Function at 0x14017b91c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
movups xmm0, xmmword [0x1403c7430]
xor r15d, r15d
mov qword [rbp + 7], rcx
lea rax, [0x14002fa58]
mov qword [rbp - 0x49], r15
mov qword [rbp - 9], rax
lea rdx, [rbp - 0x11]
lea rax, [rbp + 0x67]
mov qword [rbp - 0x41], r15
mov qword [rbp - 1], rax
lea r8d, [r15 + 0x30]
lea rax, [rbp - 0x49]
mov qword [rbp - 0x39], r15
mov qword [rbp + 0xf], rax
mov r13, r9
lea rax, [rbp - 0x59]
mov qword [rbp - 0x11], 3
mov ebx, r15d
mov qword [rbp + 0x17], rax
xor r9d, r9d
mov qword [rbp - 0x51], rbx
mov ecx, 0xb9
mov r12d, r15d
movdqu xmmword [rbp - 0x31], xmm0
movdqu xmmword [rbp - 0x21], xmm0
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp + 0x67]
test esi, esi
jns 0x14017b9c5
mov ecx, esi
call fcn.140079c40
jmp 0x14017baf1
mov edx, dword [rbp - 0x59]
lea r8, [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
call fcn.140079744
mov esi, eax
test eax, eax
jns 0x14017b9eb
mov ecx, eax
call fcn.140079c40
mov rbx, qword [rbp - 0x51]
jmp 0x14017baf1
mov rbx, qword [rbp - 0x51]
lea r8, [rbp - 0x41]
mov rcx, rbx
mov edx, 0x5c
call fcn.140069684
mov esi, eax
test eax, eax
jns 0x14017ba0a
mov ecx, eax
jmp 0x14017b9bb
cmp dword [rbp - 0x3d], 3
jne 0x14017baed
mov r15, qword [rbp - 0x39]
or r14, 0xffffffffffffffff
mov rax, r14
xor edx, edx
mov rcx, qword [r15 + 8]
inc rax
cmp word [rcx + rax*2], dx
jne 0x14017ba25
mov edx, 0x80070057
cmp rax, 0x26
jne 0x14017ba5d
cmp word [rcx], 0x7b
jne 0x14017ba63
cmp word [rcx + 0x4a], 0x7d
jne 0x14017ba63
add rcx, 2
lea rdx, [rbp - 0x31]
call fcn.14006f11c
mov edi, eax
test eax, eax
jns 0x14017ba6c
mov ecx, eax
jmp 0x14017ba67
cmp rax, 0x24
je 0x14017ba4a
mov edi, edx
mov ecx, edx
call fcn.140079c40
mov ecx, edi
call fcn.140079c60
test edi, edi
js 0x14017baed
mov rcx, qword [r15 + 0x10]
xor r15d, r15d
inc r14
cmp word [rcx + r14*2], r15w
jne 0x14017ba7e
cmp r14, 0x26
jne 0x14017bab2
cmp word [rcx], 0x7b
jne 0x14017bab8
cmp word [rcx + 0x4a], 0x7d
jne 0x14017bab8
add rcx, 2
lea rdx, [rbp - 0x21]
call fcn.14006f11c
mov edi, eax
test eax, eax
jns 0x14017bac4
mov ecx, eax
jmp 0x14017babf
cmp r14, 0x24
je 0x14017ba9f
mov ecx, 0x80070057
mov edi, ecx
call fcn.140079c40
mov ecx, edi
call fcn.140079c60
test edi, edi
js 0x14017baed
mov rax, qword [rbp + 0x6f]
mov r12d, 1
movups xmm0, xmmword [rbp - 0x31]
movups xmm1, xmmword [rbp - 0x21]
movdqu xmmword [rax], xmm0
mov rax, qword [rbp + 0x77]
movdqu xmmword [rax], xmm1
mov dword [r13], r12d
mov ecx, esi
call fcn.140079c60
xor edx, edx
lea rcx, [rbp - 0x41]
call fcn.1400795ac
mov rdi, qword [rbp - 0x39]
test rdi, rdi
je 0x14017bb20
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14017bb41
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x14017bb5e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0xf8]
mov eax, esi
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret