Function at 0x140002770
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14005a060]
xor rax, rsp
mov qword [rbp], rax
mov r14, rdx
mov rdi, rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140002812
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor esi, esi
lea r8d, [rsi + 0x1b]
lea rdx, str.failed_to_get_module_handle
movdqa xmm0, xmmword [0x140051f50]
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x28], rsi
lea rcx, [rsp + 0x28]
call fcn.140004ff0
mov dword [rbp - 0x78], ebx
lea rcx, [0x14005aca0]
mov qword [rbp - 0x70], rcx
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rdi], xmm0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdi + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdi + 0x20], xmm1
mov byte [rdi + 0x30], 1
jmp 0x140002a29
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400029a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor esi, esi
cmp eax, 0x7f
je 0x14000284a
lea r8d, [rsi + 0x1f]
lea rdx, str.failed_to_get_wow64_proc_adress
jmp 0x1400027c5
mov dword [rbp - 0x40], esi
lea rdx, [rbp - 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x140002909
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x28], rsi
movdqa xmm0, xmmword [0x140051f50]
movdqu xmmword [rsp + 0x38], xmm0
mov r8d, 0x21
lea rdx, str.failed_to_check_for_wow64_process
lea rcx, [rsp + 0x28]
call fcn.140004ff0
mov dword [rsp + 0x58], ebx
lea rcx, [0x14005aca0]
mov qword [rsp + 0x60], rcx
movups xmm3, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x68], xmm3
movdqu xmm2, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x28], xmm1
movups xmmword [rsp + 0x38], xmm3
movdqa xmm0, xmmword [0x140051f50]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], sil
movups xmmword [rdi], xmm1
movups xmmword [rdi + 0x10], xmm3
movups xmmword [rdi + 0x20], xmm2
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], sil
mov byte [rdi + 0x30], 1
lea rcx, [rsp + 0x28]
call fcn.140002610
lea rcx, [rsp + 0x58]
call fcn.140002610
jmp 0x140002a29
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
movups xmmword [rbp - 0x68], xmm0
movups xmmword [rbp - 0x58], xmm0
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rbp - 0x78]
lea rcx, [rbp - 0x38]
call fcn.140002670
cmp byte [rbp - 8], sil
je 0x14000296e
lea rcx, [rbp - 0x38]
call fcn.140003830
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140003e70
mov rdx, rax
mov rcx, rdi
call fcn.140003eb0
lea rcx, [rsp + 0x58]
call fcn.140002610
lea rcx, [rbp - 0x38]
call fcn.1400037b0
jmp 0x140002a29
mov eax, dword [rbp - 0x40]
neg eax
sbb cx, cx
and cx, 0x14c
mov word [rsp + 0x20], cx
lea rcx, [rbp - 0x38]
call fcn.140003880
movzx ecx, word [rax]
mov word [rsp + 0x22], cx
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov byte [rdi + 0x30], sil
lea rcx, [rbp - 0x38]
call fcn.1400037b0
jmp 0x140002a29
xor esi, esi
mov word [rbp - 0x48], si
mov word [rbp - 0x44], si
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x48]
mov rcx, r14
call qword [0x1400423f8]
test eax, eax
jne 0x140002a0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.failed_to_check_for_wow64_process
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140003de0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140003e70
mov rdx, rax
mov rcx, rdi
call fcn.140003eb0
lea rcx, [rbp - 0x78]
call fcn.140002610
lea rcx, [rsp + 0x58]
call fcn.140002610
jmp 0x140002a29
movzx eax, word [rbp - 0x48]
mov word [rsp + 0x20], ax
movzx eax, word [rbp - 0x44]
mov word [rsp + 0x22], ax
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov byte [rdi + 0x30], sil
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140019030
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret