Function at 0x14018170c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0xf], rax
and qword [rbp - 0x49], 0
xor edi, edi
xor ebx, ebx
mov qword [rbp - 0x41], r9
and qword [rbp - 0x61], rbx
mov rsi, r8
and dword [rbp - 9], ebx
mov r12, rdx
lea eax, [rdi + 3]
mov qword [rbp - 0x21], rdx
mov dword [rbp + 3], eax
lea r8d, [rdi + 0x30]
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x39]
lea rax, [0x1400350dc]
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x31], rax
mov r13, rcx
lea rax, [rbp - 0x59]
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x29], rax
xor r9d, r9d
lea rax, [rbp - 0x49]
mov dword [rbp - 5], 1
mov qword [rbp - 0x19], rax
mov ecx, 0xb9
lea rax, [rbp - 0x55]
mov dword [rbp - 1], 2
mov qword [rbp - 0x11], rax
mov dword [rbp + 7], 4
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x59]
test r15d, r15d
jns 0x1401817c9
mov ecx, r15d
call fcn.14007ac40
jmp 0x1401818c7
mov edx, dword [rbp - 0x55]
lea r8, [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
call fcn.14007a7c4
mov r15d, eax
test eax, eax
jns 0x1401817f0
mov ecx, eax
call fcn.14007ac40
mov rdi, qword [rbp - 0x51]
jmp 0x1401818c7
mov rdi, qword [rbp - 0x51]
lea r9, [rbp - 0x69]
mov r8, rdi
mov rdx, rsi
mov rcx, r13
call fcn.1401827f8
mov r15d, eax
test eax, eax
js 0x1401818bc
mov r14, qword [r13 + 0x18]
xor esi, esi
cmp dword [0x14045de88], 1
cmove rsi, qword [0x14045d500]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x61]
mov rdx, rsi
mov rcx, r14
call rax
mov r15d, eax
test eax, eax
js 0x1401818bc
mov r14, qword [rbp - 0x41]
lea rsi, [rbp - 9]
xor ebx, ebx
mov r9, qword [rbp - 0x61]
mov rdx, r12
mov r8d, dword [rsi]
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.140182c40
mov r15d, eax
test eax, eax
js 0x1401818bc
inc ebx
add rsi, 4
cmp ebx, 5
jb 0x14018185c
mov rbx, qword [rbp - 0x69]
mov rax, qword [rbx]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x61]
mov rax, rsi
xor r8d, r8d
mov rcx, rbx
call rax
mov r15d, eax
test eax, eax
jns 0x1401818c7
mov ecx, eax
jmp 0x1401817bf
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rbp - 0x69]
mov ecx, r15d
call fcn.14007ace8
mov rsi, qword [rbp - 0x61]
test rsi, rsi
je 0x1401818f8
mov rax, qword [rsi]
mov r14, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, r14
call rax
mov rax, r14
mov rcx, rsi
call rax
and qword [rbp - 0x61], 0
test rbx, rbx
je 0x140181918
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
test rdi, rdi
je 0x140181939
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x140181956
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r15d
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140388a40
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret