Function at 0x14001eb70
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov r15, r9
mov r12, r8
mov rsi, rdx
mov rdi, rcx
movaps xmm0, xmmword [rsp + 0x160]
movaps xmm1, xmmword [rsp + 0x150]
movaps xmm2, xmmword [rsp + 0x140]
movups xmmword [rsp + 0xb0], xmm2
movups xmmword [rsp + 0xc0], xmm1
movups xmmword [rsp + 0xd0], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x88], 0
mov word [rsp + 0x98], 0
lea rcx, [rsp + 0xa0]
lea rbx, [rsp + 0x40]
mov rdx, rbx
call fcn.140001140
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
cmp r13, 3
jne 0x14001ecce
mov qword [rsp + 0x38], r14
mov r13, qword [rsi]
mov r14, qword [rsi + 0x10]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov eax, dword [0x1400f92c4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x14001ed91
add rax, 0x110
jmp 0x14001ed96
movzx eax, byte [0x1400f92c0]
mov rcx, qword [0x1400f91f8]
test rcx, rcx
jne 0x14001ecfa
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14001eece
mov rcx, rax
mov qword [0x1400f91f8], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14001eece
mov qword [rax], r13
mov qword [rax + 8], r14
mov qword [rdi], rax
lea rax, case.0x1400270ad.366
mov qword [rdi + 8], rax
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14001ed61
lea r14, [rdi + 8]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14001ed49
add r14, 0x20
dec rbx
je 0x14001ed61
cmp qword [r14], 0
je 0x14001ed40
mov r8, qword [r14 - 8]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call r15
jmp 0x14001ed40
cmp qword [rsi + 8], 0
je 0x14001eeba
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
call fcn.1400686f0
mov rax, qword [rax]
mov r8, qword [rax + 0x210]
xor eax, eax
cmp r14, 0xffffffffffffffff
sete al
cmp rax, r8
cmova r8, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 1
mov rcx, r14
xor edx, edx
call fcn.140012850
mov rax, qword [0x1400f90f8]
mov qword [rdi + 8], rax
mov qword [rdi], 0
mov rdi, qword [rsp + 0x38]
lock dec qword [rdi + 0x1d8]
jne 0x14001ee49
mov rax, qword [rdi + 0x210]
test rax, rax
je 0x14001ee49
mov r14, qword [rdi + 0x200]
add rdi, 0x1e0
shl rax, 3
lea r15, [rax + rax*8]
xor r12d, r12d
xor ebx, ebx
jmp 0x14001ee2c
add r12, 0x48
inc rbx
cmp r15, r12
je 0x14001ee49
mov eax, 3
xchg qword [r14 + r12 + 0x30], rax
cmp rax, 2
jne 0x14001ee20
mov rcx, rdi
mov rdx, rbx
call fcn.140067170
jmp 0x14001ee20
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14001ee5e
lea rcx, [rsp + 0x38]
call fcn.1400677b0
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14001eea1
lea r14, [rdi + 8]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14001ee89
add r14, 0x20
dec rbx
je 0x14001eea1
cmp qword [r14], 0
je 0x14001ee80
mov r8, qword [r14 - 8]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call r15
jmp 0x14001ee80
cmp qword [rsi + 8], 0
je 0x14001eeba
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400a9e00
ud2