Function at 0x14007d550
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, rdx
push r14
push r13
push r12
lea r12, [rcx + 0x90]
push rdi
push rsi
push rbx
mov rbx, rcx
mov rcx, r12
sub rsp, 0x10
and rsp, 0xfffffffffffffff0
sub rsp, 0x190
movaps xmmword [rsp + 0x190], xmm6
call fcn.140030fb0
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x14007d6f8
mov rax, r15
mov ecx, r15d
shr rax, 0x38
and ecx, 0xff00ffff
mov rdx, rax
mov rax, r15
shr rax, 0x20
shl edx, 0x18
movzx eax, al
lea edx, [rdx + rax - 0x61c88647]
mov rax, r15
shr rax, 0x30
movzx eax, al
shl eax, 0x10
add edx, eax
mov rax, r15
shr rax, 0x28
movzx eax, al
shl eax, 8
add edx, eax
mov rax, r15
shr rax, 0x10
movzx eax, al
shl eax, 0x10
lea eax, [rcx + rax - 0x60b6453e]
sub eax, edx
add edx, 0x1124109
xor eax, 0x7f76d
mov ecx, eax
sub edx, eax
shl ecx, 8
xor edx, ecx
mov ecx, 0xfeedbef7
sub ecx, eax
mov r9d, edx
sub eax, edx
sub ecx, edx
shr r9d, 0xd
xor r9d, ecx
sub eax, r9d
sub edx, r9d
mov ecx, eax
mov eax, r9d
shr eax, 0xc
xor eax, ecx
mov ecx, eax
sub edx, eax
sub r9d, eax
shl ecx, 0x10
xor ecx, edx
mov edx, ecx
sub r9d, ecx
shr edx, 5
sub eax, ecx
xor edx, r9d
mov r9d, edx
sub eax, edx
sub ecx, edx
shr r9d, 3
xor r9d, eax
mov eax, r9d
sub ecx, r9d
sub edx, r9d
shl eax, 0xa
xor eax, ecx
mov rcx, qword [r8 + 0x150]
sub edx, eax
shr eax, 0xf
mov esi, dword [rcx + 8]
xor eax, edx
lea edx, [rsi - 1]
and edx, eax
shl rdx, 4
add rdx, qword [rcx]
mov r13, qword [rdx]
test r13, r13
je 0x14007d6f8
mov rcx, qword [rcx + 0x20]
mov rdx, rcx
sub r13, rcx
neg rdx
jmp 0x14007d6a7
mov r13, qword [r13 + 0x170]
test r13, r13
je 0x14007d6f8
add r13, rdx
cmp dword [r13 + 0x184], eax
jne 0x14007d698
cmp dword [r13 + 0x180], 8
jne 0x14007d698
mov rcx, qword [r13 + 0x178]
cmp r15, qword [rcx]
jne 0x14007d698
nop word cs:[rax + rax]
mov rcx, r12
call fcn.140030ef0
movaps xmm6, xmmword [rsp + 0x190]
lea rsp, [rbp - 0x38]
mov rax, r13
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbx + 0x1b8]
lea rsi, [rsp + 0x80]
mov edx, 0x104
lea r8, str._s__0llx.dchaincell
mov rcx, rsi
mov r9, qword [rax + 8]
mov qword [rsp + 0x20], r15
call fcn.140204800
lea rdx, [0x1402b1532]
mov rcx, rsi
call sub.msvcrt.dll_fopen
mov r14, rax
test rax, rax
je 0x14007dc68
cmp byte [rbx + 0x31], 0
jne 0x14007dad0
mov edx, 0x188
mov ecx, 1
call sub.msvcrt.dll_calloc
mov r13, rax
movzx eax, r15b
pxor xmm0, xmm0
mov byte [r13], al
lea rdi, [r13 + 0x10]
mov ecx, 0x20
mov qword [r13 + 8], rbx
mov qword [r13 + 0x128], 0
mov qword [r13 + 0x130], r14
mov qword [r13 + 0x140], 0xffffffffffffffff
movups xmmword [r13 + 0x118], xmm0
rep movsq qword [rdi], qword [rsi]
mov edx, dword [rsi]
mov dword [rdi], edx
movzx edx, byte [r13 + 7]
movzx ecx, byte [r13 + 4]
mov qword [r13 + 0x178], r13
mov dword [r13 + 0x180], 8
shl edx, 0x18
lea ecx, [rdx + rcx - 0x61c88647]
movzx edx, byte [r13 + 6]
shl edx, 0x10
add ecx, edx
movzx edx, byte [r13 + 5]
shl edx, 8
add ecx, edx
movzx edx, byte [r13 + 3]
shl edx, 0x18
lea eax, [rdx + rax - 0x60b6453e]
movzx edx, byte [r13 + 2]
shl edx, 0x10
add eax, edx
movzx edx, byte [r13 + 1]
shl edx, 8
add eax, edx
sub eax, ecx
add ecx, 0x1124109
xor eax, 0x7f76d
mov edx, eax
sub ecx, eax
shl edx, 8
xor edx, ecx
mov ecx, 0xfeedbef7
sub ecx, eax
mov r8d, edx
sub eax, edx
sub ecx, edx
shr r8d, 0xd
xor r8d, ecx
mov ecx, r8d
sub eax, r8d
sub edx, r8d
shr ecx, 0xc
xor ecx, eax
mov eax, edx
mov edx, ecx
sub eax, ecx
sub r8d, ecx
shl edx, 0x10
xor edx, eax
mov eax, edx
sub r8d, edx
shr eax, 5
xor eax, r8d
sub ecx, edx
mov r8d, eax
sub ecx, eax
sub edx, eax
shr r8d, 3
xor r8d, ecx
mov ecx, r8d
sub edx, r8d
sub eax, r8d
shl ecx, 0xa
xor edx, ecx
sub eax, edx
shr edx, 0xf
mov esi, edx
xor esi, eax
mov rax, qword [rbx + 0x38]
mov dword [r13 + 0x184], esi
test rax, rax
je 0x14007dd98
mov rdx, qword [rax + 0x150]
lea r14, [r13 + 0x150]
mov qword [r13 + 0x160], 0
mov qword [r13 + 0x150], rdx
mov rcx, qword [rax + 0x150]
mov rdx, qword [rcx + 0x18]
sub rdx, qword [rcx + 0x20]
mov qword [r13 + 0x158], rdx
mov rax, qword [rax + 0x150]
mov rax, qword [rax + 0x18]
mov qword [rax + 0x10], r13
mov rax, qword [rbx + 0x38]
mov rax, qword [rax + 0x150]
mov qword [rax + 0x18], r14
mov rax, qword [rbx + 0x38]
mov rdi, qword [rax + 0x150]
mov eax, dword [rdi + 0x10]
add eax, 1
mov dword [rdi + 0x10], eax
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax + 0x150]
mov eax, dword [rdx + 8]
sub eax, 1
and eax, esi
shl rax, 4
add rax, qword [rdx]
mov rdx, qword [rax]
add dword [rax + 8], 1
mov qword [r13 + 0x168], 0
mov qword [r13 + 0x170], rdx
mov rdx, qword [rax]
test rdx, rdx
je 0x14007d931
mov qword [rdx + 0x18], r14
mov edx, dword [rax + 0xc]
mov qword [rax], r14
lea edx, [rdx + rdx*4 + 5]
add edx, edx
cmp dword [rax + 8], edx
jb 0x14007d6d0
mov rdi, qword [r13 + 0x150]
mov ebx, dword [rdi + 0x34]
test ebx, ebx
jne 0x14007d6d0
mov ecx, dword [rdi + 8]
mov edx, 1
shl rcx, 5
call sub.msvcrt.dll_calloc
mov rsi, rax
test rax, rax
je 0x14007df43
mov edx, dword [rdi + 8]
mov eax, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
lea edx, [rdx + rdx - 1]
test edx, eax
setne dl
add ecx, 1
shr eax, cl
movzx edx, dl
add edx, eax
mov dword [rdi + 0x28], edx
mov rax, qword [r13 + 0x150]
mov dword [rax + 0x2c], 0
mov r8, qword [r13 + 0x150]
mov eax, dword [r8 + 8]
test eax, eax
je 0x14007da70
xor r10d, r10d
nop dword [rax + rax]
mov edx, r10d
shl rdx, 4
add rdx, qword [r8]
mov rdx, qword [rdx]
test rdx, rdx
jne 0x14007d9fa
jmp 0x14007da63
mov qword [rcx + 0x18], rdx
mov r8, qword [r13 + 0x150]
mov qword [rax], rdx
test r9, r9
je 0x14007da5f
mov eax, dword [r8 + 8]
mov rdx, r9
lea eax, [rax + rax - 1]
and eax, dword [rdx + 0x34]
mov r9, qword [rdx + 0x20]
shl rax, 4
add rax, rsi
mov edi, dword [rax + 8]
lea ecx, [rdi + 1]
mov dword [rax + 8], ecx
cmp ecx, dword [r8 + 0x28]
jbe 0x14007da3c
add dword [r8 + 0x2c], 1
mov r8, qword [r13 + 0x150]
mov ecx, dword [rax + 0xc]
mov edi, dword [r8 + 0x28]
imul edi, ecx
cmp dword [rax + 8], edi
jbe 0x14007da3c
add ecx, 1
mov dword [rax + 0xc], ecx
mov qword [rdx + 0x18], 0
mov rcx, qword [rax]
mov qword [rdx + 0x20], rcx
test rcx, rcx
jne 0x14007d9e0
mov qword [rax], rdx
mov r8, qword [r13 + 0x150]
test r9, r9
jne 0x14007d9f3
mov eax, dword [r8 + 8]
add r10d, 1
cmp r10d, eax
jb 0x14007d9c0
mov rcx, qword [r8]
call sub.msvcrt.dll_free
mov rax, qword [r13 + 0x150]
shl dword [rax + 8], 1
mov rax, qword [r13 + 0x150]
add dword [rax + 0xc], 1
mov rax, qword [r13 + 0x150]
mov qword [rax], rsi
mov rax, qword [r13 + 0x150]
mov edx, dword [rax + 0x10]
shr edx, 1
cmp dword [rax + 0x2c], edx
jbe 0x14007daae
mov ebx, dword [rax + 0x30]
add ebx, 1
mov dword [rax + 0x30], ebx
mov rax, qword [r13 + 0x150]
cmp dword [rax + 0x30], 1
jbe 0x14007d6d0
mov dword [rax + 0x34], 1
jmp 0x14007d6d0
mov r8d, 2
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_fseek
mov rcx, r14
call sub.msvcrt.dll_ftell
mov qword [rsp + 0x28], rsi
xor edx, edx
xor ecx, ecx
movsxd rdi, eax
lea rax, str.____Initial_size_of__s_is__lu
mov r9d, 3
mov qword [rsp + 0x20], rax
lea r8, str.dap_chain_cell
mov qword [rsp + 0x30], rdi
call fcn.14005a0c0
xor edx, edx
xor r8d, r8d
mov rcx, r14
call sub.msvcrt.dll_fseek
mov rcx, r14
call sub.msvcrt.dll__fileno
mov rdx, rdi
mov r13d, eax
test rdi, rdi
jne 0x14007db53
mov eax, dword [0x1403f17d0]
test eax, eax
je 0x14007de2f
mov edx, eax
neg eax
add rdx, 0xfffffff
and rdx, rax
mov dword [rsp + 0x20], r13d
mov r8d, 3
mov r9d, 2
xor ecx, ecx
mov qword [rsp + 0x28], 0
call fcn.14014a350
mov r8, rax
cmp rax, 0xffffffffffffffff
je 0x14007dead
mov edx, 0x188
mov ecx, 1
movq xmm6, r8
mov qword [rsp + 0x48], r8
call sub.msvcrt.dll_calloc
mov r8, qword [rsp + 0x48]
punpcklqdq xmm6, xmm6
mov r13, rax
movzx eax, r15b
test r8, r8
je 0x14007d75f
lea rax, [r8 + rdi]
movq xmm1, r14
mov byte [r13], r15b
mov rdx, r8
movq xmm0, rax
mov qword [r13 + 8], rbx
lea rdi, [r13 + 0x10]
mov ecx, 0x20
punpcklqdq xmm0, xmm1
movups xmmword [r13 + 0x118], xmm6
movups xmmword [r13 + 0x128], xmm0
mov qword [r13 + 0x140], 0xffffffffffffffff
rep movsq qword [rdi], qword [rsi]
mov eax, dword [rsi]
mov dword [rdi], eax
call fcn.1400f9220
mov rdx, qword [r13 + 0x128]
mov qword [r13 + 0x148], rax
mov rcx, rax
call fcn.1400f9220
mov rdx, qword [r13 + 0x118]
mov qword [r13 + 0x148], rax
test rdx, rdx
je 0x14007dc57
mov rax, qword [r13 + 0x128]
xor r9d, r9d
lea r8, str.dap_chain_cell
xor ecx, ecx
sub rax, rdx
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, str.____Mapped_region_is__lu
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
movzx eax, byte [r13]
jmp 0x14007d7a0
mov rax, qword [sym.imp.msvcrt.dll__errno]
mov qword [rsp + 0x48], rax
call rax
cmp dword [rax], 2
jne 0x14007d749
lea rax, str.____File__s_doesnt_exist__create_it
mov qword [rsp + 0x28], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r9d, 3
lea r8, str.dap_chain_cell
call fcn.14005a0c0
lea rdx, [0x1402b157d]
mov rcx, rsi
call sub.msvcrt.dll_fopen
mov r13, rax
test rax, rax
je 0x14007defd
mov rcx, rax
call sub.msvcrt.dll__fileno
mov r14d, eax
mov eax, dword [0x1403f17d0]
test eax, eax
jne 0x14007dd00
lea rcx, [rsp + 0x50]
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov qword [rsp + 0x40], rcx
call rdi
mov eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov dword [0x1403f17d0], eax
je 0x14007de88
mov edi, eax
neg eax
add rdi, 0xfffffff
mov dword [rsp + 0x20], r14d
and rdi, rax
mov r8d, 3
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov r9d, 2
mov rdx, rdi
mov r14, r13
call fcn.14014a350
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x14007db81
mov rax, qword [rsp + 0x48]
call rax
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov qword [rsp + 0x30], r15
lea r8, str.dap_chain_cell
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x38], eax
lea rax, str.Chain_cell___s__0x_016llX_cannot_be_mapped__error__d
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov rcx, r13
xor r13d, r13d
call sub.msvcrt.dll_fclose
mov rcx, r12
call fcn.140030ef0
jmp 0x14007d6d8
pxor xmm0, xmm0
mov ecx, 0x40
movups xmmword [r13 + 0x158], xmm0
call sub.msvcrt.dll_malloc
mov qword [r13 + 0x150], rax
mov rdi, rax
test rax, rax
je 0x14007df43
lea r14, [r13 + 0x150]
mov qword [rax + 0x10], 0
mov edx, 1
mov ecx, 0x200
mov qword [rax + 0x28], 0
mov qword [rax + 0x30], 0
mov qword [rax + 0x38], 0
mov qword [rax + 0x18], r14
mov rax, qword [0x1402b1a28]
mov qword [rdi + 0x20], 0x150
mov qword [rdi + 8], rax
call sub.msvcrt.dll_calloc
mov dword [rdi + 0x38], 0xa0111fe1
mov qword [rdi], rax
test rax, rax
je 0x14007df43
mov qword [rbx + 0x38], r13
mov eax, 1
jmp 0x14007d8ef
mov rdx, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
call rdx
mov eax, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov dword [0x1403f17d0], eax
jne 0x14007db45
call rdx
mov ecx, dword [rsp + 0x54]
mov edx, 0x10000fff
mov eax, ecx
mov dword [0x1403f17d0], ecx
neg eax
test ecx, ecx
mov ecx, 0xfffff000
cmove rax, rcx
jmp 0x14007db50
call rdi
mov edx, dword [rsp + 0x54]
mov edi, 0x10000fff
mov eax, edx
mov dword [0x1403f17d0], edx
neg eax
test edx, edx
mov edx, 0xfffff000
cmove rax, rdx
jmp 0x14007dd0b
call qword [sym.imp.msvcrt.dll__errno]
mov r9d, 7
xor edx, edx
xor ecx, ecx
mov eax, dword [rax]
mov qword [rsp + 0x30], r15
lea r8, str.dap_chain_cell
xor r13d, r13d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x38], eax
lea rax, str.Chain_cell___s__0x_016llX_cannot_be_mapped__errno__d
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov rcx, r14
call sub.msvcrt.dll_fclose
mov rcx, r12
call fcn.140030ef0
jmp 0x14007d6d8
mov rax, qword [rsp + 0x48]
call rax
xor ecx, ecx
mov r9d, 7
xor edx, edx
mov eax, dword [rax]
mov qword [rsp + 0x30], r15
lea r8, str.dap_chain_cell
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x38], eax
lea rax, str.Chain_cell___s__0x_016llX_cannot_be_opened__error__d
mov qword [rsp + 0x20], rax
call fcn.14005a0c0
mov rcx, r12
call fcn.140030ef0
jmp 0x14007d6d8
or ecx, 0xffffffff
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop