Function at 0x140173d6c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor ecx, ecx
mov r12d, r8d
mov qword [rbp - 0x40], rcx
mov edi, ecx
mov qword [rbp - 0x48], rcx
mov ebx, ecx
mov esi, ecx
cmp r8d, 0xffffffff
jne 0x140173db0
lea r14d, [rcx + 1]
jmp 0x14017413e
or r13, 0xffffffffffffffff
mov r15, r13
inc r15
cmp word [r9 + r15*2], cx
jne 0x140173db7
mov r14d, r15d
mov qword [rbp - 0x38], r14
cmp r15, r14
je 0x140173dd9
mov ecx, 0x80070216
call fcn.1400790f8
jmp 0x140173dde
call fcn.140079118
mov rax, r15
sub rax, r14
neg rax
sbb r14d, r14d
and r14d, 0x80070216
mov ecx, r14d
call fcn.140079118
mov rax, qword [rbp - 0x38]
cmp r15, rax
je 0x140173e0f
mov ecx, r14d
call fcn.1400790f8
jmp 0x14017413e
test eax, eax
je 0x140173e31
test r12b, 8
je 0x140173e31
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.140175264
mov r14d, eax
test eax, eax
jns 0x140173e40
mov ecx, eax
jmp 0x140173e05
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.140078fc0
jmp 0x140173e26
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rdi, rax
test rax, rax
jne 0x140173e5e
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140173e05
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140173e8c
lea r14, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov r15, qword [rbp + 0x68]
test r15, r15
jne 0x140173ee9
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, [0x1403b8928]
call fcn.140078cfc
mov r14d, eax
test eax, eax
js 0x140173ecc
lea rcx, [0x1403b8928]
mov edx, dword [rbp + 0x58]
lea r8, [rbp - 0x48]
call fcn.140078e54
mov r14d, eax
test eax, eax
jns 0x140173ed3
mov ecx, eax
call fcn.1400790f8
mov ecx, r14d
call fcn.140079118
test r14d, r14d
jns 0x140173fa6
jmp 0x140173e02
test r12b, 4
je 0x140173f1e
mov rax, qword [rbp + 0x48]
cmp dword [rax + 4], ecx
jne 0x140173f1e
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, str._exc_
call fcn.140078cfc
mov r14d, eax
test eax, eax
js 0x140173ecc
lea rcx, str._exc_
jmp 0x140173eb9
inc r13
cmp word [r15 + r13*2], cx
jne 0x140173f1e
mov edx, r13d
mov qword [rbp - 0x30], rdx
cmp r13, rdx
je 0x140173f40
mov ecx, 0x80070216
call fcn.1400790f8
jmp 0x140173f4b
xor ecx, ecx
call fcn.140079118
mov rdx, qword [rbp - 0x30]
mov rax, r13
sub rax, rdx
neg rax
mov rax, qword [rbp - 0x38]
sbb r14d, r14d
and r14d, 0x80070216
cmp r13, rdx
mov ecx, r14d
cmove eax, r13d
mov qword [rbp - 0x38], rax
call fcn.140079118
cmp r13, qword [rbp - 0x30]
jne 0x140173e02
mov rax, qword [rbp - 0x38]
test eax, eax
je 0x140173faa
test r12b, 0x10
je 0x140173faa
lea r8, [rbp - 0x48]
mov edx, eax
mov rcx, r15
call fcn.140159bc0
mov r14d, eax
test eax, eax
js 0x140173e2d
mov r15, qword [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rbx, rax
test rax, rax
je 0x140173e54
mov r13, qword [rbp + 0x70]
test r13, r13
je 0x140173fe7
test r12b, 0x40
jne 0x140173fe7
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rsi, rax
test rax, rax
je 0x140173e54
mov r15, qword [rbp + 0x48]
test r12b, 1
je 0x14017405c
mov rdx, qword [rbp + 0x50]
mov r9, rbx
mov rcx, qword [r15 + 0x18]
mov r8, rdi
call fcn.14015acfc
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140173e02
test r13, r13
je 0x14017404a
test r12b, 0x40
jne 0x14017404a
cmp dword [0x14042fd08], 1
mov r8d, eax
mov rdx, qword [rbp + 0x50]
mov r9, rsi
cmove r8, qword [0x14042f4c0]
mov rcx, qword [r15 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140173e2d
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x40]
call fcn.14007613c
jmp 0x14017412c
mov rax, qword [r15 + 0x18]
mov qword [rbp - 0x30], rax
mov rax, qword [rax]
mov r14, qword [rax + 0x178]
test r12b, 2
je 0x1401741e2
mov rcx, r14
call qword [0x1403af620]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rdx, rdi
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140173e02
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
test r12b, 0x20
je 0x140174244
mov r8, rbx
call fcn.1401753c0
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140173e02
test r13, r13
je 0x1401740fd
test r12b, 0x40
jne 0x1401740fd
cmp dword [0x14042fd08], 1
mov r8d, eax
mov rdx, qword [rbp - 0x40]
mov r9, rsi
cmove r8, qword [0x14042f4c0]
mov rcx, qword [r15 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140173e2d
mov r15, qword [rbp + 0x50]
mov rax, qword [r15]
mov r14, qword [rax + 0xa8]
mov rcx, r14
call qword [0x1403af620]
mov rdx, qword [rbp - 0x40]
xor r8d, r8d
mov rcx, r15
call r14
mov r14d, eax
test eax, eax
js 0x140173e2d
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x14017413e
mov rcx, qword [rbp - 0x40]
call fcn.14007613c
mov ecx, r14d
call fcn.140079118
test rsi, rsi
je 0x140174154
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test rbx, rbx
je 0x140174164
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140174172
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x14017419a
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
xor r9d, r9d
mov qword [rbp - 0x28], 3
lea rax, [0x140011f38]
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x40]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x14042fd08], 1
mov r15, rcx
mov rcx, r14
cmove r15, qword [0x14042f4a8]
call qword [0x1403af620]
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rdx, r15
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140173e02
cmp dword [0x14042fd08], 1
mov r8d, eax
mov r15, qword [rbp + 0x48]
mov r9, rdi
cmove r8, qword [0x14042f4b0]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
call fcn.14015acfc
jmp 0x14017408f
cmp dword [0x14042fd08], 1
mov r8, rax
mov r9, rbx
cmove r8, qword [0x14042f4b8]
call fcn.14015acfc
jmp 0x1401740b7