Function at 0x140073bc0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14023cac0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, rdx
mov r13, rcx
mov qword [rbp + 0xf], rcx
xor esi, esi
lea rcx, [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp - 0x39]
cmp rax, qword [rbp - 0x31]
jae 0x140073ed3
movabs r14, 0x7fffffffffffffff
movabs r15, 0x8000000000000000
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x30
lea r8, [rbp - 0x71]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x140073ed3
cmp dword [rbp - 0x51], 0x1000
jne 0x140073ec1
mov eax, dword [rbp - 0x4d]
test al, 4
je 0x140073ec1
bt eax, 8
jb 0x140073ec1
mov rdi, qword [rbp - 0x59]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp - 1], rsi
mov qword [rbp + 7], rsi
cmp rdi, r14
ja 0x140073fd0
cmp rdi, 0xf
ja 0x140073cb8
mov qword [rbp - 1], rdi
mov qword [rbp + 7], recv
mov r8, rdi
xor edx, edx
lea rcx, [rbp - 0x11]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + rdi - 0x11], 0
jmp 0x140073d41
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x140073ccd
mov rbx, r14
lea rax, [r15 + 0x27]
jmp 0x140073cf4
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140073d13
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140073fca
mov rcx, rax
call fcn.14019e660
test rax, rax
je 0x140073fc3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140073d20
test rcx, rcx
je 0x140073d20
call fcn.14019e660
mov rsi, rax
mov qword [rbp - 0x11], rsi
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rbx
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov byte [rsi + rdi], 0
mov rdi, qword [rbp - 0x59]
lea r8, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova r8, qword [rbp - 0x11]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rbp - 0x71]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140073fb6
mov rcx, qword [rbp + 0xf]
mov rdx, qword [rbp - 1]
cmp rcx, rdx
ja 0x140073d95
mov qword [rbp - 1], rcx
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0xf
cmova rax, qword [rbp - 0x11]
mov byte [rax + rcx], 0
jmp 0x140073de0
mov rdi, rcx
sub rdi, rdx
mov r8, qword [rbp + 7]
mov rax, r8
sub rax, rdx
cmp rdi, rax
ja 0x140073dd1
mov qword [rbp - 1], rcx
lea rbx, [rbp - 0x11]
cmp r8, 0xf
cmova rbx, qword [rbp - 0x11]
add rbx, rdx
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
jmp 0x140073de0
mov r9, rdi
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.140072fe0
lea rdi, [rbp - 0x11]
mov rbx, qword [rbp - 0x11]
mov rsi, qword [rbp + 7]
cmp rsi, 0xf
cmova rdi, rbx
mov r15, qword [rbp - 1]
cmp r15, 6
jb 0x140073e7e
lea r14, [r15 + rdi]
lea r8, [r14 - 5]
sub r8, rdi
mov edx, 0x54
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140073e74
xor eax, eax
lea rdx, str.TRACE_
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140073e48
cmp rax, 6
jne 0x140073e30
xor eax, eax
jmp 0x140073e4d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140073f1f
inc r9
lea r8, [r14 - 5]
sub r8, r9
mov edx, 0x54
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140073e22
movabs r14, 0x7fffffffffffffff
movabs r15, 0x8000000000000000
cmp rsi, 0xf
jbe 0x140073ebf
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140073eb7
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140073fc3
mov rcx, rbx
call fcn.14019e6a4
xor esi, esi
mov rax, qword [rbp - 0x71]
add rax, qword [rbp - 0x59]
cmp rax, qword [rbp - 0x31]
jb 0x140073c30
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], rsi
xor r8d, r8d
lea rdx, [0x140215ef0]
mov rcx, r13
call fcn.140071cb0
mov rax, r13
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14019e640
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub r9, rdi
cmp r9, 0xffffffffffffffff
je 0x140073e74
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
cmp r15, r9
jb 0x140073fd6
sub r15, r9
mov r8, 0xffffffffffffffff
cmp r15, r8
cmovb r8, r15
lea rdx, [rbp - 0x11]
cmp rsi, 0xf
cmova rdx, rbx
add rdx, r9
mov rcx, r13
call fcn.140071cb0
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x140073ef5
inc rdx
mov rcx, qword [rbp - 0x11]
mov r8, rcx
cmp rdx, 0x1000
jb 0x140073fac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x140073fc3
call fcn.14019e6a4
jmp 0x140073ef5
mov rsi, qword [rbp + 7]
mov rbx, qword [rbp - 0x11]
jmp 0x140073e88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140070ea0
int3
call fcn.140070f40
nop
call fcn.1400747b0
int3