Function at 0x180002e50
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
mov rax, qword [rdx + 8]
mov rsi, r9
mov r14, rdx
mov r15, rcx
cmp qword [rdx], rax
jne 0x180002ec9
movzx r9d, byte [0x1800ac76a]
lea rcx, [rbp - 0x41]
xor edx, edx
call fcn.180005c90
cmp byte [rbp - 0x39], 0
je 0x180002eaf
mov rax, qword [rbp - 0x41]
mov qword [r15], rax
mov rax, r15
mov byte [r15 + 8], 1
add rsp, 0xa8
pop r15
pop r14
pop rsi
pop rbp
ret
mov byte [r15], 0
mov rax, r15
mov byte [r15 + 8], 0
add rsp, 0xa8
pop r15
pop r14
pop rsi
pop rbp
ret
xorps xmm0, xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xa0], rdi
lea rcx, [rbp - 0x19]
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [r14]
mov rdx, qword [rbp - 0x11]
mov r8, qword [rbp - 9]
mov r9, r8
mov rcx, qword [rax]
mov rax, rcx
mov r12, rcx
sub rax, rdx
sub r12, rsi
cmp rax, rsi
mov rax, r8
cmovbe r12, rdx
sub rax, rcx
cmp rax, rsi
jbe 0x180002f35
lea r9, [rcx + rsi]
mov eax, dword [rbp + 0xf]
cmp r12, rdx
cmovb r12, rdx
cmp r8, r9
cmovb r9, r8
lea r13, [rax - 1]
lea rdi, [rax - 1]
mov qword [rbp + 0x6f], r9
add rdi, rcx
not r13
and rdi, r13
mov rbx, rdi
cmp rdi, r12
jbe 0x180003042
mov qword [rbp + 0x17], rsi
nop dword [rax + rax]
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp - 0x49], rbx
cmp r8, r9
je 0x180002fa8
mov rdx, qword [r8]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
cmp rbx, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x180003042
add r8, 8
cmp r8, r9
jne 0x180002f80
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.180005d50
cmp byte [rbp - 1], 0
je 0x180003042
mov rax, qword [rbp - 9]
shr rax, 8
test al, al
je 0x18000302f
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], rbx
cmp r8, r9
je 0x180003004
nop
mov rdx, qword [r8]
mov rax, rbx
sub rax, rdx
mov rcx, rdx
sub rcx, rbx
cmp rbx, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x18000302f
add r8, 8
cmp r8, r9
jne 0x180002fe0
movzx r9d, byte [0x1800ac76a]
lea rcx, [rbp - 0x29]
mov r8, qword [rbp + 0x77]
mov rdx, rbx
call fcn.180005c90
cmp byte [rbp - 0x21], 0
je 0x18000302f
mov rax, qword [rbp - 0x29]
test rax, rax
jne 0x1800031b2
mov rbx, qword [rbp - 0x19]
dec rbx
and rbx, r13
cmp rbx, r12
ja 0x180002f70
mov rbx, qword [rbp + 0x6f]
cmp rdi, rbx
jae 0x180003178
mov qword [rbp + 0x6f], rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp - 0x41], rdi
cmp r8, r9
je 0x180003098
mov rdx, qword [r8]
mov rax, rdi
sub rax, rdx
mov rcx, rdx
sub rcx, rdi
cmp rdi, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x180003178
add r8, 8
cmp r8, r9
jne 0x180003070
xorps xmm0, xmm0
lea rdx, [rbp - 0x19]
mov r8d, 0x30
mov rcx, rdi
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180003178
mov ecx, dword [rbp + 0xb]
mov eax, ecx
and al, 0x70
neg al
sbb dl, dl
and dl, 4
test cl, 0x66
setne al
and cl, 0x44
or dl, al
neg cl
sbb al, al
and al, 2
or dl, al
cmp dword [rbp + 7], 0x10000
mov byte [rbp - 0x31], dl
sete byte [rbp - 0x30]
mov rax, qword [rbp - 0x31]
shr rax, 8
test al, al
je 0x18000316b
mov r9, qword [r14 + 8]
mov r8, qword [r14]
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x49], rdi
cmp r8, r9
je 0x180003144
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [r8]
mov rax, rdi
sub rax, rdx
mov rcx, rdx
sub rcx, rdi
cmp rdi, rdx
cmovbe rax, rcx
cmp rax, rsi
ja 0x18000316b
add r8, 8
cmp r8, r9
jne 0x180003120
movzx r9d, byte [0x1800ac76a]
lea rcx, [rbp - 0x29]
mov r8, qword [rbp + 0x77]
mov rdx, rdi
call fcn.180005c90
cmp byte [rbp - 0x21], 0
je 0x18000316b
mov rax, qword [rbp - 0x29]
test rax, rax
jne 0x1800031b2
add rdi, qword [rbp - 1]
cmp rdi, rbx
jb 0x180003060
mov byte [r15], 1
mov byte [r15 + 8], 0
mov r12, qword [rsp + 0x98]
mov rax, r15
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x90]
add rsp, 0xa8
pop r15
pop r14
pop rsi
pop rbp
ret
mov qword [r15], rax
mov byte [r15 + 8], 1
jmp 0x180003181