Function at 0x14000bfa8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140042038]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rdi, [rcx + 0x10]
mov rcx, rdi
call fcn.140001834
nop
xor r14d, r14d
mov byte [rbx + 0x4c], r14b
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [rbp - 0x7c]
mov dword [rbx], eax
mov eax, dword [rbp - 0x78]
mov dword [rbx + 4], eax
mov eax, dword [rbp - 0x74]
mov dword [rbx + 8], eax
lea rdx, [rbp - 0x6c]
mov rcx, rdi
call fcn.140001908
mov r8d, r14d
or r10, 0xffffffffffffffff
lea r15, [0x140038a64]
cmp qword [rdi + 8], r14
jbe 0x14000c073
mov rax, qword [rdi]
mov r9, r14
mov rcx, r14
mov edx, 0x20
cmp word [rax], dx
jne 0x14000c054
inc rcx
inc r9
movzx edx, word [r15 + r9*2]
test dx, dx
jne 0x14000c04c
test rcx, rcx
je 0x14000c076
inc r8
add rax, 2
cmp r8, qword [rdi + 8]
jb 0x14000c041
mov r8, r10
cmp r8, r10
jne 0x14000c080
mov r8, r10
jmp 0x14000c085
test r8, r8
je 0x14000c08f
xor edx, edx
mov rcx, rdi
call fcn.140001b6c
mov rdx, r15
mov rcx, rdi
call fcn.14000a9c0
mov word [rbx + 0x47], r14w
mov qword [rbx + 0x30], r14
mov qword [rbx + 0x38], r14
mov dword [rbx + 0x40], r14d
mov word [rbx + 0x44], r14w
mov byte [rbx + 0x46], r14b
mov ecx, dword [rbx]
sub ecx, 5
je 0x14000c1e0
dec ecx
je 0x14000c11d
cmp ecx, 4
jne 0x14000c21d
mov byte [rbx + 0x31], 1
mov byte [rbx + 0x33], 1
mov byte [rbx + 0x3f], 1
mov byte [rbx + 0x3d], 1
mov byte [rbx + 0x3b], 1
mov byte [rbx + 0x39], 1
mov byte [rbx + 0x35], 1
mov byte [rbx + 0x41], 1
mov byte [rbx + 0x43], 1
cmp dword [rbx + 4], r14d
jne 0x14000c21d
cmp byte [rbp + 0x9a], 1
jne 0x14000c10e
mov word [rbx + 0x44], 0x101
jmp 0x14000c21d
mov word [rbx + 0x45], 0x101
mov byte [rbx + 0x47], 1
jmp 0x14000c21d
mov byte [rbx + 0x31], 1
mov byte [rbx + 0x33], 1
mov eax, dword [rbx + 4]
test eax, eax
jne 0x14000c14f
cmp byte [rbp + 0x9a], 1
jne 0x14000c140
mov word [rbx + 0x34], 0x101
jmp 0x14000c21d
mov word [rbx + 0x35], 0x101
mov byte [rbx + 0x37], 1
jmp 0x14000c21d
cmp eax, 1
jne 0x14000c17c
mov byte [rbx + 0x35], al
mov byte [rbx + 0x37], al
cmp byte [rbp + 0x9a], al
jne 0x14000c16d
mov word [rbx + 0x38], 0x101
jmp 0x14000c21d
mov word [rbx + 0x39], 0x101
mov byte [rbx + 0x3b], 1
jmp 0x14000c21d
cmp eax, 2
jne 0x14000c1aa
mov byte [rbx + 0x3b], 1
mov byte [rbx + 0x39], 1
mov byte [rbx + 0x35], 1
cmp byte [rbp + 0x9a], 1
jne 0x14000c19e
mov word [rbx + 0x3c], 0x101
jmp 0x14000c21d
mov word [rbx + 0x3d], 0x101
mov byte [rbx + 0x3f], 1
jmp 0x14000c21d
cmp eax, 3
jne 0x14000c21d
mov byte [rbx + 0x3f], 1
mov byte [rbx + 0x3d], 1
mov byte [rbx + 0x3b], 1
mov byte [rbx + 0x39], 1
mov byte [rbx + 0x35], 1
cmp byte [rbp + 0x9a], 1
jne 0x14000c1d4
mov word [rbx + 0x40], 0x101
jmp 0x14000c21d
mov word [rbx + 0x41], 0x101
mov byte [rbx + 0x43], 1
jmp 0x14000c21d
cmp dword [rbx + 4], 1
jne 0x14000c1ee
mov word [rbx + 0x30], 0x101
jmp 0x14000c20f
cmp dword [rbx + 4], 2
jne 0x14000c20f
mov byte [rbx + 0x31], 1
mov byte [rbx + 0x33], 1
cmp byte [rbp + 0x9a], 1
jne 0x14000c20b
mov byte [rbx + 0x30], 1
jmp 0x14000c20f
mov byte [rbx + 0x32], 1
mov al, byte [rbp + 0x98]
shr al, 6
and al, 1
mov byte [rbx + 0x4c], al
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x20], 1
jne 0x14000c241
mov byte [rbx + 0x48], 1
mov dword [rsp + 0x48], r14d
xor edx, edx
lea r8d, [rdx + 0x2c]
lea rcx, [rsp + 0x4c]
call fcn.140017af0
cmp byte [rbx + 0x48], r14b
je 0x14000c2ba
mov qword [rsp + 0x40], r14
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000c29e
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000c29e
lea rcx, [rsp + 0x48]
call rax
jmp 0x14000c2aa
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
test rdi, rdi
je 0x14000c2c5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14000c2c5
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx ecx, word [rsp + 0x48]
mov word [rbx + 0x4a], cx
mov rax, rbx
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140015ef0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret