Function at 0x14018171c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0xf], rax
and qword [rbp - 0x49], 0
xor edi, edi
xor ebx, ebx
mov qword [rbp - 0x41], r9
and qword [rbp - 0x61], rbx
mov rsi, r8
and dword [rbp - 9], ebx
mov r12, rdx
lea eax, [rdi + 3]
mov qword [rbp - 0x21], rdx
mov dword [rbp + 3], eax
lea r8d, [rdi + 0x30]
mov qword [rbp - 0x39], rax
lea rdx, [rbp - 0x39]
lea rax, [0x14001731c]
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x31], rax
mov r13, rcx
lea rax, [rbp - 0x59]
mov qword [rbp - 0x69], rbx
mov qword [rbp - 0x29], rax
xor r9d, r9d
lea rax, [rbp - 0x49]
mov dword [rbp - 5], 1
mov qword [rbp - 0x19], rax
mov ecx, 0xb9
lea rax, [rbp - 0x55]
mov dword [rbp - 1], 2
mov qword [rbp - 0x11], rax
mov dword [rbp + 7], 4
call sub.ntdll.dll_NtQuerySystemInformation
mov r15d, dword [rbp - 0x59]
test r15d, r15d
jns 0x1401817d9
mov ecx, r15d
call fcn.14007ac40
jmp 0x1401818d7
mov edx, dword [rbp - 0x55]
lea r8, [rbp - 0x51]
mov rcx, qword [rbp - 0x49]
call fcn.14007a7c4
mov r15d, eax
test eax, eax
jns 0x140181800
mov ecx, eax
call fcn.14007ac40
mov rdi, qword [rbp - 0x51]
jmp 0x1401818d7
mov rdi, qword [rbp - 0x51]
lea r9, [rbp - 0x69]
mov r8, rdi
mov rdx, rsi
mov rcx, r13
call fcn.140182808
mov r15d, eax
test eax, eax
js 0x1401818cc
mov r14, qword [r13 + 0x18]
xor esi, esi
cmp dword [0x14045de88], 1
cmove rsi, qword [0x14045d500]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403d25b8]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x61]
mov rdx, rsi
mov rcx, r14
call rax
mov r15d, eax
test eax, eax
js 0x1401818cc
mov r14, qword [rbp - 0x41]
lea rsi, [rbp - 9]
xor ebx, ebx
mov r9, qword [rbp - 0x61]
mov rdx, r12
mov r8d, dword [rsi]
mov rcx, r13
mov qword [rsp + 0x20], r14
call fcn.140182c50
mov r15d, eax
test eax, eax
js 0x1401818cc
inc ebx
add rsi, 4
cmp ebx, 5
jb 0x14018186c
mov rbx, qword [rbp - 0x69]
mov rax, qword [rbx]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x61]
mov rax, rsi
xor r8d, r8d
mov rcx, rbx
call rax
mov r15d, eax
test eax, eax
jns 0x1401818d7
mov ecx, eax
jmp 0x1401817cf
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rbp - 0x69]
mov ecx, r15d
call fcn.14007ace8
mov rsi, qword [rbp - 0x61]
test rsi, rsi
je 0x140181908
mov rax, qword [rsi]
mov r14, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, r14
call rax
mov rax, r14
mov rcx, rsi
call rax
and qword [rbp - 0x61], 0
test rbx, rbx
je 0x140181928
mov rax, qword [rbx]
mov rsi, qword [rax + 0x10]
mov rax, qword [0x1403d25b8]
mov rcx, rsi
call rax
mov rax, rsi
mov rcx, rbx
call rax
test rdi, rdi
je 0x140181949
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
mov rbx, qword [rbp - 0x49]
test rbx, rbx
je 0x140181966
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r15d
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140388a50
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret