Function at 0x140002c30
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0x520]
sub rsp, 0x620
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rbp + 0x510], rax
mov r15, r8
mov r14d, edx
mov edi, ecx
xor edx, edx
mov r8d, 0x2c8
lea rcx, [rbp + 0x230]
xor ebx, ebx
call fcn.140004c80
test edi, edi
jne 0x140002c8d
lea rcx, str.InjectDll:_Error__no_process_identifier_supplied._n
call fcn.1400011f0
mov eax, ebx
jmp 0x140003060
mov r8d, edi
mov qword [rsp + 0x668], rsi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140002cc0
lea rcx, str.InjectDll:_Failed_to_open_process
call fcn.140001320
mov eax, ebx
jmp 0x140003058
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea r8, [rbp + 0x200]
mov qword [rbp + 0x200], rcx
mov r9d, 0x30
mov qword [rbp + 0x208], rcx
xor edx, edx
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rcx
mov qword [rbp + 0x220], rcx
mov qword [rbp + 0x228], rcx
lea rcx, [rbp + 0x500]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call rax
test eax, eax
js 0x140002d63
cmp dword [rbp + 0x500], 0x30
jne 0x140002d63
mov rdx, qword [rbp + 0x208]
lea rax, [rbp + 0x508]
mov r9d, 0x2c8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x230]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140002d6f
lea rcx, str.InjectDll:_GetProcessPeb_failure._n
call fcn.1400011f0
test r14d, r14d
jne 0x140002f28
cmp qword [rbp + 0x240], rbx
je 0x140002f4c
cmp qword [rbp + 0x248], rbx
jne 0x140002f4c
cmp dword [0x140023d24], ebx
jne 0x140002dc0
lea rcx, [0x140023d20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x140023d24], ebx
jne 0x140002dc0
lea rcx, str.GetProcessInitialThreadId:_Failed_to_obtain_system_page_size
call fcn.140001320
jmp 0x140002f02
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
lea r8, [rbp + 0x200]
mov qword [rbp + 0x200], rcx
mov r9d, 0x30
mov qword [rbp + 0x208], rcx
xor edx, edx
mov qword [rbp + 0x210], rcx
mov qword [rbp + 0x218], rcx
mov qword [rbp + 0x220], rcx
mov qword [rbp + 0x228], rcx
lea rcx, [rbp + 0x508]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call rax
test eax, eax
js 0x140002ef6
cmp dword [rbp + 0x508], 0x30
jne 0x140002ef6
mov edx, dword [0x140023d24]
lea r8, [rbp + 0x500]
add rdx, 0x48
mov qword [rsp + 0x20], rbx
add rdx, qword [rbp + 0x208]
mov r9d, 4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140002eb3
mov eax, dword [0x140023d24]
lea r8, [rbp + 0x500]
mov rdi, qword [rbp + 0x208]
mov r9d, 4
sub rdi, rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
lea rdx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140002eb3
lea rdx, [rdi + 0x48]
lea rcx, str.GetProcessInitialThreadId:_ReadProcessMemory_failed__0x_p_._n
call fcn.1400011f0
jmp 0x140002f02
mov edi, dword [rbp + 0x500]
test edi, edi
je 0x140002f02
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
mov edx, edi
test rax, rax
jne 0x140002ee5
lea rcx, str.InjectDll:_No_thread_ID_supplied__OpenThread_on_initial_thread_ID__d_failed
call fcn.1400011f0
jmp 0x140002f4c
mov r8, rax
lea rcx, str.InjectDll:_No_thread_ID_supplied__initial_thread_ID__d__handle_0x_x_n
call fcn.1400011f0
jmp 0x140002f4c
lea rcx, str.GetProcessInitialThreadId:_NtQueryInformationProcess_failed._n
call fcn.1400011f0
mov edx, dword [rbp + 0x4f0]
test edx, edx
je 0x140002f1f
lea rcx, str.InjectDll:_No_thread_ID_supplied__GetProcessInitialThreadId_failed__SessionId_d_._n
call fcn.1400011f0
mov edi, ebx
jmp 0x14000303f
lea rcx, str.InjectDll:_No_thread_ID_supplied__GetProcessInitialThreadId_failed__falling_back_to_thread_injection._n
jmp 0x140002f47
mov r8d, r14d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
jne 0x140002f4c
lea rcx, str.InjectDll:_OpenThread_failed
call fcn.1400011f0
cmp dword [0x140023e64], 0
jne 0x140003018
test rbx, rbx
je 0x140003018
cmp qword [rbp + 0x240], 0
je 0x140003018
lea rcx, [rsp + 0x30]
mov edx, 5
lea rax, [rbp + 0x230]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002f81
movups xmm0, xmmword [rax]
lea r9, [rsp + 0x30]
mov r8, r15
movups xmm1, xmmword [rax + 0x10]
mov rdx, rbx
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
mov rax, qword [rax + 0x40]
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm1
mov qword [rcx + 0x40], rax
mov rcx, rsi
call fcn.140002230
test eax, eax
je 0x140003018
mov edi, 1
jmp 0x14000303f
test r14d, r14d
je 0x140003032
test rbx, rbx
je 0x140003032
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.140001840
jmp 0x14000303d
mov rdx, r15
mov rcx, rsi
call fcn.140001a90
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140003056
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rsi, qword [rsp + 0x668]
mov rcx, qword [rbp + 0x510]
xor rcx, rsp
call fcn.140003c30
add rsp, 0x620
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret