Function at 0x1401c1b68
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword [rbp + 0x88]
xor r14d, r14d
mov rdi, qword [rbp + 0x80]
mov r13, rcx
mov qword [rbp - 0x68], r8
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x58], rdx
xor edx, edx
lea r8d, [r14 + 0x48]
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
call sub.msvcrt.dll_memset
mov rax, qword gs:[0x58]
lea rsi, [0x1403dd550]
mov edx, 4
lea r15d, [r14 + 1]
lea rbx, str.msft:sl_EUL_ACTIVATED_PUBLIC
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140452ec0], eax
jg 0x1401c1fdd
mov rax, qword [rdi]
mov rbx, qword [rax + 0x28]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
jns 0x1401c1c46
mov ecx, eax
call fcn.140082a8c
jmp 0x1401c1eeb
cmp dword [rsp + 0x50], r15d
mov r12d, r15d
mov eax, 2
mov r15d, r14d
cmove r12d, eax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1401c1c84
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rsp + 0x40], r14
mov rsi, qword [r13 + 0x18]
xor edi, edi
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
test r15d, r15d
jne 0x1401c1cb4
cmp dword [0x140452f70], 1
cmove rdi, qword [0x140452540]
jmp 0x1401c1cc9
mov r14d, 1
cmp dword [0x140452f70], r14d
cmove rdi, qword [0x140452548]
call rax
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
mov rax, rbx
call rax
mov ebx, eax
test eax, eax
js 0x1401c1ee1
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14016e754
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea r9, [0x140452ed0]
mov rdx, qword [rbp - 0x70]
mov qword [rsp + 0x30], rcx
mov rcx, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call fcn.1401c2ac0
mov ebx, eax
test eax, eax
js 0x1401c1ee1
test r14d, r14d
je 0x1401c1e96
mov rax, qword [rsp + 0x48]
mov rcx, r13
mov r8, qword [rsp + 0x40]
mov rdx, qword [r13 + 0x10]
mov r9, qword [rax]
call fcn.1401c2968
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x1401c1c3a
mov rsi, qword [rbp - 0x68]
mov rax, qword [rsi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rsp + 0x40]
mov rax, rbx
xor r8d, r8d
mov rcx, rsi
call rax
mov ebx, eax
test eax, eax
js 0x1401c1c3a
mov rax, qword [rsp + 0x48]
or rsi, 0xffffffffffffffff
mov rcx, qword [rax]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1401c1da0
cmp rax, 0x26
jne 0x1401c1e62
cmp word [rcx], 0x7b
je 0x1401c1dca
mov edi, 0x80070057
mov ecx, edi
mov ebx, edi
call fcn.140082a8c
jmp 0x1401c1df0
cmp word [rcx + 0x4a], 0x7d
jne 0x1401c1dba
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.140078228
mov ebx, eax
test eax, eax
jns 0x1401c1deb
mov ecx, eax
call fcn.140082a8c
mov edi, 0x80070057
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x1401c1eda
lea r8, [rsp + 0x54]
lea rdx, str.msft:sl_EUL_ACTIVATED_PUBLIC
lea rcx, [rsp + 0x58]
call fcn.1400c8318
test al, al
je 0x1401c1e87
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1401c1e2e
cmp rax, 0x26
jne 0x1401c1e71
cmp word [rcx], 0x7b
jne 0x1401c1e77
cmp word [rcx + 0x4a], 0x7d
jne 0x1401c1e77
add rcx, 2
lea rdx, [rbp - 0x30]
call fcn.140078228
mov edx, eax
test eax, eax
jns 0x1401c1e80
mov ecx, eax
jmp 0x1401c1e7b
cmp rax, 0x24
jne 0x1401c1dba
jmp 0x1401c1dd5
cmp rax, 0x24
je 0x1401c1e4f
mov edx, edi
mov ecx, edi
call fcn.140082a8c
mov ecx, edx
call fcn.140082b34
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x50]
call fcn.1401875c4
jmp 0x1401c1ec3
mov rsi, qword [rbp - 0x58]
mov rax, qword [rsi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rsp + 0x40]
mov rax, rbx
xor r8d, r8d
mov rcx, rsi
call rax
xor r14d, r14d
mov ebx, eax
test eax, eax
js 0x1401c1c3a
inc r15d
cmp r15d, r12d
jge 0x1401c1eeb
jmp 0x1401c1c5a
mov ecx, ebx
jmp 0x1401c1c3c
mov ecx, eax
call fcn.140082a8c
xor r14d, r14d
mov ecx, ebx
call fcn.140082b34
mov r13d, 3
mov qword [rsp + 0x78], r14
lea rax, [0x14004a1dc]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp - 0x50]
mov r15d, 0xb9
lea esi, [r13 + 0x1d]
mov qword [rbp - 0x80], rax
mov r8d, esi
xor r9d, r9d
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14002ee5c]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], r14
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8d, esi
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1401c1f88
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x48], r14
lea rax, [0x140028cdc]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], r14
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8, rsi
mov rcx, r15
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140389660
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x140452ec0]
call fcn.140389a9c
cmp dword [0x140452ec0], 0xffffffff
jne 0x1401c1c0c
or dword [0x140452ee4], 0xffffffff
lea rax, str.metaInfoType
xorps xmm0, xmm0
mov qword [0x140452ed0], rax
xor eax, eax
mov qword [0x140452ed8], r14
mov qword [0x140452ef8], rax
lea rcx, [0x140452ec0]
mov qword [0x140452f10], rax
movups xmmword [0x140452ee8], xmm0
mov dword [0x140452ef8], r14d
movups xmmword [0x140452f00], xmm0
mov dword [0x140452efc], r15d
mov dword [0x140452f10], r15d
mov dword [0x140452f14], 0x18
mov dword [0x140452ee0], r14d
mov qword [0x140452ee8], rsi
mov qword [0x140452ef0], r14
mov qword [0x140452f00], rbx
mov qword [0x140452f08], r14
call fcn.140389a2c
jmp 0x1401c1c0c