Function at 0x1400b5ba0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1402c0040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 + 0x10], rbx
xor edi, edi
cmp byte [0x1402cb8e0], dil
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], r12
mov r12, rcx
mov qword [r11 - 0x18], r13
mov r13d, 0xffff
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov r15d, 2
je 0x1400b5c38
movzx r8d, word [0x1402cb8e2]
xor r9d, r9d
mov rdx, qword [0x1402cb500]
mov ecx, 0x53
shl r8d, 3
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rsi, qword [0x1402cb500]
test eax, eax
jns 0x1400b5c2c
movzx r8d, word [0x1402cb8e2]
xor edx, edx
shl r8, 3
mov rcx, rsi
call fcn.14020ba80
movzx edx, word [0x1402cb8e4]
jmp 0x1400b5d1f
movzx edx, word [0x1402cb8e4]
movzx ebp, di
mov rsi, qword [0x1402cb500]
mov word [rsp + 0x30], di
cmp di, dx
jae 0x1400b5d1f
movzx eax, di
movzx r8d, di
movzx r9d, di
mov rcx, qword [0x1402cb8e8]
test rcx, rcx
je 0x1400b5c9f
movzx ebx, di
cmp ax, r13w
jne 0x1400b5c8f
cmp di, dx
jae 0x1400b5ca6
movzx eax, dx
nop
add bx, word [rcx]
lea rcx, [rcx + 2]
sub rax, 1
jne 0x1400b5c80
jmp 0x1400b5ca6
cmp r8w, dx
jae 0x1400b5ca6
movzx eax, r9w
movzx ebx, word [rcx + rax*2]
jmp 0x1400b5ca6
movzx ebx, word [0x1402cb8e2]
movzx eax, bp
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
mov r8d, r15d
mov ecx, 0x53
lea r14, [rax*8]
movzx eax, bx
shl eax, 3
lea r9, [r14 + rsi]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov rsi, qword [0x1402cb500]
nop
test eax, eax
jns 0x1400b5cf7
movzx r8d, bx
lea rcx, [r14 + rsi]
shl r8, 3
xor edx, edx
call fcn.14020ba80
movzx eax, word [rsp + 0x30]
add bp, bx
movzx edx, word [0x1402cb8e4]
inc ax
mov word [rsp + 0x30], ax
movzx r8d, ax
movzx r9d, ax
cmp ax, dx
jb 0x1400b5c62
movzx ebp, word [0x1402cb8e2]
mov rbx, rdi
mov r10d, edi
cmp ebp, 4
jb 0x1400b5d9d
mov r9d, ebp
xorps xmm2, xmm2
and r9d, 0xfffffffc
xorps xmm1, xmm1
mov r8d, r15d
nop dword [rax]
nop word [rax + rax]
mov eax, r10d
add r10d, 4
movq xmm0, qword [rsi + rax*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rsi + rax*8]
mov eax, r8d
paddq xmm2, xmm0
movq xmm0, qword [rsi + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rsi + rax*8]
add r8d, 4
paddq xmm1, xmm0
cmp r10d, r9d
jb 0x1400b5d50
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq rbx, xmm1
mov r8, rdi
mov r9, rdi
cmp r10d, ebp
jae 0x1400b5df5
mov eax, ebp
mov ecx, r10d
sub eax, r10d
cmp eax, r15d
jb 0x1400b5dea
mov eax, ebp
sub eax, r10d
sub eax, r15d
shr eax, 1
inc eax
mov r11d, eax
lea eax, [r10 + rax*2]
nop dword [rax + rax]
add r8, qword ds:[rsi + rcx*8]
add r9, qword [rsi + rcx*8 + 8]
add rcx, r15
sub r11, 1
jne 0x1400b5dd0
cmp eax, ebp
jae 0x1400b5dee
add rbx, qword [rsi + rcx*8]
lea rax, [r9 + r8]
add rbx, rax
mov rax, rbx
sub rax, qword [0x1402d08b0]
cmp byte [0x1402cb8e0], dil
mov qword [r12], rax
mov r12, qword [rsp + 0x88]
mov qword [0x1402d08b8], rax
mov qword [0x1402d08b0], rbx
je 0x1400b5e6a
mov rdx, qword [0x1402cb518]
lea r8d, [rbp*8]
xor r9d, r9d
mov ecx, 0x6c
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rsi, qword [0x1402cb518]
test eax, eax
jns 0x1400b5f5f
movzx r8d, word [0x1402cb8e2]
xor edx, edx
shl r8, 3
mov rcx, rsi
call fcn.14020ba80
jmp 0x1400b5f5f
mov rsi, qword [0x1402cb518]
movzx ebp, di
mov word [rsp + 0x34], di
cmp di, dx
jae 0x1400b5f5f
movzx ecx, di
movzx r8d, di
movzx r9d, di
mov rax, qword [0x1402cb8e8]
nop dword [rax + rax]
test rax, rax
je 0x1400b5edf
movzx ebx, di
cmp cx, r13w
jne 0x1400b5ecf
cmp di, dx
jae 0x1400b5ee6
movzx ecx, dx
nop word [rax + rax]
add bx, word [rax]
lea rax, [rax + 2]
sub rcx, 1
jne 0x1400b5ec0
jmp 0x1400b5ee6
cmp r8w, dx
jae 0x1400b5ee6
movzx ecx, r9w
movzx ebx, word [rax + rcx*2]
jmp 0x1400b5ee6
movzx ebx, word [0x1402cb8e2]
movzx eax, bp
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x28], rdi
mov r8d, r15d
mov ecx, 0x6c
lea r14, [rax*8]
movzx eax, bx
shl eax, 3
lea r9, [r14 + rsi]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov rsi, qword [0x1402cb518]
nop
test eax, eax
jns 0x1400b5f37
movzx r8d, bx
lea rcx, [r14 + rsi]
shl r8, 3
xor edx, edx
call fcn.14020ba80
movzx ecx, word [rsp + 0x34]
add bp, bx
movzx edx, word [0x1402cb8e4]
inc cx
mov word [rsp + 0x34], cx
movzx r8d, cx
movzx r9d, cx
cmp cx, dx
jb 0x1400b5e94
movzx r11d, word [0x1402cb8e2]
mov r10, rdi
mov r14, qword [rsp + 0x48]
mov edx, edi
mov r13, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
cmp r11d, 4
jb 0x1400b5feb
mov r8d, r11d
xorps xmm2, xmm2
and r8d, 0xfffffffc
xorps xmm1, xmm1
nop word [rax + rax]
mov eax, edx
add edx, 4
movq xmm0, qword [rsi + rax*8]
lea eax, [r15 - 1]
movhpd xmm0, qword [rsi + rax*8]
mov eax, r15d
paddq xmm2, xmm0
movq xmm0, qword [rsi + rax*8]
lea eax, [r15 + 1]
movhpd xmm0, qword [rsi + rax*8]
add r15d, 4
paddq xmm1, xmm0
cmp edx, r8d
jb 0x1400b5fa0
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r10, xmm1
mov r15, qword [rsp + 0x40]
mov r8, rdi
cmp edx, r11d
jae 0x1400b6043
mov eax, r11d
mov ecx, edx
sub eax, edx
cmp eax, 2
jb 0x1400b6038
mov eax, r11d
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov r9d, eax
lea eax, [rdx + rax*2]
nop word [rax + rax]
add rdi, qword [rsi + rcx*8]
add r8, qword [rsi + rcx*8 + 8]
add rcx, 2
sub r9, 1
jne 0x1400b6020
cmp eax, r11d
jae 0x1400b603c
add r10, qword [rsi + rcx*8]
lea rax, [r8 + rdi]
add r10, rax
mov rax, r10
sub rax, qword [0x1402d08c0]
mov qword [0x1402d08c8], rax
mov qword [0x1402d08c0], r10
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401e5e20
add rsp, 0x58
pop rdi
pop rsi
ret