Function at 0x1401b25ec
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rsi, qword [rdx + 0x18]
xor r13d, r13d
mov r15, rcx
mov qword [rbp - 0x59], r13
mov qword [rbp + 0x7f], r13
mov edi, r13d
mov qword [rbp - 0x71], r13
mov r14, rdx
mov qword [rbp - 0x19], r13
lea r12d, [r13 + 1]
cmp dword [0x140440d60], r12d
mov qword [rbp - 0x41], r13
cmove rdi, qword [0x1404401e0]
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x61], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], r13
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x79]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x1404401e8]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x21]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x1404401f0]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x61]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x140440208]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x31]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x1404401f8]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x49]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x140440200]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x29]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x140440210]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140440d60], r12d
cmove rdi, qword [0x140440218]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x39]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rax, qword [r15]
mov rbx, qword [rax + 0x20]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x19]
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rax, qword [r15]
mov rbx, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x19]
lea r8, [rbp - 0x41]
mov rax, rbx
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x41]
mov r12d, r13d
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov r15d, r13d
cmp dword [rbp + 0x6f], r13d
jbe 0x1401b2ba1
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x1401b2944
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x59], r13
mov rbx, qword [rbp - 0x41]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea r8, [rbp - 0x59]
mov edx, r15d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x59]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x69]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1401b29c9
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp + 0x7f], r13
mov rbx, qword [rbp - 0x59]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x7f]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x71]
test rbx, rbx
je 0x1401b2a17
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x71], r13
mov rbx, qword [rbp + 0x7f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
lea r9, [rbp + 0x77]
lea r8, [rbp - 0x71]
mov rcx, rbx
lea rdx, str.metaInfoType
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
cmp dword [rbp + 0x77], 1
jne 0x1401b2b5f
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeSku
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401b2a9c
mov rax, qword [rbp + 0x7f]
lea rcx, [rbp - 0x11]
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x61]
mov rdx, qword [rbp - 0x21]
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1401b442c
jmp 0x1401b2b8a
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeLicense
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401b2ad6
mov r9, qword [rbp + 0x7f]
lea rax, [rbp - 0x11]
mov r8, qword [rbp - 0x69]
mov rcx, r14
mov rdx, qword [rbp - 0x31]
mov qword [rsp + 0x20], rax
call fcn.1401b3d70
jmp 0x1401b2b8a
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeFile
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401b2b11
inc r12d
cmp dword [r14 + 8], r13d
jne 0x1401b2b94
mov r9, qword [rbp + 0x7f]
mov rcx, r14
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x49]
call fcn.1401b3b80
jmp 0x1401b2b8a
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeStoreToken
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401b2b3f
mov r9, qword [rbp + 0x7f]
mov rcx, r14
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x29]
call fcn.1401b39d0
jmp 0x1401b2b8a
mov rax, qword [rbp - 0x71]
lea rdx, [rbp - 0x11]
mov rcx, qword [rbp + 0x7f]
mov qword [rsp + 0x30], rdx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
jmp 0x1401b2b76
mov rax, qword [rbp + 0x7f]
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x69]
mov rcx, r14
mov r8, qword [rbp - 0x61]
mov rdx, qword [rbp - 0x51]
call fcn.1401b3490
mov esi, eax
test eax, eax
js 0x1401b2d79
inc r15d
cmp r15d, dword [rbp + 0x6f]
jb 0x1401b291c
cmp dword [r14 + 8], r13d
je 0x1401b2bd3
cmp dword [0x140440d60], 1
mov r8, r13
mov rdx, qword [rbp - 0x49]
mov r9d, r12d
cmove r8, qword [0x140440220]
mov rcx, qword [r14 + 0x18]
call fcn.14017ce00
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rdx, qword [rbp - 0x39]
lea r8, [rbp - 0x11]
mov rcx, r14
call fcn.1401768b8
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x21]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x61]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x49]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x29]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x31]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x51]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x39]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401b2d79
mov rdi, qword [r14 + 0x20]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x79]
mov rax, rbx
xor r8d, r8d
mov rcx, rdi
call rax
mov esi, eax
test eax, eax
jns 0x1401b2d80
mov ecx, eax
call fcn.140079c40
mov ecx, esi
call fcn.140079c60
mov r15d, 3
mov qword [rsp + 0x50], r13
lea rax, [0x140033b58]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rax, [rbp - 0x11]
mov edi, 0xb9
lea r14d, [r15 + 0x1d]
mov qword [rsp + 0x58], rax
mov r8d, r14d
xor r9d, r9d
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], r15
lea rbx, [0x14001a858]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x48], rbx
mov r8d, r14d
mov qword [rsp + 0x50], r13
lea rdx, [rsp + 0x40]
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x51]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x31]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x61]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
lea rdx, [rsp + 0x40]
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x79]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rbp - 0x41]
test rbx, rbx
je 0x1401b2f46
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x41], r13
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x1401b2f6e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x19], r13
mov rbx, qword [rbp - 0x71]
test rbx, rbx
je 0x1401b2f8f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x71], r13
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1401b2fb7
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp + 0x7f], r13
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x1401b2fdb
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x140]
mov eax, esi
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret