Function at 0x1401786a0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor ecx, ecx
mov r12d, r8d
mov qword [rbp - 0x40], rcx
mov edi, ecx
mov qword [rbp - 0x48], rcx
mov ebx, ecx
mov esi, ecx
cmp r8d, 0xffffffff
jne 0x1401786e4
lea r14d, [rcx + 1]
jmp 0x140178a7c
or r13, 0xffffffffffffffff
mov r15, r13
inc r15
cmp word [r9 + r15*2], cx
jne 0x1401786eb
mov r14d, r15d
mov qword [rbp - 0x38], r14
cmp r15, r14
je 0x14017870d
mov ecx, 0x80070216
call fcn.140079c40
jmp 0x140178712
call fcn.140079c60
mov rax, r15
sub rax, r14
neg rax
sbb r14d, r14d
and r14d, 0x80070216
mov ecx, r14d
call fcn.140079c60
mov rax, qword [rbp - 0x38]
cmp r15, rax
je 0x140178743
mov ecx, r14d
call fcn.140079c40
jmp 0x140178a7c
test eax, eax
je 0x140178765
test r12b, 8
je 0x140178765
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.140179bd8
mov r14d, eax
test eax, eax
jns 0x140178774
mov ecx, eax
jmp 0x140178739
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.140079b08
jmp 0x14017875a
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rdi, rax
test rax, rax
jne 0x140178792
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140178739
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x1401787c0
lea r14, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov r15, qword [rbp + 0x68]
test r15, r15
jne 0x14017881d
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, [0x1403ca998]
call fcn.140079840
mov r14d, eax
test eax, eax
js 0x140178800
lea rcx, [0x1403ca998]
mov edx, dword [rbp + 0x58]
lea r8, [rbp - 0x48]
call fcn.140079998
mov r14d, eax
test eax, eax
jns 0x140178807
mov ecx, eax
call fcn.140079c40
mov ecx, r14d
call fcn.140079c60
test r14d, r14d
jns 0x1401788da
jmp 0x140178736
test r12b, 4
je 0x140178852
mov rax, qword [rbp + 0x48]
cmp dword [rax + 4], ecx
jne 0x140178852
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, str._exc_
call fcn.140079840
mov r14d, eax
test eax, eax
js 0x140178800
lea rcx, str._exc_
jmp 0x1401787ed
inc r13
cmp word [r15 + r13*2], cx
jne 0x140178852
mov edx, r13d
mov qword [rbp - 0x30], rdx
cmp r13, rdx
je 0x140178874
mov ecx, 0x80070216
call fcn.140079c40
jmp 0x14017887f
xor ecx, ecx
call fcn.140079c60
mov rdx, qword [rbp - 0x30]
mov rax, r13
sub rax, rdx
neg rax
mov rax, qword [rbp - 0x38]
sbb r14d, r14d
and r14d, 0x80070216
cmp r13, rdx
mov ecx, r14d
cmove eax, r13d
mov qword [rbp - 0x38], rax
call fcn.140079c60
cmp r13, qword [rbp - 0x30]
jne 0x140178736
mov rax, qword [rbp - 0x38]
test eax, eax
je 0x1401788de
test r12b, 0x10
je 0x1401788de
lea r8, [rbp - 0x48]
mov edx, eax
mov rcx, r15
call fcn.14015e2a0
mov r14d, eax
test eax, eax
js 0x140178761
mov r15, qword [rbp - 0x48]
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rbx, rax
test rax, rax
je 0x140178788
mov r13, qword [rbp + 0x70]
test r13, r13
je 0x14017891b
test r12b, 0x40
jne 0x14017891b
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rsi, rax
test rax, rax
je 0x140178788
mov r15, qword [rbp + 0x48]
test r12b, 1
je 0x140178990
mov rdx, qword [rbp + 0x50]
mov r9, rbx
mov rcx, qword [r15 + 0x18]
mov r8, rdi
call fcn.14015f424
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178736
test r13, r13
je 0x14017897e
test r12b, 0x40
jne 0x14017897e
cmp dword [0x140440748], 1
mov r8d, eax
mov rdx, qword [rbp + 0x50]
mov r9, rsi
cmove r8, qword [0x14043ff00]
mov rcx, qword [r15 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x140178761
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x40]
call fcn.140076ce8
jmp 0x140178a6a
mov rax, qword [r15 + 0x18]
mov qword [rbp - 0x30], rax
mov rax, qword [rax]
mov r14, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
test r12b, 2
je 0x140178b21
mov rcx, r14
call rax
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rax, r14
mov rdx, rdi
call rax
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178736
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
test r12b, 0x20
je 0x140178b81
mov r8, rbx
call fcn.140179d30
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178736
test r13, r13
je 0x140178a36
test r12b, 0x40
jne 0x140178a36
cmp dword [0x140440748], 1
mov r8d, eax
mov rdx, qword [rbp - 0x40]
mov r9, rsi
cmove r8, qword [0x14043ff00]
mov rcx, qword [r15 + 0x18]
call fcn.14015f424
mov r14d, eax
test eax, eax
js 0x140178761
mov r15, qword [rbp + 0x50]
mov rax, qword [r15]
mov r14, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, r14
call rax
mov rdx, qword [rbp - 0x40]
mov rax, r14
xor r8d, r8d
mov rcx, r15
call rax
mov r14d, eax
test eax, eax
js 0x140178761
mov rdx, qword [rbp + 0x78]
test rdx, rdx
je 0x140178a7c
mov rcx, qword [rbp - 0x40]
call fcn.140076ce8
mov ecx, r14d
call fcn.140079c60
test rsi, rsi
je 0x140178a92
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test rbx, rbx
je 0x140178aa2
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140178ab0
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140178ad8
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079c60
xor r9d, r9d
mov qword [rbp - 0x28], 3
lea rax, [0x14001ab98]
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x40]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x140440748], 1
mov r15, rcx
mov rcx, r14
cmove r15, qword [0x14043fee8]
call rax
mov rcx, qword [rbp - 0x30]
lea r8, [rbp - 0x40]
mov rax, r14
mov rdx, r15
call rax
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140178736
cmp dword [0x140440748], 1
mov r8d, eax
mov r15, qword [rbp + 0x48]
mov r9, rdi
cmove r8, qword [0x14043fef0]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [r15 + 0x18]
call fcn.14015f424
jmp 0x1401789c8
cmp dword [0x140440748], 1
mov r8, rax
mov r9, rbx
cmove r8, qword [0x14043fef8]
call fcn.14015f424
jmp 0x1401789f0