Function at 0x1400dc440
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x118
mov eax, dword [0x140140870]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x522
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x140140878]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x523
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x140140874]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x524
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x14014086c]
mov ecx, dword [0x14014106c]
sub ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x525
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x14014106c]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x526
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408e4]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x527
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408cc]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x528
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408ec]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x529
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408e8]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x52a
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408b0]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x52b
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc6bb
mov eax, dword [0x14013ed04]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x52d
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc6d4
lea r8, [0x1401229c8]
mov edx, 0x52d
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc70c
mov eax, dword [0x14013ecdc]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x52e
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc725
lea r8, [0x1401229c8]
mov edx, 0x52e
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x1401408b4]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x52f
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc795
mov eax, dword [0x14013ed04]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x531
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc7ae
lea r8, [0x1401229c8]
mov edx, 0x531
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc7e6
mov eax, dword [0x14013ec5c]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x532
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc7ff
lea r8, [0x1401229c8]
mov edx, 0x532
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x14013ecf9]
test eax, eax
je 0x1400dc86f
cmp qword [0x14013ef90], 0
jne 0x1400dc81e
cmp qword [0x14013ece0], 0
je 0x1400dc86f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call fcn.1400dd0e0
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x50]
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
jmp 0x1400dc8a9
call sym.ProcessHacker.exe_KphIsConnected
movzx eax, al
test eax, eax
jne 0x1400dc893
lea rax, str.no_driver
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
jmp 0x1400dc8a9
lea rax, str.no_symbols
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x38]
mov edx, 0x52c
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov r8, qword [rsp + 0x28]
mov edx, 0x530
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc90f
mov eax, dword [0x14013ecd4]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x558
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc928
lea r8, [0x1401229c8]
mov edx, 0x558
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc960
mov eax, dword [0x14013f0f4]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x559
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc979
lea r8, [0x1401229c8]
mov edx, 0x559
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dc9b1
mov eax, dword [0x14013eef4]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x55a
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dc9ca
lea r8, [0x1401229c8]
mov edx, 0x55a
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [0x14013ef50], 1
jbe 0x1400dca02
mov eax, dword [0x14013ecf4]
mov dl, 1
mov ecx, eax
call sym.ProcessHacker.exe_PhFormatUInt64
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x55b
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dca1b
lea r8, [0x1401229c8]
mov edx, 0x55b
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3c
jb 0x1400dcf9c
xor r9d, r9d
mov r8d, 0xb0
lea rdx, [rsp + 0x60]
mov ecx, 0x50
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1400dce3e
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x20], 0
jmp 0x1400dca6f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jae 0x1400dcab0
mov eax, dword [rsp + 0x20]
mov rax, qword [rsp + rax*8 + 0x88]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov rax, qword [rsp + rax*8 + 0xc8]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1400dca65
mov rax, qword [rsp + 0x60]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x534
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [rsp + 0x68]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x535
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [rsp + 0x70]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x536
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [rsp + 0x78]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x537
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rax, qword [rsp + 0x30]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x539
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 0
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x542
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 1
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x543
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 2
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x544
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 3
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x545
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 4
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x554
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 5
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x555
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 6
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x556
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 8
imul rax, rax, 7
mov rax, qword [rsp + rax + 0x88]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x557
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [sym.ProcessHacker.exe_WindowsVersion], 0x3e
jb 0x1400dce20
mov rax, qword [rsp + 0x108]
imul rax, rax, 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessHacker.exe_PhFormatSize
mov rcx, rax
call fcn.140006e90
mov r8, qword [rax + 8]
mov edx, 0x55d
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dce39
lea r8, [0x14011d660]
mov edx, 0x55d
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x1400dcf9c
lea r8, [0x14011d660]
mov edx, 0x534
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x535
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x536
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x537
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x55d
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x539
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x542
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x543
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x544
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x545
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x554
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x555
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x556
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x14011d660]
mov edx, 0x557
mov rcx, qword [0x14013ed10]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
add rsp, 0x118
ret