Function at 0x14001c4d8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov r14, rcx
xor esi, esi
cmp byte [rcx + 0xe1], sil
jne 0x14001c968
or r12d, 0xffffffff
cmp byte [rcx + 0xe2], sil
je 0x14001c764
cmp byte [rcx + 0xe0], sil
je 0x14001c66c
lea r12d, [rsi + 1]
mov dword [rcx + 0xe0], 0x10000
mov rax, qword [rcx + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c993
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.1400189e4
mov dword [rbx + 0x60], esi
mov edx, esi
mov ecx, esi
lea rax, [0x14002c810]
cmp dword [rax + rcx*8], 2
je 0x14001c583
inc edx
inc rcx
cmp edx, 4
jb 0x14001c566
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c5f1
mov r13d, esi
lea r15, [0x14002c830]
lea rax, [rax + rcx*8]
add rax, 4
mov qword [rsp + 0xc8], rax
mov bl, byte [rax]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [0x140026788]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [0x140026788]
inc r13d
mov rax, qword [rsp + 0xc8]
inc rax
mov qword [rsp + 0xc8], rax
lea r15, [r15 + 4]
cmp r13d, 3
jb 0x14001c59d
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x58]
test eax, eax
je 0x14001c60a
cmp eax, 5
jne 0x14001c636
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x14001c636
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r14 + 0x90]
test rcx, rcx
je 0x14001c656
call fcn.140019398
test eax, eax
js 0x14001c987
mov byte [r14 + 0xe3], r12b
movabs rax, 0x7fffffffffffffff
mov qword [r14 + 0xd0], rax
jmp 0x14001c95d
cmp byte [rcx + 0xe3], sil
je 0x14001c95d
mov r12d, esi
mov word [rcx + 0xe0], 1
mov rax, qword [rcx + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c9a4
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.1400189e4
mov dword [rbx + 0x60], esi
mov edx, esi
mov rcx, rsi
lea rax, [0x14002c810]
cmp dword [rax + rcx*8], 3
je 0x14001c6d4
inc edx
inc rcx
cmp edx, 4
jb 0x14001c6b7
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c742
mov r13d, esi
lea r15, [0x14002c830]
lea rax, [rax + rcx*8]
add rax, 4
mov qword [rsp + 0xc8], rax
mov bl, byte [rax]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [0x140026788]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [0x140026788]
inc r13d
mov rax, qword [rsp + 0xc8]
inc rax
mov qword [rsp + 0xc8], rax
lea r15, [r15 + 4]
cmp r13d, 3
jb 0x14001c6ee
mov rcx, qword [r14 + 0x90]
test rcx, rcx
je 0x14001c95d
call fcn.1400194f4
test eax, eax
js 0x14001c998
jmp 0x14001c95d
mov edx, 1
lea ecx, [rdx + 0x17]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_378]
mov rbx, rax
test rax, rax
jne 0x14001c780
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1135]
mov rax, qword [r14 + 8]
mov dword [rbx], 1
mov dword [rbx + 4], esi
mov qword [rbx + 8], rax
lea rdi, [rbx + 0x10]
mov qword [rdi], rsi
mov dword [rsp + 0x30], 0x20
mov eax, 0x7d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14001de30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
je 0x14001c7c9
mov qword [rdi], rsi
mov rdi, qword [r14 + 0xa0]
cmp rdi, rbx
je 0x14001c7f2
test rdi, rdi
je 0x14001c7eb
mov rcx, rdi
call fcn.14001dddc
mov rcx, rdi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1110]
mov qword [r14 + 0xa0], rbx
mov rcx, r14
call fcn.14001b58c
mov ebx, eax
test eax, eax
jns 0x14001c877
lea rax, str.SH_ErrorCode
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], ebx
mov word [rsp + 0x54], si
lea rax, [0x140027ea8]
mov qword [rsp + 0x40], rax
lea rax, [0x140027e80]
mov qword [rsp + 0x58], rax
lea rax, [0x1400291f0]
mov qword [rsp + 0x60], rax
lea rax, str.StartRecording__
mov qword [rsp + 0x68], rax
mov word [rsp + 0x70], si
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, str.OnRecordButtonClicked
mov ecx, 0x12dd2c2
call fcn.140009b50
test ebx, ebx
js 0x14001c9a9
mov r12d, 1
mov dword [r14 + 0xe0], 0x10000
mov rax, qword [r14 + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c9b5
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.1400189e4
mov dword [rbx + 0x60], esi
mov edx, esi
mov rcx, rsi
lea rax, [0x14002c810]
cmp dword [rax + rcx*8], 2
je 0x14001c8d7
inc edx
inc rcx
cmp edx, 4
jb 0x14001c8ba
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c92b
lea r15, [0x14002c830]
lea r13, [rax + 4]
lea r13, [r13 + rcx*8]
mov bl, byte [r13]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [0x140026788]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [0x140026788]
inc esi
inc r13
lea r15, [r15 + 4]
cmp esi, 3
jb 0x14001c8e7
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [0x140026788]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], r12b
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, r10
call qword [0x140026788]
nop
mov edx, r12d
mov rcx, r14
call fcn.14001b9f4
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 0x235e119b
mov ecx, eax
call fcn.14000810c
call fcn.140007aa8
mov edx, 0x235e119c
mov ecx, eax
call fcn.14000810c
call fcn.140007aa8
mov edx, 0x235e119a
mov ecx, ebx
call fcn.14000810c
call fcn.140007aa8
int3