Function at 0x140006d40
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x398]
sub rsp, 0x498
lea rcx, [0x14007b9e0]
call fcn.140018420
cmp al, 1
jne 0x140006d7e
mov al, 1
add rsp, 0x498
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x20], rax
lea r9, str.ViewState
mov r8, qword [0x14007ba00]
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140018080
test al, al
jne 0x140006de4
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x20], rax
lea r9, str.ViewState
mov r8, qword [0x14007ba00]
mov rdx, 0xffffffff80000001
lea rcx, [0x14007b9e1]
call fcn.140018080
test al, al
je 0x140007109
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x20], rax
lea r9, str.CacheTag
mov r8, qword [0x14007ba00]
mov rdx, 0xffffffff80000002
lea rcx, [0x14007b9e1]
call fcn.140018080
test al, al
jne 0x140006e4a
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x20], rax
lea r9, str.CacheTag
mov r8, qword [0x14007ba00]
mov rdx, 0xffffffff80000001
lea rcx, [0x14007b9e1]
call fcn.140018080
test al, al
je 0x140007109
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x70]
call fcn.140041b60
call fcn.140004200
mov rcx, rax
test rax, rax
je 0x14000711b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x3d0], rax
lea r8, [rbp + 0x3d0]
mov rcx, qword [0x14007ba08]
call fcn.140013440
test al, al
je 0x140006eed
lea rdx, str.ThisUser
mov rbx, qword [rbp + 0x3d0]
mov rcx, rbx
call fcn.140044b14
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x140006ecd
mov r9, rdi
lea r8, str.Registered_User
mov edx, 0x200
lea rcx, [rbp - 0x70]
call fcn.140047c08
xor esi, esi
mov word [rbp - 0x70], si
mov r9, rdi
mov r8, rbx
mov edx, 0x200
lea rcx, [rbp - 0x70]
call fcn.140047c08
nop
jmp 0x140006f9e
mov rdx, qword [rbp + 0x3d0]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006f14
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140004200
mov rcx, rax
test rax, rax
je 0x14000711b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x3d8], rax
lea r8, [rbp + 0x3d8]
mov rcx, qword [0x14007ba08]
call fcn.140013440
test al, al
je 0x1400070eb
lea rdx, str.ThisUser
mov rbx, qword [rbp + 0x3d8]
mov rcx, rbx
call fcn.140044b14
test eax, eax
jne 0x140006f83
mov r9, rdi
lea r8, str.Registered_User
mov edx, 0x200
lea rcx, [rbp - 0x70]
call fcn.140047c08
xor esi, esi
mov word [rbp - 0x70], si
mov r9, rdi
mov r8, rbx
mov edx, 0x200
lea rcx, [rbp - 0x70]
call fcn.140047c08
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140006fb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x3e0]
mov r14, qword [rbp + 0x3e8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r8d, si
mov edx, esi
cmp word [rbp - 0x70], 0
je 0x14000701a
lea rax, [rbp - 0x70]
mov rcx, rdi
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140006ff6
mov rax, rsi
cmp rax, rcx
jae 0x14000701a
add r8w, word [rbp + rax*2 - 0x70]
inc edx
mov eax, edx
cmp word [rbp + rdx*2 - 0x70], 0
jne 0x140007003
movzx ecx, word [rsp + 0x5c]
shl rcx, 0x10
movzx eax, word [rsp + 0x5e]
or rcx, rax
and ecx, 0xfffff
movzx eax, r8w
shl rax, 0x14
or rcx, rax
shl rcx, 8
movzx eax, byte [rsp + 0x50]
or rcx, rax
shl rcx, 0x10
movzx eax, word [rsp + 0x54]
or rcx, rax
shl rcx, 4
mov rax, qword [rsp + 0x30]
and eax, 0xf
or rcx, rax
xor rcx, r14
movabs r15, 0x917aa921821c49ab
xor rcx, r15
cmp rcx, rbx
je 0x140006d6c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, esi
cmp word [rbp - 0x70], 0
je 0x1400070c8
lea rax, [rbp - 0x70]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400070a5
mov rax, rsi
cmp rax, rdi
jae 0x1400070c8
add si, word [rbp + rax*2 - 0x70]
inc ecx
mov eax, ecx
cmp word [rbp + rcx*2 - 0x70], 0
jne 0x1400070b2
movzx eax, si
shl rax, 0x30
xor rax, r14
xor rax, r15
cmp rax, rbx
sete al
add rsp, 0x498
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdx, qword [rbp + 0x3d8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140007109
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
add rsp, 0x498
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003f50
int3