Function at 0x14005e420
Capabilities:
Get system information on windows

Disassembly:
jmp 0x14005e420
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x9e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x140289140]
xor rax, rbp
mov qword [rbp + 0x3e8], rax
lea rcx, [0x1402ac2b2]
call fcn.140007f72
nop
mov rdx, qword [rbp + 0x410]
lea rcx, [rbp + 8]
call fcn.1400084e0
nop
lea rcx, [rbp + 8]
call fcn.1400077c0
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x14005e4cb
mov ecx, 4
call fcn.140003297
nop
lea rdx, [0x14022caa8]
lea rcx, [0x14028c5e0]
call fcn.140001bae
nop
mov ecx, 7
call fcn.140003297
nop
lea rcx, [rbp + 8]
call fcn.140006e79
nop
jmp 0x14005e75d
mov r8d, dword [rbp + 0x44]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14005e520
mov ecx, 4
call fcn.140003297
nop
lea rdx, [0x14022cac8]
lea rcx, [0x14028c5e0]
call fcn.140001bae
nop
mov ecx, 7
call fcn.140003297
nop
lea rcx, [rbp + 8]
call fcn.140006e79
nop
jmp 0x14005e75d
lea rcx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
mov edx, 0x20
lea rcx, [rbp + 0x128]
call fcn.140006d3e
lea rcx, [rbp + 0x128]
call fcn.1400033c3
nop
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x168], rax
jmp 0x14005e577
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0x168]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x98]
cmp qword [rbp + 0x168], rax
jae 0x14005e73b
mov r9d, 0x30
lea r8, [rbp + 0xd8]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14005e736
cmp dword [rbp + 0xf8], 0x1000
jne 0x14005e736
cmp dword [rbp + 0xfc], 4
jne 0x14005e736
mov rdx, qword [rbp + 0xf0]
lea rcx, [rbp + 0x128]
call fcn.140001ad7
nop
lea rcx, [rbp + 0x128]
call fcn.140002ee1
lea rcx, [rbp + 0x188]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0xf0]
mov r8, rax
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14005e736
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x3d8], rax
lea rcx, [rbp + 0x128]
call fcn.140002ee1
mov qword [rbp + 0x3e0], rax
mov r8, qword [rbp + 0x3d8]
mov rdx, qword [rbp + 0x3e0]
lea rcx, [rbp + 0x1a8]
call fcn.140001b4f
nop
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x1e8], rax
mov rcx, qword [rbp + 0x1e8]
call fcn.1400037bf
mov qword [rbp + 0x208], rax
mov rcx, qword [rbp + 0x1e8]
call fcn.140007a72
mov qword [rbp + 0x228], rax
jmp 0x14005e6a2
mov rax, qword [rbp + 0x208]
add rax, 0x28
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x228]
cmp qword [rbp + 0x208], rax
je 0x14005e729
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0x248], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x248]
lea rcx, [rbp + 0x1a8]
call fcn.140002cfc
cmp rax, 0xffffffffffffffff
je 0x14005e724
mov ecx, 4
call fcn.140003297
nop
lea rdx, [0x14022caf0]
lea rcx, [0x14028c490]
call fcn.140001bae
mov rdx, qword [rbp + 0x248]
mov rcx, rax
call fcn.1400071da
lea rdx, [0x14022c4b4]
mov rcx, rax
call fcn.140001bae
nop
mov ecx, 7
call fcn.140003297
nop
jmp 0x14005e690
lea rcx, [rbp + 0x1a8]
call fcn.140002414
nop
jmp 0x14005e55c
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp + 0x128]
call fcn.14000749b
nop
lea rcx, [rbp + 8]
call fcn.140006e79
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140224910]
call fcn.140006b90
mov rcx, qword [rbp + 0x3e8]
xor rcx, rbp
call fcn.1400044d0
lea rsp, [rbp + 0x3f8]
pop rdi
pop rbp
ret