Function at 0x1401057c0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x1402b5020]
xor rax, rsp
mov qword [rbp + 0x570], rax
mov edi, ecx
mov r15, rdx
mov ecx, dword [rdx + 0x10]
sub ecx, 0x947
je 0x14010600d
nop dword [rax]
sub ecx, 1
je 0x140105856
cmp ecx, 1
jne 0x1401064d2
cmp dword [rdx + 0x20], 0x203
jne 0x1401064d2
mov ecx, dword ds:[rdx + 0x18]
cmp ecx, dword [rdx + 0x1c]
jae 0x1401064d2
call fcn.140107050
mov rbx, rax
test rax, rax
je 0x1401064d2
mov rcx, qword [0x1402c2948]
mov rdx, rax
call sym.SystemInformer.exe_PhShowProcessRecordDialog
mov rcx, rbx
call sym.SystemInformer.exe_PhDereferenceProcessRecord
jmp 0x1401064d2
mov r9d, dword ds:[rdx + 0x18]
cmp r9d, dword [rdx + 0x1c]
jae 0x1401064d2
cmp edi, 0xffffffff
jne 0x140105a59
cmp dword [0x1402c29b0], r9d
nop word [rax + rax]
je 0x140105a45
mov edx, dword [0x1402c498c]
lea rcx, str.___K:
mov eax, dword [0x1402c4984]
add edx, r9d
and rdx, rax
mov rax, qword [0x1402c4990]
movss xmm1, dword [rax + rdx*4]
mov edx, dword [0x1402c4a4c]
mov eax, dword [0x1402c4a44]
add edx, r9d
and rdx, rax
mov rax, qword [0x1402c4a50]
cvtps2pd xmm2, xmm1
movss xmm0, dword [rax + rdx*4]
movzx eax, word [0x1402bcf88]
movaps xmm1, xmm2
cvtps2pd xmm3, xmm0
mov qword [rbp + 0x198], rcx
lea rcx, str.___U:
mov word [rbp + 0x164], ax
mov word [rbp + 0x1a4], ax
mov word [rbp + 0x1e4], ax
lea rax, [0x140268234]
mov qword [rbp + 0x1d8], rcx
mov ecx, r9d
movsd xmm0, qword [0x140288b20]
addsd xmm1, xmm3
mulsd xmm2, xmm0
mov dword [rbp + 0x160], 0x4b
mulsd xmm3, xmm0
mov dword [rbp + 0x180], 1
mov qword [rbp + 0x190], 0xc
mulsd xmm1, xmm0
mov dword [rbp + 0x1a0], 0x4b
movsd qword [rbp + 0x1b0], xmm2
movsd qword [rbp + 0x1f0], xmm3
mov dword [rbp + 0x1c0], 1
movsd qword [rbp + 0x170], xmm1
mov qword [rbp + 0x1d0], 0xc
mov dword [rbp + 0x1e0], 0x4b
mov dword [rbp + 0x200], 1
mov qword [rbp + 0x210], 4
mov qword [rbp + 0x218], rax
call fcn.1401070e0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, dword ds:[r15 + 0x18]
xor r14d, r14d
xor ecx, ecx
movups xmm0, xmmword [rax]
mov eax, 0xa
mov dword [rbp + 0x220], 1
mov dword [rbp + 0x240], r14d
movaps xmmword [rbp + 0x230], xmm0
mov word [rbp + 0x250], ax
call sym.SystemInformer.exe_PhGetStatisticsTimeString
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
lea edx, [r14 + 9]
mov r8d, 0xa0
lea rcx, [rbp + 0x160]
movups xmm0, xmmword [rax]
mov dword [rbp + 0x260], 1
movaps xmmword [rbp + 0x270], xmm0
call sym.SystemInformer.exe_PhFormat
mov rcx, qword [0x1402c29a8]
mov qword [0x1402c29a8], rax
test rcx, rcx
je 0x140105a45
add rcx, 0xfffffffffffffff0
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140105a45
nop dword [rax]
call fcn.14013d2a0
mov rax, qword [0x1402c29a8]
movups xmm0, xmmword [rax]
movups xmmword [r15 + 0x20], xmm0
jmp 0x1401064d2
mov rax, qword [0x1402c2828]
mov rbx, rdi
mov qword [rsp + 0x6a0], r13
lea r13, [rdi + rdi*2]
add r13, r13
cmp dword [rax + r13*8 + 0x28], r9d
je 0x140105fec
mov rdx, qword [0x1402c4c70]
lea r8, [rdi + rdi*2]
mov qword [rsp + 0x6f0], r12
mov ecx, dword [rdx + r8*8 + 0xc]
mov eax, dword [rdx + r8*8 + 4]
add ecx, r9d
and rcx, rax
mov rax, qword [rdx + r8*8 + 0x10]
mov rdx, qword [0x1402c4cd8]
movss xmm1, dword [rax + rcx*4]
mov ecx, dword [rdx + r8*8 + 0xc]
mov eax, dword [rdx + r8*8 + 4]
add ecx, r9d
and rcx, rax
mov rax, qword [rdx + r8*8 + 0x10]
cvtps2pd xmm2, xmm1
movss xmm0, dword [rax + rcx*4]
lea rcx, str.___K:
movzx eax, word [0x1402bcf88]
movaps xmm1, xmm2
cvtps2pd xmm3, xmm0
mov qword [rsp + 0x78], rcx
lea rcx, str.___U:
mov word [rsp + 0x44], ax
mov word [rbp - 0x7c], ax
mov word [rbp - 0x3c], ax
lea rax, [0x140268234]
mov qword [rbp - 0x48], rcx
mov ecx, r9d
movsd xmm0, qword [0x140288b20]
addsd xmm1, xmm3
mulsd xmm2, xmm0
mov dword [rsp + 0x40], 0x4b
mulsd xmm3, xmm0
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x70], 0xc
mulsd xmm1, xmm0
mov dword [rbp - 0x80], 0x4b
movsd qword [rbp - 0x70], xmm2
movsd qword [rbp - 0x30], xmm3
mov dword [rbp - 0x60], 1
movsd qword [rsp + 0x50], xmm1
mov qword [rbp - 0x50], 0xc
mov dword [rbp - 0x40], 0x4b
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x10], 4
mov qword [rbp - 8], rax
call fcn.1401070e0
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
cmp byte [0x1402bfd18], 0
movups xmm0, xmmword [rax]
mov eax, 0xa
mov dword [rbp], 1
mov qword [rbp + 0x30], rax
lea rax, str._nCPU
mov qword [rbp + 0x38], rax
movaps xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], 1
je 0x140105c30
lea rax, str.__Core
mov dword [rbp + 0x40], 8
mov edx, edi
mov qword [rbp + 0x78], rax
xor ecx, ecx
mov dword [rbp + 0x50], edi
mov dword [rbp + 0x60], 1
mov qword [rbp + 0x70], 0xe
call fcn.140107820
mov dword [rbp + 0x90], eax
mov edx, edi
lea rax, str.__Socket
mov dword [rbp + 0x80], 8
mov ecx, 3
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xa0], 1
mov qword [rbp + 0xb0], 0x12
call fcn.140107820
mov dword [rbp + 0xd0], eax
jmp 0x140105d41
movzx r9d, word [0x1402bfd1c]
xor r14d, r14d
movzx r8d, r14w
movzx ebx, r14w
cmp r14w, r9w
jae 0x140105cd9
mov r10, qword [0x1402bfd20]
mov r11d, 0xffff
nop word [rax + rax]
test r10, r10
je 0x140105c9f
movzx ecx, r14w
cmp bx, r11w
jne 0x140105c8f
mov rax, r10
mov rdx, r9
nop word [rax + rax]
add cx, word [rax]
lea rax, [rax + 2]
sub rdx, 1
jne 0x140105c80
jmp 0x140105ca6
cmp bx, r9w
jae 0x140105ca6
movzx eax, bx
movzx ecx, word [r10 + rax*2]
jmp 0x140105ca6
movzx ecx, word [0x1402bfd1a]
movzx edx, r14w
cmp r14w, cx
jae 0x140105cd0
movzx eax, r8w
inc r8w
cmp eax, edi
je 0x140105dac
inc dx
cmp dx, cx
jb 0x140105cb0
inc bx
cmp bx, r9w
jb 0x140105c60
lea rax, str.__Group
mov dword [rbp + 0x40], 8
mov qword [rbp + 0x78], rax
mov dword [rbp + 0x50], edi
mov dword [rbp + 0x60], 1
mov qword [rbp + 0x70], 0x10
mov dword [rbp + 0x80], 8
mov dword [rbp + 0x90], 0xffffffff
mov dword [rbp + 0xd0], 0xffffffff
lea rax, str.__Node
mov qword [rbp + 0xb8], rax
mov dword [rbp + 0xa0], 1
mov rbx, rdi
mov qword [rbp + 0xb0], 0xe
cmp dword [0x1402b5e88], 0x64
mov r12, qword ss:[rsp + 0x6f0]
mov dword [rbp + 0xc0], 8
jb 0x140105f62
cmp word [0x1402bfd1a], 0x40
jae 0x140105f62
test byte [0x1402bb3e8], 1
nop dword [rax + rax]
jne 0x140105e87
lock bts qword [0x1402bb3e8], 0x1f
jb 0x140105e70
call fcn.1401078c0
lea rcx, [0x1402bb3e8]
call sym.SystemInformer.exe_PhfSetEvent
jmp 0x140105e87
movzx r12d, dx
lea rax, str.__Group
mov qword [rbp + 0x78], rax
movzx esi, r14w
movzx eax, bx
mov dword [rbp + 0x90], eax
mov dword [rbp + 0x40], 8
mov dword [rbp + 0x50], r12d
mov dword [rbp + 0x60], 1
mov qword [rbp + 0x70], 0x10
mov dword [rbp + 0x80], 8
cmp bx, 0x14
jae 0x140105e48
cmp dx, 0x40
jae 0x140105e48
xor r9d, r9d
lea rdx, [rbp + 0x160]
mov r8d, 0x408
lea ecx, [r9 + 0x37]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x140105e48
mov edx, dword [rbp + 0x160]
nop dword [rax]
movzx eax, si
add rax, rax
cmp word [rbp + rax*8 + 0x170], bx
jne 0x140105e3e
mov rax, qword [rbp + rax*8 + 0x168]
bt rax, r12
jb 0x140105e54
inc si
movzx eax, si
cmp eax, edx
jbe 0x140105e20
mov dword [rbp + 0xd0], r14d
jmp 0x140105d1b
lea rax, str.__Node
mov qword [rbp + 0xb8], rax
movzx eax, si
mov dword [rbp + 0xd0], eax
jmp 0x140105d29
test byte [0x1402bb3e8], 1
jne 0x140105e87
xor edx, edx
lea rcx, [0x1402bb3e8]
call sym.SystemInformer.exe_PhfWaitForEvent
mov rax, qword [0x1402c2888]
test rax, rax
je 0x140105f62
cmp edi, dword [rax]
ja 0x140105f62
mov rax, qword [rax + 8]
mov ecx, dword [rax + rbx*8]
cmp ecx, 0x20
je 0x140105ec4
cmp ecx, 0x40
jne 0x140105f62
mov rax, qword [0x1402bb3b8]
lea rcx, str.P_Core
jmp 0x140105ed2
mov rax, qword [0x1402bb3c8]
lea rcx, str.E_Core
mov qword [rbp + 0x110], rax
lea rdx, [0x140236e40]
mov rax, qword [rcx]
xor ecx, ecx
mov qword [rbp + 0x118], rax
lea rax, [0x1402349d0]
mov qword [rbp + 0xf8], rdx
mov edx, dword [r15 + 0x18]
mov qword [rbp + 0x138], rax
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 4
mov dword [rbp + 0x100], 1
mov dword [rbp + 0x120], 1
mov qword [rbp + 0x130], 2
call sym.SystemInformer.exe_PhGetStatisticsTimeString
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, 0x11
movups xmm0, xmmword [rax]
mov dword [rbp + 0x140], 1
movaps xmmword [rbp + 0x150], xmm0
jmp 0x140105fb1
mov edx, dword [r15 + 0x18]
lea rax, [0x1402349d0]
xor ecx, ecx
mov qword [rbp + 0xf8], rax
mov dword [rbp + 0xe0], 1
mov qword [rbp + 0xf0], 2
call sym.SystemInformer.exe_PhGetStatisticsTimeString
mov rcx, rax
call sym.SystemInformer.exe_PhAutoDereferenceObject
mov edx, 0xf
movups xmm0, xmmword [rax]
mov dword [rbp + 0x100], 1
movaps xmmword [rbp + 0x110], xmm0
xor r8d, r8d
lea rcx, [rsp + 0x40]
call sym.SystemInformer.exe_PhFormat
mov rcx, qword [0x1402c2828]
mov rdx, qword [rcx + r13*8 + 0x20]
mov qword [rcx + r13*8 + 0x20], rax
test rdx, rdx
je 0x140105fec
lea rcx, [rdx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140105fec
call fcn.14013d2a0
mov rax, qword [0x1402c2828]
mov rcx, qword [rax + r13*8 + 0x20]
mov r13, qword [rsp + 0x6a0]
movups xmm0, xmmword [rcx]
movups xmmword [r15 + 0x20], xmm0
jmp 0x1401064d2
mov rbx, qword [rdx + 0x18]
mov eax, 0x13
cmp byte [0x1402c48c4], 0
mov ecx, 0x1013
mov r8d, dword [0x1402c4820]
mov edx, dword [0x1402c482c]
cmovne eax, ecx
mov dword [rbx + 8], eax
mov rcx, rbx
mov rax, qword [0x1402c2918]
movaps xmmword [rsp + 0x690], xmm6
movaps xmmword [rsp + 0x680], xmm7
mov r9, qword [rax + 0x78]
mov r9d, dword [r9 + 0x54]
call sym.SystemInformer.exe_PhSiSetColorsGraphDrawInfo
mov r8d, dword [0x1402c4988]
mov rdx, qword [r15 + 0x18]
cmp edi, 0xffffffff
jne 0x1401061ab
lea rcx, [0x1402c2988]
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
cmp byte [0x1402c299c], 0
jne 0x1401064c2
mov r8d, dword ds:[rbx + 0x14]
lea rcx, [0x1402c4980]
mov rdx, qword [0x1402c2988]
call sym.SystemInformer.exe_PhCopyCircularBuffer_FLOAT
mov r8d, dword [rbx + 0x14]
lea rcx, [0x1402c4a40]
mov rdx, qword [0x1402c2990]
call sym.SystemInformer.exe_PhCopyCircularBuffer_FLOAT
cmp byte [0x1402c48e4], 0
je 0x14010617a
cmp byte [0x1402c48ec], 0
xorps xmm7, xmm7
xorps xmm6, xmm6
je 0x14010610a
mov eax, dword ds:[rbx + 0x14]
cmp eax, 0x80
jbe 0x14010610a
mov rdi, qword [0x1402c2988]
mov r8d, eax
mov rdx, qword [0x1402c2990]
mov rcx, rdi
call sym.SystemInformer.exe_PhAddPlusMaxMemorySingles
movaps xmm6, xmm0
jmp 0x14010614b
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x140106182
mov rdi, qword [0x1402c2988]
mov edx, ecx
mov r8, qword [0x1402c2990]
mov rax, rdi
sub r8, rdi
nop dword [rax + rax]
movss xmm0, dword [rax + r8]
addss xmm0, dword [rax]
add rax, 4
maxss xmm0, xmm6
movaps xmm6, xmm0
sub rdx, 1
jne 0x140106130
ucomiss xmm6, xmm7
jp 0x140106152
je 0x140106182
mov r8d, dword ds:[rbx + 0x14]
movaps xmm1, xmm6
mov rcx, rdi
call sym.SystemInformer.exe_PhDivideSinglesBySingle
mov r8d, dword [rbx + 0x14]
movaps xmm1, xmm6
mov rcx, qword [0x1402c2990]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
jmp 0x140106182
movss xmm6, dword [0x140288ae4]
mov edx, 0x50
lea rax, [sym.SystemInformer.exe_PhSiDoubleLabelYFunction]
mov ecx, 0x58
mov r8, rbx
mov qword [rbx + rdx], rax
movss dword [rcx + rbx], xmm6
mov byte [0x1402c299c], 1
jmp 0x1401064c2
mov rcx, qword [0x1402c2828]
mov r14, rdi
lea rdi, [rdi + rdi*2]
shl rdi, 4
add rcx, rdi
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
mov rdx, qword [0x1402c2828]
lea rsi, [r14 + r14*2]
shl rsi, 3
cmp byte [rdi + rdx + 0x14], 0
jne 0x140106307
mov rcx, qword [0x1402c4c70]
mov r8d, dword [rbx + 0x14]
add rcx, rsi
mov rdx, qword [rdi + rdx]
call sym.SystemInformer.exe_PhCopyCircularBuffer_FLOAT
mov rdx, qword [0x1402c2828]
mov rcx, qword [0x1402c4cd8]
mov r8d, dword [rbx + 0x14]
add rcx, rsi
mov rdx, qword [rdi + rdx + 8]
call sym.SystemInformer.exe_PhCopyCircularBuffer_FLOAT
cmp byte [0x1402c48e4], 0
nop dword [rax]
je 0x1401062d3
cmp byte [0x1402c48ec], 0
xorps xmm7, xmm7
xorps xmm6, xmm6
je 0x14010625c
mov eax, dword [rbx + 0x14]
cmp eax, 0x80
jbe 0x14010625c
mov rcx, qword [0x1402c2828]
mov r8d, eax
mov rdx, qword [rdi + rcx + 8]
mov rcx, qword [rdi + rcx]
call sym.SystemInformer.exe_PhAddPlusMaxMemorySingles
movaps xmm6, xmm0
jmp 0x14010629a
mov r8d, dword [rbx + 0x14]
test r8d, r8d
je 0x1401062db
mov rax, qword [0x1402c2828]
mov rcx, qword [rdi + rax]
mov rdx, qword [rdi + rax + 8]
mov eax, r8d
sub rdx, rcx
nop dword [rax + rax]
movss xmm0, dword [rdx + rcx]
addss xmm0, dword [rcx]
add rcx, 4
maxss xmm0, xmm6
movaps xmm6, xmm0
sub rax, 1
jne 0x140106280
ucomiss xmm6, xmm7
jp 0x1401062a2
nop
je 0x1401062db
mov rcx, qword [0x1402c2828]
movaps xmm1, xmm6
mov r8d, dword [rbx + 0x14]
mov rcx, qword [rdi + rcx]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
mov rcx, qword [0x1402c2828]
movaps xmm1, xmm6
mov r8d, dword [rbx + 0x14]
mov rcx, qword [rdi + rcx + 8]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
jmp 0x1401062db
movss xmm6, dword [0x140288ae4]
lea rax, [sym.SystemInformer.exe_PhSiDoubleLabelYFunction]
mov edx, 0x50
mov ecx, 0x58
mov r9, rbx
mov r8, rbx
mov qword [rbx + rdx], rax
movss dword [rcx + rbx], xmm6
mov rax, qword [0x1402c2828]
mov byte [rdi + rax + 0x14], 1
cmp dword [0x1402c48c8], 0
je 0x1401064bb
mov rdx, qword [0x1402c4c70]
mov eax, dword [rsi + rdx + 4]
mov ecx, dword [rsi + rdx + 0xc]
and rcx, rax
mov rax, qword [rsi + rdx + 0x10]
mov rdx, qword [0x1402c4cd8]
movss xmm1, dword [rax + rcx*4]
mov eax, dword [rsi + rdx + 4]
mov ecx, dword [rsi + rdx + 0xc]
and rcx, rax
mov rax, qword [rsi + rdx + 0x10]
cvtps2pd xmm2, xmm1
mov edx, 6
lea r8d, [rdx + 0x3a]
movss xmm0, dword [rax + rcx*4]
lea rcx, str.___K:
movzx eax, word [0x1402bcf88]
movaps xmm1, xmm2
cvtps2pd xmm3, xmm0
mov qword [rbp + 0x198], rcx
lea rcx, str.___U:
mov word [rbp + 0x164], ax
mov word [rbp + 0x1a4], ax
mov word [rbp + 0x1e4], ax
lea rax, [0x140268234]
mov qword [rbp + 0x1d8], rcx
lea rcx, [rbp + 0x160]
movsd xmm0, qword [0x140288b20]
addsd xmm1, xmm3
mulsd xmm2, xmm0
mov dword [rbp + 0x160], 0x4b
mulsd xmm3, xmm0
mov dword [rbp + 0x180], 1
mov qword [rbp + 0x190], 0xc
mulsd xmm1, xmm0
mov dword [rbp + 0x1a0], 0x4b
movsd qword [rbp + 0x1b0], xmm2
movsd qword [rbp + 0x1f0], xmm3
mov dword [rbp + 0x1c0], 1
movsd qword [rbp + 0x170], xmm1
mov qword [rbp + 0x1d0], 0xc
mov dword [rbp + 0x1e0], 0x4b
mov dword [rbp + 0x200], 1
mov qword [rbp + 0x210], 4
mov qword [rbp + 0x218], rax
call sym.SystemInformer.exe_PhFormat
mov rcx, qword [0x1402c2828]
mov rdx, qword [rdi + rcx + 0x18]
mov qword [rdi + rcx + 0x18], rax
test rdx, rdx
je 0x14010646b
lea rcx, [rdx - 0x10]
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010646b
call fcn.14013d2a0
mov rcx, qword [0x1402c2878]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x919
mov rcx, qword [rcx + r14*8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [0x1402c2828]
lea rcx, [0x1402b6228]
mov dword [rsp + 0x28], 5
lea r9, [0x1402b6238]
mov qword [rsp + 0x20], rcx
mov rdx, rbx
mov rcx, rax
mov r8, qword [rdi + r8 + 0x18]
call sym.SystemInformer.exe_PhSetGraphText
jmp 0x1401064c2
xor r14d, r14d
mov qword [rbx + 0x78], r14
movaps xmm6, xmmword [rsp + 0x690]
movaps xmm7, xmmword [rsp + 0x680]
mov rcx, qword ds:[rbp + 0x570]
xor rcx, rsp
call fcn.1401dd6a0
add rsp, 0x6a8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret