x14002d104
mov rdx, qword [rbp]
mov rsi, rcx
mov r8, r12
call fcn.1400b5adc
mov rcx, rsi
test eax, eax
je 0x14002d65c
add rbp, 0x28
inc rbx
mov r8, r13
cmp rbx, r8
movabs r12, 0x7ffffffffffffff7
mov r13d, dword [rsp + 0x24]
jb 0x14002d0db
cmp dword [rsp + 0x20], 0
jne 0x14002d7b4
cmp edi, 2
jne 0x14002d140
cmp word [0x140157ab0], 0
jne 0x14002d6e6
cmp edi, 1
jne 0x14002d153
cmp word [0x140157cb0], 0
jne 0x14002d71e
cmp edi, 2
lea rax, [0x140157eb0]
lea r14, str.RegistryMachine_
cmove r14, rax
mov rcx, r14
call fcn.1400b5304
cmp rax, r12
ja 0x14002d649
mov rbx, rax
cmp rax, 0xb
jae 0x14002d195
lea r15, [rsp + 0xa0]
mov byte [r15 + 0x17], bl
test rbx, rbx
jne 0x14002d1e5
jmp 0x14002d1f6
lea rax, [r12 + 5]
and rax, rbx
add rax, 4
mov rsi, rbx
or rsi, 3
cmp rsi, 0xb
cmove rsi, rax
inc rsi
js 0x14002d64f
lea rcx, [rsi + rsi]
call fcn.1400b4d4c
mov r15, rax
mov qword [rsp + 0xa0], rax
lea rax, [r12 + 9]
or rax, rsi
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, r14
call fcn.1400eabe0
mov word [r15 + rbx*2], 0
lea r14, [rsp + 0xa0]
movzx edi, byte [r14 + 0x17]
test dil, dil
cmovs rdi, qword [r14 + 8]
cmovs r14, qword [r14]
movzx eax, byte [rsp + 0x57]
lea rcx, [r12 + 8]
and rcx, qword [rsp + 0x50]
dec rcx
test al, al
mov rbx, rax
cmovs rbx, qword [rsp + 0x48]
mov esi, 0xa
cmovs rsi, rcx
mov rcx, rsi
sub rcx, rbx
cmp rcx, rdi
jb 0x14002d2c3
test rdi, rdi
je 0x14002d3b2
test al, al
js 0x14002d25b
lea r15, [rsp + 0x40]
jmp 0x14002d260
mov r15, qword [rsp + 0x40]
test rbx, rbx
je 0x14002d292
lea rax, [r15 + rbx*2]
xor ecx, ecx
cmp rax, r14
mov eax, 0
cmova rax, rdi
cmp r15, r14
cmova rax, rcx
lea r14, [r14 + rax*2]
lea rcx, [r15 + rdi*2]
lea r8, [rbx + rbx]
mov rdx, r15
call fcn.1400eabe0
lea r8, [rdi + rdi]
mov rcx, r15
mov rdx, r14
call fcn.1400eabe0
add rbx, rdi
cmp byte [rsp + 0x57], 0
js 0x14002d2bc
mov eax, ebx
and al, 0x7f
mov byte [rsp + 0x57], al
lea rax, [r15 + rbx*2]
jmp 0x14002d3ad
mov qword [rsp + 0x48], rbx
jmp 0x14002d2b3
lea rbp, [rbx + rdi]
mov rcx, rbp
sub rcx, rsi
mov rdx, rsi
not rdx
add rdx, r12
cmp rdx, rcx
jb 0x14002d64c
test al, al
mov dword [rsp + 0x24], r13d
js 0x14002d2ef
lea r15, [rsp + 0x40]
jmp 0x14002d2f4
mov r15, qword [rsp + 0x40]
movabs rax, 0x3ffffffffffffff3
mov r13, r12
cmp rsi, rax
jae 0x14002d340
lea rax, [rsi + rsi]
cmp rbp, rax
cmova rax, rbp
mov r13d, 0xb
cmp rax, 0xb
jb 0x14002d340
mov rcx, rax
and rcx, 0xfffffffffffffffc
add rcx, 4
or rax, 3
cmp rax, 0xb
cmove rax, rcx
inc rax
mov r13, rax
js 0x14002d784
lea rcx, [r13*2]
call fcn.1400b4d4c
mov r12, rax
lea r8, [rdi + rdi]
mov rcx, rax
mov rdx, r14
call fcn.1400eabe0
test rbx, rbx
je 0x14002d376
lea rcx, [r12 + rdi*2]
add rbx, rbx
mov rdx, r15
mov r8, rbx
call fcn.1400eabe0
cmp rsi, 0xa
je 0x14002d384
mov rcx, r15
call fcn.1400b4d44
mov qword [rsp + 0x40], r12
movabs rax, 0x7ffffffffffffff7
add rax, 9
or r13, rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], rbp
lea rax, [r12 + rbp*2]
mov r13d, dword [rsp + 0x24]
mov word [rax], 0
cmp byte [rsp + 0xb7], 0
jns 0x14002d3c9
mov rcx, qword [rsp + 0xa0]
call fcn.1400b4d44
cmp byte [rsp + 0x57], 0
mov rsi, qword [rsp + 0x38]
js 0x14002d3dc
lea rdx, [rsp + 0x40]
jmp 0x14002d3e1
mov rdx, qword [rsp + 0x40]
lea rbx, [rsp + 0x90]
mov rcx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
lea r8, [rsp + 0x60]
mov dword [r8], 0x30
mov qword [r8 + 8], 0
mov dword [r8 + 0x18], 0x40
mov qword [r8 + 0x10], rbx
xorps xmm0, xmm0
movaps xmmword [r8 + 0x20], xmm0
mov rcx, rsi
mov edx, r13d
xor r9d, r9d
call sub.ntdll.dll_NtOpenKeyEx
test eax, eax
setns sil
cmp byte [rsp + 0x57], 0
jns 0x14002d43e
mov rcx, qword [rsp + 0x40]
call fcn.1400b4d44
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400b7310
mov eax, esi
add rsp, 0xd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x40]
cmp word [rcx + r14*2 + 2], 0x5c
jne 0x14002d4c6
cmp rax, r14
jbe 0x14002d800
mov r8d, 1
mov rcx, rbx
call fcn.14008be50
cmp r14, 0xffffffffffffffff
je 0x14002cff1
movzx ecx, byte [rsp + 0x57]
test cl, cl
mov rax, qword [rsp + 0x48]
mov rdx, rcx
cmovs rdx, rax
cmp rdx, r14
jbe 0x14002d6e3
lea rdx, [r14 + 1]
test cl, cl
js 0x14002d464
cmp word [rsp + r14*2 + 0x42], 0x5c
mov rax, rcx
mov rcx, rbx
je 0x14002d472
cmp rax, rdx
jbe 0x14002cff1
lea r14, [r14*2 + 2]
add rax, rax
cmp word [rcx + r14], 0x5c
je 0x14002d4f0
add r14, 2
cmp rax, r14
jne 0x14002d4da
jmp 0x14002cff1
cmp rax, r14
je 0x14002cff1
sar r14, 1
jmp 0x14002d489
mov eax, r15d
and al, 0x7f
mov byte [rsp + 0x57], al
jmp 0x14002d56d
sub r12, r15
je 0x14002cee1
mov esi, 0xa
jmp 0x14002d539
mov rcx, qword [rsp + 0x50]
movabs r8, 0x7ffffffffffffff7
lea rsi, [r8 + 8]
and rsi, rcx
dec rsi
shr rcx, 0x38
mov r15, rdx
mov rdx, rsi
sub rdx, r15
cmp rdx, r12
jb 0x14002d576
test cl, cl
lea r14, [rsp + 0x40]
cmovs r14, rax
lea rcx, [r14 + r15*2]
lea r8, [r12 + r12]
xor edx, edx
call fcn.1400eb280
add r15, r12
cmp byte [rsp + 0x57], 0
jns 0x14002d4fe
mov qword [rsp + 0x48], r15
lea rax, [r14 + r15*2]
jmp 0x14002ced4
mov ebp, r13d
mov rax, r12
sub rax, rsi
add rax, r15
movabs r13, 0x7ffffffffffffff7
mov rcx, r13
sub rcx, rsi
cmp rcx, rax
jb 0x14002d803
movabs rax, 0x3ffffffffffffff3
cmp rsi, rax
jae 0x14002d5e8
lea rax, [rsi + rsi]
lea rcx, [r15 + r12]
cmp rcx, rax
cmova rax, rcx
mov r13d, 0xb
cmp rax, 0xb
jb 0x14002d5e8
mov rcx, rax
and rcx, 0xfffffffffffffffc
add rcx, 4
or rax, 3
cmp rax, 0xb
cmove rax, rcx
inc rax
mov r13, rax
js 0x14002d806
lea rcx, [r13*2]
call fcn.1400b4d4c
mov r14, rax
test r15, r15
je 0x14002d60c
lea r8, [r15 + r15]
mov rcx, r14
mov rdx, rbx
call fcn.1400eabe0
cmp rsi, 0xa
je 0x14002d61a
mov rcx, rbx
call fcn.1400b4d44
mov qword [rsp + 0x40], r14
movabs rax, 0x7ffffffffffffff7
add rax, 9
or r13, rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r15
mov r13d, ebp
jmp 0x14002d54f
xor esi, esi
jmp 0x14002d43e
int3
int3
int3
lea rcx, [rsp + 0x40]
jmp 0x14002d0b8
movzx r8d, word [rcx + r12*2]
cmp r8d, 0x5c
je 0x14002d670
test r8d, r8d
jne 0x14002d104
lea rax, [rcx + r12*2]
mov edx, dword [rbp + 0x10]
mov dword [rsp + 0x20], edx
cmp edx, 1
je 0x14002d69d
cmp dword [rsp + 0x20], 2
jne 0x14002d6ae
lea rdx, str.WOW6432Node
mov qword [rsp + 0x30], rdx
mov rdx, rax
mov qword [rsp + 0x28], rax
jmp 0x14002d6ae
lea rdx, str.WOW6432Node_
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rsi
cmp r8w, 0x5c
jne 0x14002d6cb
lea rcx, [rax + 2]
dec r15
cmp word [rax + 2], 0x5c
mov rdx, rcx
mov rax, rcx
je 0x14002d6b5
jmp 0x14002d6ce
mov rdx, rax
mov r8, qword [rbp + 0x20]
mov rbp, qword [rbp + 0x18]
xor ebx, ebx
mov r14, r15
mov rcx, rdx
jmp 0x14002d10e
int3
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401213c0]
movaps xmmword [rbx], xmm0
lea rdx, [0x140157eb0]
mov rcx, rbx
call fcn.140058780
lea r14, [0x140157ab0]
jmp 0x14002d754
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0xa0]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1401213c0]
movaps xmmword [rbx], xmm0
lea rdx, [0x140157eb0]
mov rcx, rbx
call fcn.140058780
lea r14, [0x140157cb0]
mov rcx, r14
call fcn.1400b5304
mov rcx, rbx
mov rdx, r14
mov r8, rax
call fcn.140059400
lea rdx, [0x140135b0c]
mov r8d, 1
mov rcx, rbx
call fcn.140059400
jmp 0x14002d1fd
int3
lea rax, [rsp + 0x40]
mov byte [rax + 0x17], 0
jmp 0x14002d7a0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], 0
mov word [rax], 0
movabs r12, 0x7ffffffffffffff7
jmp 0x14002cf84
lea r15, [rsp + 0x40]
cmp byte [r15 + 0x17], 0
mov rax, r15
jns 0x14002d7c8
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
sub rbx, rax
sar rbx, 1
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.1400b5304
mov rcx, r15
mov rdx, rbx
mov r8, rsi
mov r9, rax
call fcn.1400592e0
movabs r12, 0x7ffffffffffffff7
jmp 0x14002d12d
int3
int3
int3