Function at 0x1400efaa0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov esi, edx
mov rbx, rcx
call fcn.1400efe40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jne 0x1400eface
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x1400efadb
mov r8d, esi
xor edx, edx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x1400efaf4
test rcx, rcx
jle 0x1400efaf1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
cmp dword [0x1403b3a0c], 0xa
jb 0x1400efb30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jne 0x1400efb30
mov r8d, esi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, qword [rbx]
mov rdi, rax
cmp rax, rcx
je 0x1400efb30
test rcx, rcx
jle 0x1400efb2d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rdi
mov rdi, qword [rbx]
test rdi, rdi
jg 0x1400efb6d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rdi, rax
je 0x1400efb6d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x1400efb6d
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov dword [rbx + 8], esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1401419b0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1402e4100]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
xor esi, esi
mov dword [rbp - 9], esi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 5], xmm0
movups xmmword [rbp + 0xb], xmm0
mov qword [rbp + 0x1b], rax
mov dword [rbp + 0x23], eax
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rbp - 9], si
jne 0x140141a93
lea ecx, [rsi + 0x20]
call fcn.1401dea44
mov rbx, rax
mov qword [rbp - 0x59], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rax, qword [r15]
lea r14, vtable.blackbone::Native.0
mov qword [rbx], r14
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
mov dword [rbp - 0x39], esi
xor eax, eax
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
mov qword [rbp - 0x15], rax
mov dword [rbp - 0xd], eax
lea rcx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rbp - 0x35]
mov dword [rbx + 0x18], eax
mov word [rbx + 0x14], 0x101
mov dword [rbx + 0x10], esi
mov byte [rbx + 0x16], 1
lea rax, vtable.blackbone::x86Native.0
mov qword [rbx], rax
lea rdi, [r15 + 0x10]
mov rcx, qword [rdi]
mov qword [rdi], rbx
test rcx, rcx
je 0x140141b2e
jmp 0x140141b21
mov dword [rbp - 0x49], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
lea rdi, [r15 + 0x10]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
cmp dword [rbp - 0x49], 1
jne 0x140141aee
call fcn.1401dea44
mov rbx, rax
mov qword [rbp - 0x59], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rax
call fcn.140142620
lea rax, vtable.blackbone::NativeWow64.0
mov qword [rbx], rax
mov rcx, qword [rdi]
mov qword [rdi], rbx
jmp 0x140141b15
call fcn.1401dea44
mov qword [rbp - 0x59], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xor r8d, r8d
mov rdx, qword [r15]
mov rcx, rax
call fcn.140142620
mov rcx, qword [rdi]
mov qword [rdi], rax
test rcx, rcx
je 0x140141b2e
lea r14, vtable.blackbone::Native.0
mov qword [rcx], r14
mov edx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401de9c4
mov rax, qword [rdi]
cmp byte [rax + 0x15], sil
jne 0x140141b41
mov byte [r15 + 0x18], 1
jmp 0x140141c9a
mov dword [rbp - 0x49], esi
mov dword [rbp - 0x45], esi
call fcn.1400ef2d0
mov rdi, rax
lea rdx, str.GetProcessDEPPolicy
lea rcx, [rbp - 0x39]
call fcn.1400ca810
nop
call fcn.140132d40
lea r12, [rdi + 0x40]
mov qword [rbp - 0x59], r12
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rbp - 0x41], rsi
lea r14, [rdi + 8]
mov qword [rbp - 0x51], r14
lea rcx, [rbp - 0x39]
call fcn.14009e7c0
mov rbx, rax
lea rcx, [rbp - 0x39]
call fcn.14009de20
mov r8, rbx
mov rdx, rax
movabs rcx, 0xcbf29ce484222325
call fcn.1400721c0
mov r13, qword [rdi + 0x30]
and r13, rax
mov rcx, qword [rdi + 0x18]
mov rax, r13
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [r14]
je 0x140141c21
add r13, r13
mov r13, qword [rcx + r13*8]
nop
lea rcx, [rdi + 0x10]
mov rbx, qword [rcx + 0x10]
call fcn.14009e9a0
mov r12, rax
mov r14, qword [rbp - 0x29]
lea rcx, [rbp - 0x39]
call fcn.14009e9a0
cmp r14, rbx
jne 0x140141c04
mov r8, r14
mov rdx, r12
mov rcx, rax
call fcn.140267580
test eax, eax
je 0x140141c0f
cmp rdi, r13
je 0x140141c19
mov rdi, qword [rdi + 8]
jmp 0x140141bd0
mov r14, qword [rbp - 0x51]
mov r12, qword [rbp - 0x59]
jmp 0x140141c24
mov r14, qword [rbp - 0x51]
mov r12, qword [rbp - 0x59]
mov rdi, rsi
test rdi, rdi
jne 0x140141c2c
mov rdi, qword [r14]
mov qword [rbp - 0x41], rdi
mov rdx, r14
lea rcx, [rbp - 0x41]
call fcn.140072680
mov rax, qword [r14]
mov qword [rbp - 0x59], rax
mov rdx, r14
lea rcx, [rbp - 0x59]
call fcn.140072680
mov rax, qword [rbp - 0x41]
mov rcx, r12
cmp rax, qword [rbp - 0x59]
je 0x140141c7c
mov rbx, qword [rax + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140141c83
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x49]
mov rcx, qword [r15]
call rbx
mov esi, eax
jmp 0x140141c83
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rbp - 0x39]
call fcn.14009de70
test esi, esi
je 0x140141c9a
movzx eax, byte [rbp - 0x49]
and al, 1
mov byte [r15 + 0x18], al
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1401de720
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret