Function at 0x140001f24
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x50
xor edi, edi
xor r14d, r14d
mov r15, rdx
mov r13, rcx
cmp rdx, 0x40
jae 0x140001f62
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400021cb
mov eax, dword [rcx + 0x3c]
add eax, 0xe0
movsxd rcx, eax
lea rax, [rcx + 0x108]
cmp r15, rax
jb 0x140001f52
lea rbp, [rcx + r13]
cmp dword [rbp], 0x100c
je 0x140001f8d
mov ecx, 0xc1
jmp 0x140001f57
mov eax, 0x8664
cmp word [rbp + 4], ax
jne 0x140001f86
test byte [rbp + 0x38], 1
jne 0x140001f86
movzx eax, word [rbp + 6]
movzx ecx, word [rbp + 0x14]
mov r9d, dword [rbp + 0x38]
test eax, eax
je 0x140001fdb
lea rdx, [rbp + 0x24]
mov r8d, eax
add rdx, rcx
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x140001fc6
mov eax, dword [rdx]
add rax, r9
jmp 0x140001fca
mov eax, dword [rdx]
add eax, ecx
cmp rax, rdi
cmova rdi, rax
add rdx, 0x28
sub r8, 1
jne 0x140001fb8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x24]
mov eax, dword [rbp + 0x50]
lea rbx, [rdx - 1]
add rbx, rax
lea rcx, [rdx - 1]
add rcx, rdi
lea rax, [rdx - 1]
not rax
and rbx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
cmp rbx, rcx
jne 0x140001f86
mov rax, qword [0x140017c08]
mov rdi, qword [rbp + 0x30]
test rax, rax
jne 0x140002042
mov rcx, qword [0x140017c00]
lea rdx, [0x140014458]
call fcn.1400013fc
mov qword [0x140017c08], rax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
mov rcx, rdi
call rax
mov rsi, rax
test rax, rax
jne 0x1400020a9
mov rax, qword [0x140017c08]
test rax, rax
jne 0x140002084
mov rcx, qword [0x140017c00]
lea rdx, [0x140014458]
call fcn.1400013fc
mov qword [0x140017c08], rax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call rax
mov rsi, rax
test rax, rax
jne 0x1400020a9
mov ecx, 0xe
jmp 0x140001f57
lea rcx, [rsi + rbx]
mov rax, rsi
jmp 0x14000211b
mov ecx, 0x10
call fcn.140003a94
mov rdi, rax
test rax, rax
je 0x140002203
mov qword [rax], r14
mov r14, rax
mov qword [rax + 8], rsi
mov rax, qword [0x140017c08]
test rax, rax
jne 0x1400020f8
mov rcx, qword [0x140017c00]
lea rdx, [0x140014458]
call fcn.1400013fc
mov qword [0x140017c08], rax
mov r9d, 4
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call rax
mov rsi, rax
test rax, rax
je 0x1400021ec
lea rcx, [rax + rbx]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x1400020b2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002203
mov qword [rax + 8], rsi
movzx eax, word [rbp + 0x16]
and qword [rdi + 0x58], 0
shr eax, 0xd
and eax, 1
mov dword [rdi + 0x20], eax
lea rax, [0x140001e44]
mov qword [rdi + 0x28], rax
lea rax, [0x140001eb0]
mov qword [rdi + 0x30], rax
lea rax, [0x140001f0c]
mov qword [rdi + 0x38], rax
lea rax, [0x140001f14]
mov qword [rdi + 0x40], rax
lea rax, [0x140001f1c]
mov qword [rdi + 0x48], rax
mov eax, dword [rsp + 0x24]
mov dword [rdi + 0x68], eax
mov qword [rdi + 0x70], r14
mov ebx, dword [rbp + 0x54]
cmp r15, rbx
jae 0x14000223b
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call fcn.1400024f8
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov rcx, rdi
lea rdx, [0x140001eb0]
xor r8d, r8d
call fcn.1400017f8
jmp 0x14000209f
mov rax, qword [0x140017c10]
test rax, rax
jne 0x140002229
mov rcx, qword [0x140017c00]
lea rdx, [0x140014468]
call fcn.1400013fc
mov qword [0x140017c10], rax
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call rax
mov rcx, r14
jmp 0x1400021ef
mov rax, qword [0x140017c08]
test rax, rax
jne 0x140002261
mov rcx, qword [0x140017c00]
lea rdx, [0x140014458]
call fcn.1400013fc
mov qword [0x140017c08], rax
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call rax
mov r8d, dword [rbp + 0x54]
mov rdx, r13
mov rcx, rax
mov rbx, rax
call fcn.14000bf70
mov eax, dword [r13 + 0x3c]
mov r9, rdi
add eax, 0xe0
mov r8, rbp
cdqe
mov rdx, r15
add rax, rbx
mov rcx, r13
mov qword [rdi], rax
mov qword [rax + 0x30], rsi
call fcn.140001854
test eax, eax
je 0x1400021c3
mov rax, qword [rdi]
mov rdx, qword [rax + 0x30]
sub rdx, qword [rbp + 0x30]
je 0x1400022cf
mov rcx, rdi
call fcn.140001c18
mov dword [rdi + 0x24], eax
jmp 0x1400022d6
mov dword [rdi + 0x24], 1
mov rcx, rdi
call fcn.140001cd0
test eax, eax
je 0x1400021c3
mov rcx, rdi
call fcn.140001a84
test eax, eax
je 0x1400021c3
mov rax, qword [rdi]
mov rbp, qword [rdi + 8]
cmp dword [rax + 0xd0], 0
je 0x140002330
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + rbp + 0x18]
test rbx, rbx
je 0x140002330
jmp 0x140002328
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x140002318
mov rax, qword [rdi]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x14000236d
cmp dword [rdi + 0x20], 0
lea rax, [rsi + rcx]
je 0x140002367
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x14000235e
mov ecx, 0x45a
jmp 0x1400021bd
mov dword [rdi + 0x1c], 1
jmp 0x140002372
mov qword [rdi + 0x60], rax
jmp 0x140002372
and qword [rdi + 0x60], 0
mov rax, rdi
jmp 0x1400021cd