Function at 0x140182358
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor ebx, ebx
xor edi, edi
and qword [rbp - 0x30], rbx
xor esi, esi
and dword [rbp + 0x58], ebx
mov r13, r8
mov r14, rcx
mov qword [rbp - 0x38], rbx
mov qword [rbp + 0x60], rdi
cmp dword [r8 + 4], ebx
jle 0x140182567
xor r12d, r12d
mov r15, qword [r13 + 8]
add r15, r12
test rbx, rbx
je 0x1401823ca
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
and qword [rbp - 0x38], 0
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.140072318
mov esi, eax
test eax, eax
js 0x140182878
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x140182409
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
and qword [rbp - 0x30], 0
mov r14, qword [r14 + 0x18]
xor esi, esi
cmp dword [0x140452a78], 1
cmove rsi, qword [0x140452158]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x30]
mov rdx, rsi
mov rcx, r14
call rax
mov esi, eax
test eax, eax
js 0x140182878
and qword [rsp + 0x30], 0
lea r9, [0x1403ec10c]
mov rbx, qword [rbp - 0x38]
mov r8d, 1
and qword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x20], rbx
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
xor r14d, r14d
cmp dword [r15 + 0x14], r14d
jle 0x14018251a
test rdi, rdi
je 0x1401824b9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
and qword [rbp + 0x60], 0
movsxd rcx, r14d
lea rdx, [rbp + 0x60]
shl rcx, 4
add rcx, qword [r15 + 0x18]
call fcn.140072318
mov esi, eax
test eax, eax
js 0x1401826f2
and qword [rsp + 0x30], 0
lea r9, str.skuId
mov rdi, qword [rbp + 0x60]
xor r8d, r8d
and qword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x48]
mov qword [rsp + 0x20], rdi
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
inc r14d
cmp r14d, dword [r15 + 0x14]
jl 0x140182493
mov r15, qword [rbp + 0x50]
mov rax, qword [r15]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x30]
mov rax, rsi
xor r8d, r8d
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401826e6
mov ecx, dword [rbp + 0x58]
add r12, 0x20
mov r14, qword [rbp + 0x48]
inc ecx
mov dword [rbp + 0x58], ecx
cmp ecx, dword [r13 + 4]
jl 0x14018239d
and dword [rbp + 0x58], 0
cmp dword [r13 + 0x24], 0
jle 0x140182883
xor r12d, r12d
mov r15, qword [r13 + 0x28]
add r15, r12
test rbx, rbx
je 0x1401825a6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
and qword [rbp - 0x38], 0
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.140072318
mov esi, eax
test eax, eax
js 0x140182878
mov rbx, qword [rbp - 0x30]
test rbx, rbx
je 0x1401825e5
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
and qword [rbp - 0x30], 0
mov r14, qword [r14 + 0x18]
xor esi, esi
cmp dword [0x140452a78], 1
cmove rsi, qword [0x140452160]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x30]
mov rdx, rsi
mov rcx, r14
call rax
mov esi, eax
test eax, eax
js 0x140182878
and qword [rsp + 0x30], 0
lea r9, str.pkeyId
mov r14, qword [rbp + 0x48]
mov r8d, 1
mov rbx, qword [rbp - 0x38]
mov rcx, r14
and qword [rsp + 0x28], 0
mov rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rbx
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
mov rax, qword [0x1403d7020]
cmp rax, qword [r15 + 0x10]
jne 0x140182702
mov rcx, qword [0x1403d7028]
cmp rcx, qword [r15 + 0x18]
jne 0x140182702
lea rdx, [r15 + 0x20]
cmp rax, qword [rdx]
jne 0x140182696
cmp rcx, qword [rdx + 8]
je 0x140182777
lea r8, [rbp + 0x60]
lea rcx, [r13 + 0x10]
call fcn.140183c0c
test al, al
je 0x140182777
test rbx, rbx
je 0x1401826d1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
and qword [rbp - 0x38], 0
movsxd rax, dword [rbp + 0x60]
mov rcx, qword [r13 + 0x18]
shl rax, 5
add rax, 0x10
add rcx, rax
jmp 0x14018272c
mov ecx, eax
call fcn.140082a8c
jmp 0x140182883
mov ecx, eax
call fcn.140082a8c
mov rdi, qword [rbp + 0x60]
jmp 0x140182883
test rbx, rbx
je 0x140182728
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
and qword [rbp - 0x38], 0
lea rcx, [r15 + 0x10]
lea rdx, [rbp - 0x38]
call fcn.140072318
mov esi, eax
test eax, eax
js 0x140182878
and qword [rsp + 0x30], 0
lea r9, str.skuId
mov rbx, qword [rbp - 0x38]
mov r8d, 1
and qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], rbx
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
mov rax, qword [r15 + 0x30]
test rax, rax
je 0x1401827b4
and qword [rsp + 0x30], 0
lea r9, [0x1403ebf54]
and qword [rsp + 0x28], 0
mov r8d, 1
mov rdx, qword [rbp - 0x30]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
mov rax, qword [r15 + 0x38]
test rax, rax
je 0x1401827f1
and qword [rsp + 0x30], 0
lea r9, str.pid2
and qword [rsp + 0x28], 0
mov r8d, 1
mov rdx, qword [rbp - 0x30]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
mov rax, qword [r15 + 0x40]
test rax, rax
je 0x14018282e
and qword [rsp + 0x30], 0
lea r9, [0x1403ec0cc]
and qword [rsp + 0x28], 0
mov r8d, 1
mov rdx, qword [rbp - 0x30]
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1401836fc
mov esi, eax
test eax, eax
js 0x1401826e6
mov r15, qword [rbp + 0x50]
mov rax, qword [r15]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x30]
mov rax, rsi
xor r8d, r8d
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401826e6
mov ecx, dword [rbp + 0x58]
add r12, 0x48
inc ecx
mov dword [rbp + 0x58], ecx
cmp ecx, dword [r13 + 0x24]
jge 0x140182883
jmp 0x140182579
mov ecx, eax
call fcn.140082a8c
mov rbx, qword [rbp - 0x38]
mov ecx, esi
call fcn.140082b34
and qword [rbp - 0x18], 0
lea rax, [0x140028cdc]
xor r9d, r9d
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x28], 3
lea rdx, [rbp - 0x28]
mov qword [rbp - 0x10], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
test rdi, rdi
je 0x1401828e0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
test rbx, rbx
je 0x140182901
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov eax, esi
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret