Function at 0x14017ad94
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x14042eb28]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa0]
xor r14d, r14d
mov r15, qword [rbp + 0xa8]
mov rbx, rdx
mov qword [rbp - 0x80], r8
mov r13, rcx
xor edx, edx
mov qword [rbp - 0x70], rax
lea r8d, [r14 + 0x48]
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], r14
mov r12, r9
mov qword [rsp + 0x40], r14
mov edi, r14d
mov qword [rsp + 0x58], r14
mov esi, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
mov qword [rbp - 0x10], r14
lea r9, [rsp + 0x38]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp]
call fcn.14017bdc8
mov r14d, eax
test eax, eax
jns 0x14017ae46
mov ecx, eax
call fcn.14007ab24
xor r15d, r15d
jmp 0x14017af7f
cmp dword [rsp + 0x38], esi
je 0x14017ae72
lea r8, [rbp - 0x68]
mov rcx, r15
lea rdx, [rbp]
call fcn.14017d7a4
xor r15d, r15d
mov r14d, eax
test eax, eax
jns 0x14017ae72
mov ecx, eax
call fcn.14007ab24
jmp 0x14017af7f
mov r15, qword [r13 + 0x18]
xor r14d, r14d
cmp dword [0x140438e08], 1
cmove r14, qword [0x1404384a0]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403b8660]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r15
call rbx
xor r15d, r15d
mov r14d, eax
test eax, eax
js 0x14017ae66
mov eax, dword [rbp + 0x98]
test al, 0x40
je 0x14017b0d8
cmp dword [0x140438e08], 1
jne 0x14017aed9
mov r9, qword [0x140438580]
mov r8, qword [0x140438578]
jmp 0x14017aedf
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [rbp + 0x90], 4
jne 0x14017b0ad
lea rdx, [0x1403be6f4]
mov r8d, dword [r12]
lea rcx, [rsp + 0x40]
call fcn.140079c18
mov r14d, eax
test eax, eax
js 0x14017ae66
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x14017af45
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x14017ae68
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov r14, qword [rax + 0xd8]
mov rcx, r14
call qword [0x1403b8660]
mov rdx, rdi
mov rcx, rbx
call r14
mov r14d, eax
test eax, eax
js 0x14017ae66
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.140077a84
mov ecx, r14d
call fcn.14007ab44
mov r12d, 3
mov qword [rsp + 0x70], r15
lea rax, [0x14003c338]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov ebx, 0xb9
lea r13d, [r12 + 0x1d]
mov qword [rsp + 0x78], rax
mov r8d, r13d
xor r9d, r9d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x1400239f8]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], r15
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, r13d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x14017b01b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
test rdi, rdi
je 0x14017b029
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14017b057
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov ebx, 0xb9
lea rax, [0x14001cb78]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], r15
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, r13
mov rcx, rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14036e5e0
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x140438e08], 1
mov r9d, 1
mov rdx, qword [rsp + 0x30]
mov r8, r15
cmove r8, qword [0x140438570]
mov rcx, qword [r13 + 0x18]
call fcn.14017d220
jmp 0x14017af66
test al, al
jns 0x14017b129
cmp dword [0x140438e08], 1
jne 0x14017b0f5
mov r9, qword [0x140438588]
mov r8, qword [0x140438578]
jmp 0x14017b0fb
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [rbp + 0x90], 4
jne 0x14017b0ad
lea rdx, [0x1403c0d70]
jmp 0x14017af0c
bt eax, 8
jae 0x14017b18e
cmp dword [0x140438e08], 1
jne 0x14017b148
mov r9, qword [0x140438590]
mov r8, qword [0x140438578]
jmp 0x14017b14e
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [rbp + 0x90], 8
jne 0x14017b0ad
mov r8, qword [r12]
lea rdx, str._I64u
lea rcx, [rsp + 0x40]
call fcn.140079c18
jmp 0x14017af1a
bt eax, 9
jae 0x14017b205
mov ebx, 1
cmp dword [0x140438e08], ebx
jne 0x14017b1b1
mov r9, qword [0x140438598]
mov r8, qword [0x140438578]
jmp 0x14017b1b7
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x14017b1f7
mov eax, edx
and eax, ebx
test al, al
jne 0x14017b1f7
shr rdx, 1
lea r8, [rsp + 0x40]
mov rcx, r12
call fcn.14007a630
jmp 0x14017af1a
cmp dword [0x140438e08], ebx
mov r9d, ebx
jmp 0x14017b0ba
bt eax, 0xa
jae 0x14017b415
cmp dword [0x140438e08], 1
jne 0x14017b228
mov r9, qword [0x1404385a0]
mov r8, qword [0x140438578]
jmp 0x14017b22e
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov r8d, dword [rbp + 0x90]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.14017c650
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [rsp + 0x4c], r15d
je 0x14017af71
cmp dword [rsp + 0x38], r15d
je 0x14017af71
mov rcx, qword [rbp - 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x14017b291
cmp rax, 0x26
jne 0x14017b2c5
cmp word [rcx], 0x7b
jne 0x14017b2cb
cmp word [rcx + 0x4a], 0x7d
jne 0x14017b2cb
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.14006fe70
mov ebx, eax
test eax, eax
jns 0x14017b2d7
mov ecx, eax
jmp 0x14017b2d2
cmp rax, 0x24
je 0x14017b2b2
mov ecx, 0x80070057
mov ebx, ecx
call fcn.14007ab24
mov ecx, ebx
call fcn.14007ab44
test ebx, ebx
js 0x14017af71
movups xmm0, xmmword [rbp - 0x68]
lea r8, [rsp + 0x38]
lea rdx, [0x1403d3174]
lea rcx, [rsp + 0x48]
movdqu xmmword [rbp - 0x40], xmm0
call fcn.1400ba818
test al, al
je 0x14017b365
movsxd rax, dword [rsp + 0x38]
shl rax, 4
add rax, qword [rsp + 0x50]
mov r14, qword [rax + 8]
test r14, r14
jne 0x14017b329
mov r14d, r15d
mov qword [rbp - 0x20], r15
jmp 0x14017b350
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.14007ab44
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, r14
call fcn.14007a880
mov r14d, eax
test eax, eax
jns 0x14017b350
mov ecx, eax
call fcn.14007ab24
mov ecx, r14d
call fcn.14007ab44
test r14d, r14d
jns 0x14017b365
mov ecx, r14d
jmp 0x14017ae68
lea r8, [rsp + 0x38]
lea rdx, str.pid2
lea rcx, [rsp + 0x48]
call fcn.1400ba818
test al, al
je 0x14017b403
movsxd r15, dword [rsp + 0x38]
xor r12d, r12d
mov rax, qword [rsp + 0x50]
add r15, r15
mov r14, qword [rax + r15*8 + 8]
test r14, r14
jne 0x14017b3a6
mov r14d, r12d
mov qword [rbp - 0x18], r12
jmp 0x14017b3cd
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.14007ab44
lea r8, [rbp - 0x18]
mov edx, ebx
mov rcx, r14
call fcn.14007a880
mov r14d, eax
test eax, eax
jns 0x14017b3cd
mov ecx, eax
call fcn.14007ab24
mov ecx, r14d
call fcn.14007ab44
test r14d, r14d
jns 0x14017b3e2
mov ecx, r14d
jmp 0x14017ae39
mov rax, qword [rsp + 0x50]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax + r15*8 + 8]
call fcn.14006b8f4
xor r15d, r15d
mov r14d, eax
test eax, eax
js 0x14017ae66
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call fcn.14017d3b4
jmp 0x14017af66
bt eax, 0xb
jae 0x14017b482
cmp dword [0x140438e08], 1
jne 0x14017b434
mov r9, qword [0x1404385a8]
mov r8, qword [0x140438578]
jmp 0x14017b43a
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [rbp + 0x90], 0x10
jne 0x14017b0ad
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.14006a0b8
mov rsi, qword [rsp + 0x58]
test eax, eax
js 0x14017b0ad
mov rcx, rsi
jmp 0x14017af2a
bt eax, 0xc
jae 0x14017b4b6
cmp dword [0x140438e08], 1
jne 0x14017b4cf
mov r9, qword [0x1404385b0]
jmp 0x14017b4c6
test ebx, ebx
je 0x14017af71
lea r9, [rsp + 0x40]
mov edx, ebx
mov rcx, r12
call fcn.1400694dc
jmp 0x14017af1a
cmp dword [0x140438e08], 1
jne 0x14017b4cf
mov r9, qword [0x1404385b8]
mov r8, qword [0x140438578]
jmp 0x14017b4d5
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015fd2c
mov r14d, eax
test eax, eax
js 0x14017ae66
cmp dword [0x140438e08], 1
mov r8, r15
mov ebx, dword [rbp + 0x90]
mov r9d, ebx
cmove r8, qword [0x1404385c0]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14017d220
mov r14d, eax
test eax, eax
jns 0x14017b49a
jmp 0x14017ae66