Function at 0x140077e80
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x218]
sub rsp, 0x310
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdi, rcx
mov r8d, 9
lea rdx, [rsp + 0x48]
call fcn.140050270
lea rdx, str.install.ddaprivacy
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0x10
jb 0x140077f38
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rcx, 0x1000
jb 0x140077f30
test dl, 0x1f
je 0x140077f03
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x140077f12
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x140077f21
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x140077f2d
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
test ebx, ebx
jne 0x14007807a
mov ebx, 0x67
xor eax, eax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rax, qword [rbp - 0x58]
cmp ax, 9
je 0x140077f7e
mov ecx, 0x68
test ax, ax
cmove ebx, ecx
mov r8d, reloc.WS2_32.dll_listen
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140050270
nop
cmp qword [rax + 0x18], 0x10
jb 0x140077f9c
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140085920
mov rdi, rax
lea rcx, [rbp - 0x78]
call fcn.1400761e0
nop
cmp qword [rdi + 0x18], 8
jb 0x140077fc0
mov rdi, qword [rdi]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140077fd9
movzx edx, bx
lea r8, str.DDAPRIVSP
mov rcx, rdi
call rax
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140077fe9
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140078005
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140008b70
mov qword [rbp - 0x80], 7
xor ebx, ebx
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x140078599
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x140078070
test cl, 0x1f
je 0x140078043
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078052
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078061
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x14007806d
call fcn.1400a26d8
int3
mov rcx, rax
call fcn.14009d844
jmp 0x140078599
mov r8d, 9
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140050270
lea rdx, str.privacy
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0x10
jb 0x1400780fa
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rcx, 0x1000
jb 0x1400780f2
test dl, 0x1f
je 0x1400780c5
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x1400780d4
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x1400780e3
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x1400780ef
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
lea rdx, [rsp + 0x48]
mov rcx, rdi
test ebx, ebx
jne 0x140078298
lea r8d, [rbx + 5]
call fcn.140050270
cmp qword [rax + 0x18], 0x10
jb 0x14007811d
mov rax, qword [rax]
mov rcx, rax
call fcn.1400a3f50
mov esi, eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0x10
jb 0x140078183
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rcx, 0x1000
jb 0x14007817b
test dl, 0x1f
je 0x14007814e
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x14007815d
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x14007816c
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x140078178
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
mov r8d, 0x5c
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.140050270
nop
mov qword [rbp - 0x60], 7
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x78], bx
xor r8d, r8d
lea rdx, [0x1400e6c40]
lea rcx, [rbp - 0x78]
call fcn.140008a20
nop
lea rcx, [rbp - 0x78]
call fcn.140076580
nop
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x1400781e1
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140008b70
xor r8d, r8d
lea rdx, str.privacy
lea rcx, [0x1401399a0]
call fcn.140079810
cmp qword [rsp + 0x78], 0
je 0x14007820f
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400761e0
nop
mov r8, qword [rax + 0x18]
test r8, r8
je 0x14007822c
mov rdx, rbx
mov ecx, esi
call r8
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14007823d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rax, qword [rbp - 0x80]
cmp rax, 0x10
jb 0x140078599
inc rax
mov rcx, qword [rsp + 0x68]
cmp rax, 0x1000
jb 0x140078070
test cl, 0x1f
je 0x14007826a
call fcn.1400a26d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140078279
call fcn.1400a26d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x140078288
call fcn.1400a26d8
int3
cmp rcx, 0x27
jbe 0x14007806d
call fcn.1400a26d8
int3
mov r8d, 9
call fcn.140050270
lea rdx, str.install.vhid
mov rcx, rax
call fcn.14000aeb0
mov ebx, eax
mov rcx, qword [rsp + 0x60]
cmp rcx, 0x10
jb 0x140078310
inc rcx
mov rdx, qword [rsp + 0x48]
cmp rcx, 0x1000
jb 0x140078308
test dl, 0x1f
je 0x1400782db
call fcn.1400a26d8
int3
mov rax, qword [rdx - 8]
cmp rax, rdx
jb 0x1400782ea
call fcn.1400a26d8
int3
sub rdx, rax
cmp rdx, 8
jae 0x1400782f9
call fcn.1400a26d8
int3
cmp rdx, 0x27
jbe 0x140078305
call fcn.1400a26d8
int3
mov rdx, rax
mov rcx, rdx
call fcn.14009d844
test ebx, ebx
jne 0x140078599
xor ebx, ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], ebx
mov dword [rsp + 0x34], ebx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x140078373
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14007836a
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x38]
call rax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x34], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x38], 0xa
jb 0x140078599
call fcn.14002c170
movzx esi, al
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp]
call fcn.1400a1560
mov r8d, 0x1fe
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], rbx
mov word [rbp - 0x78], bx
or rdi, 0xffffffffffffffff
cmp word [rbp], bx
jne 0x1400783dc
mov r8, rbx
jmp 0x1400783ed
lea rax, [rbp]
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x1400783e3
lea rdx, [rbp]
lea rcx, [rbp - 0x78]
call fcn.140008a20
nop
lea rax, str.driverVhid64
lea rdx, str.driverVhid
test sil, sil
cmovne rdx, rax
cmp word [rdx], 0
jne 0x140078420
mov rdi, rbx
jmp 0x14007842a
inc rdi
cmp word [rdx + rdi*2], 0
jne 0x140078420
mov r8, rdi
lea rcx, [rbp - 0x78]
call fcn.14002dd30
lea r8, str.devcon.exe
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.140031030
nop
lea r8, str.orayvhid.inf
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140031030
nop
lea r8, [rsp + 0x68]
lea rdx, str._install__
lea rcx, [rsp + 0x48]
call fcn.140030f50
nop
lea r8, str.__orayorayvhid
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140031110
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x1400784a9
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.140008b70
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
mov r9d, 4
call fcn.14004f590
mov byte [rsp + 0x31], 0
mov byte [rsp + 0x30], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x31]
call fcn.140007fc0
nop
mov r8, qword [rbp - 0x10]
cmp r8, 8
jb 0x140078517
inc r8
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x28]
call fcn.140008b70
mov qword [rbp - 0x10], 7
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x28], bx
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x140078543
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.140008b70
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], rbx
mov word [rsp + 0x68], bx
mov r8, qword [rbp - 0x40]
cmp r8, 8
jb 0x14007856f
inc r8
mov rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x58]
call fcn.140008b70
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], rbx
mov word [rbp - 0x58], bx
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x140078599
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140008b70
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14009d860
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret