Function at 0x1400b3990
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x14049f3c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rbp, rcx
mov r14d, 4
mov rax, qword gs:[0x58]
add r14, qword [rax]
mov eax, dword [r14]
cmp dword [0x1404b6cb8], eax
jle 0x1400b3a1d
lea rcx, [0x1404b6cb8]
call fcn.1402bafac
cmp dword [0x1404b6cb8], 0xffffffff
jne 0x1400b3a1d
lea rcx, [0x14042a808]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14042b060]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404b6cc0], rax
lea rcx, [0x1404b6cb8]
call fcn.1402baf40
mov eax, dword [r14]
cmp dword [0x1404b6cc8], eax
jle 0x1400b3a6d
lea rcx, [0x1404b6cc8]
call fcn.1402bafac
cmp dword [0x1404b6cc8], 0xffffffff
jne 0x1400b3a6d
lea rcx, [0x14042a808]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404b6cd0], rax
lea rcx, [0x1404b6cc8]
call fcn.1402baf40
xor r15d, r15d
mov edi, 0x8664
mov esi, 0x14c
mov eax, dword [r14]
cmp dword [0x1404b6cd8], eax
jle 0x1400b3b37
lea rcx, [0x1404b6cd8]
call fcn.1402bafac
cmp dword [0x1404b6cd8], 0xffffffff
jne 0x1400b3b37
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x30], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400b3ae5
cmp dword [rsp + 0x30], r15d
je 0x1400b3ae5
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x1400b3af0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x40]
test eax, eax
je 0x1400b3b21
cmp eax, 6
je 0x1400b3b1a
cmp eax, 9
je 0x1400b3b15
cmp eax, 0xc
je 0x1400b3b0e
movzx eax, r15w
jmp 0x1400b3b24
mov eax, 0xaa64
jmp 0x1400b3b24
movzx eax, di
jmp 0x1400b3b24
mov eax, 0x200
jmp 0x1400b3b24
movzx eax, si
mov word [0x1404b6cdc], ax
lea rcx, [0x1404b6cd8]
call fcn.1402baf40
mov rax, qword [0x1404b6cd0]
test rax, rax
je 0x1400b3c2d
lea r8, [rbx + 2]
mov rdx, rbx
mov rcx, rbp
call rax
test eax, eax
je 0x1400b3c4c
cmp word [rbx], 0
je 0x1400b3b6a
mov byte [rbx + 4], 1
jmp 0x1400b3c81
mov byte [rbx + 4], 0
movzx esi, word [rbx + 2]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbp, rax
je 0x1400b3c28
mov eax, dword [r14]
cmp dword [0x1404b6ca8], eax
jle 0x1400b3bd1
lea rcx, [0x1404b6ca8]
call fcn.1402bafac
cmp dword [0x1404b6ca8], 0xffffffff
jne 0x1400b3bd1
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404b6cb0], rax
lea rcx, [0x1404b6ca8]
call fcn.1402baf40
mov rax, qword [0x1404b6cb0]
test rax, rax
je 0x1400b3c25
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
mov r9d, 0x40
lea r8, [rsp + 0x40]
lea edx, [r9 - 0x1b]
mov rcx, rbp
call rax
test eax, eax
js 0x1400b3c25
movzx edi, word [rsp + 0x70]
test di, di
jne 0x1400b3c28
movzx edi, si
mov word [rbx], di
jmp 0x1400b3c81
mov rax, qword [0x1404b6cc0]
test rax, rax
je 0x1400b3c6f
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x30]
mov rcx, rbp
call rax
test eax, eax
jne 0x1400b3c50
xor al, al
jmp 0x1400b3c83
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
sete al
mov byte [rbx + 4], al
movzx eax, word [0x1404b6cdc]
test ecx, ecx
jne 0x1400b3c6a
mov esi, eax
mov word [rbx], si
jmp 0x1400b3c7d
mov byte [rbx + 4], 0
movzx eax, word [0x1404b6cdc]
mov word [rbx], ax
mov word [rbx + 2], ax
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402ba9b0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret