Function at 0x1400248b0
Capabilities:
Get system information on windows
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rdi, r9
mov rbx, r8
mov qword [rsp + 0x40], rdx
mov r12, rcx
mov qword [rsp + 0x48], rcx
mov rsi, qword [rbp + 0xe0]
cmp byte [0x1401ea1e8], 0
je 0x140024f2e
cmp qword [rdx + 0x10], 0
je 0x140024f01
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rcx
lea rcx, [rbp - 0x38]
call fcn.140013bf0
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140024540
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x68], xmm1
movups xmmword [rbp - 0x58], xmm1
movups xmmword [rbp - 0x48], xmm1
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
test rbx, rbx
je 0x140024963
mov rbx, qword [rbx]
jmp 0x140024967
mov rbx, qword [rbp - 0x60]
test rdi, rdi
je 0x140024971
mov r14, qword [rdi]
jmp 0x140024975
mov r14, qword [rbp - 0x58]
mov qword [rsp + 0x38], r14
movsd xmm1, qword [0x1401c49b8]
movsd xmm0, qword [0x1401c4988]
call fcn.1400ce120
cvttsd2si eax, xmm0
add eax, 0x800
movsxd rdi, eax
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x20], 0
xor r15d, r15d
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x30], r15
lea ecx, [r15 + 0x18]
call fcn.14015be00
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x38], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x58], 8
mov dword [rbp + 0x20], 0x3f800000
mov r8, rax
lea edx, [r15 + 0x10]
lea rcx, [rbp + 0x38]
call fcn.140013da0
nop
cmp rbx, r14
jae 0x140024e17
mov r13, qword [rbp + 0xd8]
nop dword [rax]
cmp byte [0x1401ec478], 0
jne 0x140024a2e
call fcn.1400c9300
mov rax, qword [0x1401ec350]
mov rdx, rbx
test rax, rax
je 0x140024a62
lea rcx, [rbp + 8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], Ordinal_50
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rcx, r12
call rax
mov rax, qword [rbp + 8]
jmp 0x140024a7a
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov qword [rbp + 8], rax
test rax, rax
je 0x140024e08
cmp dword [rbp - 0x78], 0x1000
jne 0x140024df9
mov eax, dword [rbp - 0x74]
bt eax, 8
jb 0x140024df9
test al, 4
jne 0x140024aa9
test al, 8
je 0x140024df9
mov rcx, qword [rsp + 0x68]
mov r14, rcx
mov qword [rsp + 0x30], rcx
mov rdx, qword [rbp - 0x80]
lea rax, [rcx + rdx]
cmp rcx, rax
jae 0x140024dee
nop word [rax + rax]
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov qword [rbp - 0x28], rax
test rdi, rdi
je 0x140024b18
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140024f28
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.140013f80
mov rcx, qword [rbp - 0x38]
lea rbx, [rcx + rdi]
mov r8, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x30], rbx
mov rbx, qword [rbp - 0x38]
cmp byte [0x1401ec478], 0
jne 0x140024b2a
call fcn.1400c9300
mov rax, qword [0x1401ec358]
mov r9, rdi
mov r8, rbx
mov rdx, r14
test rax, rax
je 0x140024b54
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, r12
call rax
shr eax, 0x1f
xor al, 1
jmp 0x140024b6b
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setne al
test al, al
je 0x140024d8e
xor ebx, ebx
mov r12, qword [rbp - 0x18]
mov rcx, qword [rsp + 0x40]
cmp r12, qword [rcx + 0x10]
je 0x140024d8e
mov r14, qword [rbp - 0x10]
mov rdi, qword [rbp + 0x28]
mov r11, qword [rbp - 0x38]
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbp - 8]
sub r9, r14
sar r9, 3
test r9, r9
je 0x140024c2c
lea r10, [r11 + rbx]
mov r8, r10
lea rdx, [r14 + 4]
nop dword [rax + rax]
mov eax, dword [rdx - 4]
cmp eax, 1
je 0x140024c1a
cmp eax, 2
jne 0x140024be9
movzx eax, byte [rdx]
movzx ecx, byte [r8]
sub ecx, eax
and ecx, 0x8000000f
jge 0x140024be5
dec ecx
or ecx, 0xfffffff0
inc ecx
test ecx, ecx
jmp 0x140024c14
cmp eax, 3
jne 0x140024c0a
movzx eax, byte [r8]
movzx ecx, byte [rdx]
cmp al, cl
jb 0x140024d6a
add ecx, 0xf
cmp eax, ecx
ja 0x140024d6a
jmp 0x140024c1a
test eax, eax
jne 0x140024c1a
movzx eax, byte [rdx]
cmp byte [r8], al
jne 0x140024d6a
add rdx, 8
inc r8
mov rax, r8
sub rax, r10
cmp rax, r9
jb 0x140024bc0
mov r8, qword [rsp + 0x30]
add r8, rbx
mov qword [rbp + 0x10], r8
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, r8b
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
xor rdx, rax
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul rdx, r9
mov rax, qword [rbp + 0x50]
and rax, rdx
add rax, rax
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, rdi
je 0x140024d01
mov rax, qword [rdx + rax*8]
cmp r8, qword [rcx + 0x10]
je 0x140024d03
nop dword [rax]
cmp rcx, rax
je 0x140024d01
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x140024cf0
jmp 0x140024d03
xor ecx, ecx
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
cmp rax, rdi
jne 0x140024d6a
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140024d26
mov qword [rdx], r8
add qword [rsi + 8], 8
jmp 0x140024d32
lea r8, [rbp + 0x10]
mov rcx, rsi
call fcn.14001e6c0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x20]
call fcn.140026e00
test r13, r13
je 0x140024d5a
inc r15
movzx eax, word [r13]
cmp r15, rax
jae 0x140024e69
mov r14, qword [rbp - 0x10]
mov rdi, qword [rbp + 0x28]
mov r11, qword [rbp - 0x38]
mov r12, qword [rbp - 0x18]
inc rbx
mov rax, r12
mov rdx, qword [rsp + 0x40]
sub rax, qword [rdx + 0x10]
cmp rbx, rax
jb 0x140024ba0
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x30]
jmp 0x140024d92
mov r11, qword [rbp - 0x38]
test r11, r11
je 0x140024dcb
mov rdx, qword [rbp - 0x28]
sub rdx, r11
mov rax, r11
cmp rdx, 0x1000
jb 0x140024dc3
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024ef5
mov rcx, r11
call fcn.14015c094
add r14, rdi
mov qword [rsp + 0x30], r14
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
lea rax, [rdx + rcx]
cmp r14, rax
mov r12, qword [rsp + 0x48]
jb 0x140024ad0
mov r14, qword [rsp + 0x38]
lea rbx, [rdx + rcx]
jmp 0x140024e0e
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
lea rbx, [rdx + rcx]
jmp 0x140024e0e
mov eax, dword [rbp - 0x64]
add rbx, rax
cmp rbx, r14
jb 0x140024a20
lea rcx, [rbp + 0x20]
call fcn.140024f50
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140024f01
mov rdx, qword [rbp]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024efc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140024eaf
mov rdx, qword [rbp - 0x28]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024ef5
call fcn.14015c094
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], 0
lea rcx, [rbp + 0x20]
call fcn.140024f50
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140024f01
mov rdx, qword [rbp]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024efc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14015c094
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14015bde0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140010560
nop
movss xmm0, dword [0x1401c4720]
call fcn.1400cdb40
int3