Function at 0x1402a9c00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x238]
mov rax, qword [0x140961e80]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
xor r9d, r9d
mov r8d, 0xb0
lea rdx, [rbp + 0x10]
mov ecx, 0x50
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1402aa270
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xf8], 0
mov dword [rbp + 0x114], 0
jmp 0x1402a9c8d
mov eax, dword [rbp + 0x114]
inc eax
mov dword [rbp + 0x114], eax
cmp dword [rbp + 0x114], 8
jae 0x1402a9cd6
mov eax, dword [rbp + 0x114]
mov rax, qword [rbp + rax*8 + 0x38]
mov rcx, qword [rbp + 0xd8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xd8], rax
mov eax, dword [rbp + 0x114]
mov rax, qword [rbp + rax*8 + 0x78]
mov rcx, qword [rbp + 0xf8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xf8], rax
jmp 0x1402a9c7f
imul rax, qword [rbp + 0x10], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x534
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0x18], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x535
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0x20], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x536
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0x28], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x537
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0x30], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x546
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0xd8], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x539
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 0
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x542
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 1
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x543
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 2
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x544
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 3
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x545
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 4
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x554
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 5
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x555
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 6
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x556
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 7
imul rax, qword [rbp + rax + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x557
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
imul rax, qword [rbp + 0xf8], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x547
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 0
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x548
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 1
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x549
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 2
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54a
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 3
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54b
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 4
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54c
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 5
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54d
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 6
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54e
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
mov eax, 8
imul rax, rax, 7
imul rax, qword [rbp + rax + 0x78], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54f
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
cmp dword [0x14095f7f0], 0x3e
jb 0x1402aa252
imul rax, qword [rbp + 0xb8], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.SystemInformer.exe_PhFormatSize
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x55d
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
jmp 0x1402aa26b
lea r8, [0x1406771d8]
mov edx, 0x55d
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
jmp 0x1402aa4c8
lea r8, [0x1406550d8]
mov edx, 0x534
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x535
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x536
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x537
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x55d
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x546
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x539
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x542
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x543
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x544
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x545
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x554
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x555
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x556
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x557
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x547
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x548
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x549
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54a
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54b
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54c
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54d
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54e
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea r8, [0x1406550d8]
mov edx, 0x54f
mov rcx, qword [rbp + 0x210]
call sym.SystemInformer.exe_PhSetDialogItemText
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14068c060]
call fcn.1402124fd
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.14020ee98
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret