Function at 0x1400156d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rdi, [0x14007e040]
mov qword [rsp + 0x30], rdi
xor ebx, ebx
mov qword [0x14007e044], rbx
mov qword [0x14007e060], rbx
mov qword [0x14007e058], rbx
mov qword [0x14007e8a8], rbx
mov qword [0x14007e8a0], rbx
mov dword [0x14007e040], ebx
mov dword [0x14007e068], ebx
mov dword [0x14007e274], ebx
mov dword [0x14007e480], ebx
mov qword [0x14007e04c], rbx
mov dword [0x14007e054], ebx
mov qword [0x14007e898], rbx
mov dword [0x14007e8b8], ebx
mov qword [0x14007e8b0], 0xffffffffffffffff
xor edx, edx
mov r8d, 0x208
lea rcx, [0x14007e06c]
call fcn.14005af20
xor edx, edx
mov r8d, 0x208
lea rcx, [0x14007e278]
call fcn.14005af20
xor edx, edx
mov r8d, 0x208
lea rcx, [0x14007e484]
call fcn.14005af20
xor edx, edx
mov r8d, 0x208
lea rcx, [0x14007e68c]
call fcn.14005af20
xor edx, edx
mov r8d, 0x2698
lea rcx, [0x14007e8bc]
call fcn.14005af20
mov qword [0x140080f58], rbx
mov qword [0x140080f60], rbx
lea ecx, [rbx + 0x30]
call fcn.140039944
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x140080f58], rax
lea rcx, [0x140080f68]
call fcn.140038070
nop
lea rcx, [0x140080fc8]
call fcn.1400330b0
nop
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f12
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081108], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f1d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081128], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f28
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081130], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f33
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400811e0], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f3e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081210], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f49
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081218], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f54
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081220], rax
xorps xmm0, xmm0
movdqa xmmword [0x140081240], xmm0
mov qword [0x140081250], rbx
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f5f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081278], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f6a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081280], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f75
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081288], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f80
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081290], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f8b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x140081298], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f96
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400812a0], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015fa1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400812a8], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015fac
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400812b0], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140015f07
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400812b8], rax
mov qword [0x1400813b0], rbx
mov qword [0x1400813b8], rbx
lea ecx, [rbx + 0x30]
call fcn.140039944
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1400813b0], rax
xorps xmm0, xmm0
movdqa xmmword [0x1400813c0], xmm0
mov qword [0x1400813d0], rbx
mov qword [0x1400813d8], rbx
movdqa xmmword [0x1400813e0], xmm0
movdqa xmmword [0x1400813f0], xmm0
mov qword [0x140081400], rbx
mov qword [0x140081408], rbx
movdqa xmmword [0x140081410], xmm0
movdqa xmmword [0x140081420], xmm0
mov qword [0x140081430], rbx
mov qword [0x140081438], rbx
movdqa xmmword [0x140081440], xmm0
movdqa xmmword [0x140081450], xmm0
mov qword [0x140081460], rbx
mov dword [0x140081468], ebx
movdqa xmmword [0x140081470], xmm0
xorps xmm1, xmm1
movups xmmword [0x140081480], xmm1
movups xmmword [0x140081490], xmm1
movups xmmword [0x1400814a0], xmm1
mov qword [0x1400814b0], rbx
lea edx, [rbx + 2]
lea rcx, [0x140081468]
call fcn.140038d0c
nop
mov qword [0x1400814b8], rbx
xorps xmm0, xmm0
movdqa xmmword [0x1400814c0], xmm0
movdqa xmmword [0x1400814d0], xmm0
mov qword [0x1400814e0], rbx
mov qword [0x1400814e8], rbx
movdqa xmmword [0x1400814f0], xmm0
movdqa xmmword [0x140081500], xmm0
mov qword [0x140081510], rbx
mov qword [0x140081518], rbx
movdqa xmmword [0x140081520], xmm0
movdqa xmmword [0x140081530], xmm0
mov qword [0x140081540], rbx
mov qword [0x140081548], rbx
movdqa xmmword [0x140081550], xmm0
movdqa xmmword [0x140081560], xmm0
mov qword [0x140081570], rbx
mov qword [0x140081578], rbx
movdqa xmmword [0x140081580], xmm0
movdqa xmmword [0x140081590], xmm0
mov qword [0x1400815a0], rbx
mov qword [0x1400815a8], rbx
movdqa xmmword [0x1400815b0], xmm0
movdqa xmmword [0x1400815c0], xmm0
mov qword [0x1400815d0], rbx
mov qword [0x1400815d8], rbx
movdqa xmmword [0x1400815e0], xmm0
movdqa xmmword [0x1400815f0], xmm0
mov qword [0x140081600], rbx
mov qword [0x140081608], rbx
movdqa xmmword [0x140081610], xmm0
movdqa xmmword [0x140081620], xmm0
mov qword [0x140081630], rbx
mov qword [0x140081638], rbx
movdqa xmmword [0x140081640], xmm0
movdqa xmmword [0x140081650], xmm0
mov qword [0x140081660], rbx
mov qword [0x140081668], rbx
movdqa xmmword [0x140081670], xmm0
movdqa xmmword [0x140081680], xmm0
mov qword [0x140081690], rbx
mov qword [0x140081698], rbx
movdqa xmmword [0x1400816a0], xmm0
movdqa xmmword [0x1400816b0], xmm0
mov qword [0x1400816c0], rbx
mov qword [0x1400816c8], rbx
mov qword [0x1400816d0], rbx
lea ecx, [rbx + 0x30]
call fcn.140039944
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x1400816c8], rax
mov qword [0x140081708], rbx
xorps xmm0, xmm0
movdqa xmmword [0x140081710], xmm0
mov qword [0x140081720], rbx
mov qword [0x140081728], rbx
lea ecx, [rbx + 0x40]
call fcn.140039944
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [0x140081720], rax
mov dword [0x140081738], ebx
xorps xmm0, xmm0
movdqa xmmword [0x140081740], xmm0
xorps xmm1, xmm1
movups xmmword [0x140081750], xmm1
movups xmmword [0x140081760], xmm1
movups xmmword [0x140081770], xmm1
mov qword [0x140081780], rbx
lea edx, [rbx + 2]
lea rcx, [0x140081738]
call fcn.140038d0c
nop
mov dword [0x140081788], ebx
xorps xmm0, xmm0
movdqa xmmword [0x140081790], xmm0
xorps xmm1, xmm1
movups xmmword [0x1400817a0], xmm1
movups xmmword [0x1400817b0], xmm1
movups xmmword [0x1400817c0], xmm1
mov qword [0x1400817d0], rbx
lea edx, [rbx + 2]
lea rcx, [0x140081788]
call fcn.140038d0c
nop
mov dword [0x1400817d8], ebx
xorps xmm0, xmm0
movdqa xmmword [0x1400817e0], xmm0
xorps xmm1, xmm1
movups xmmword [0x1400817f0], xmm1
movups xmmword [0x140081800], xmm1
movups xmmword [0x140081810], xmm1
mov qword [0x140081820], rbx
lea edx, [rbx + 2]
lea rcx, [0x1400817d8]
call fcn.140038d0c
nop
mov qword [0x140081828], rbx
xorps xmm0, xmm0
movdqa xmmword [0x140081830], xmm0
lea rcx, [0x1400810d8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x140081128]
call fcn.140002ba0
mov qword [0x140081120], rbx
lea r9, [rbx - 1]
lea r8, str.ProcessLasso
mov edx, 0x104
lea rcx, [0x14007e68c]
call fcn.140045cc8
lea rax, str.processlasso.exe
mov qword [0x14007e898], rax
mov rax, qword [0x14007cd10]
mov qword [0x14007e058], rax
mov dword [0x14007e054], ebx
lea rcx, [0x140081310]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1400816e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1400810b0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1400812c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x1400812e8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140081338]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140081360]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [0x140081388]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x140081160], bl
mov byte [0x140081196], bl
mov byte [0x1400811b1], bl
mov byte [0x1400811b8], bl
mov rcx, rdi
call fcn.140016780
mov qword [0x140081158], rbx
xorps xmm0, xmm0
movdqa xmmword [0x140081140], xmm0
mov qword [0x140081150], rbx
mov dword [0x140081138], 3
lea r9, str.Lasso777
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140081140], rax
lea r9, str.Lasso888_2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140081148], rax
lea r9, str.49da4c63_c475_4b6c_83f3_c78a9fe813c2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140081150], rax
lea rdx, [0x140081288]
mov rcx, rdi
call fcn.140025630
nop
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3