Function at 0x1402243e4
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
push rdi
push r12
push r15
sub rsp, 0x800
mov qword [r11 - 0x710], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x7f8], rax
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor ebx, ebx
mov dword [rsp + 0x60], ebx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x158], xmm0
mov word [rsp + 0x148], bx
lea rdx, [0x1402d0d28]
lea rcx, [r11 - 0x6d0]
call fcn.14000b3a4
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x1b8], xmm0
mov word [rsp + 0x1a8], bx
lea rdx, str.SOFTWAREMicrosoftOfficeCommon
lea rcx, [rsp + 0x1a8]
call fcn.14000b3a4
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x198], xmm0
mov word [rsp + 0x188], bx
lea rdx, str.SOFTWAREWow6432NodeMicrosoftOfficeCommon
lea rcx, [rsp + 0x188]
call fcn.14000b3a4
mov byte [rsp + 0x40], bl
call fcn.14014b5bc
cmp eax, 0x3000
setae sil
mov byte [rsp + 0x40], sil
jmp 0x1402244df
lea r15, vtable.RefCounted.0
mov qword [rsp + 0x1f0], r15
mov dword [rsp + 0x1f8], ebx
lea r12, vtable.ORegistryKey.0
mov qword [rsp + 0x1f0], r12
movdqa xmm0, xmmword [0x140333fe0]
movdqa xmmword [rsp + 0x210], xmm0
mov word [rsp + 0x200], bx
mov qword [rsp + 0x220], rbx
mov byte [rsp + 0x228], 1
mov dword [rsp + 0x22c], 0x85
lea r8, [rsp + 0x1a8]
lea rdx, [rsp + 0x1f0]
lea rcx, [0x1403d9060]
test sil, sil
je 0x140224563
mov dword [rsp + 0x20], 1
call fcn.140149478
jmp 0x14022457a
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], 1
xor r9d, r9d
call fcn.14007ef1c
movzx eax, al
test eax, eax
je 0x140224787
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x1f0]
call fcn.14014a710
test al, al
je 0x1402245b0
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x48]
jne 0x140224787
mov qword [rsp + 0x2e0], r15
mov dword [rsp + 0x2e8], ebx
mov qword [rsp + 0x2e0], r12
movdqa xmm0, xmmword [0x140333fe0]
movdqa xmmword [rsp + 0x300], xmm0
mov word [rsp + 0x2f0], bx
mov qword [rsp + 0x310], rbx
mov byte [rsp + 0x318], 1
mov dword [rsp + 0x31c], 0x85
mov r15d, 0x30
mov r8d, r15d
xor edx, edx
lea rcx, [rsp + 0x118]
call fcn.140238d40
lea rcx, [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsp + 0x118], bx
je 0x14022468b
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0x2e0]
lea rcx, [0x1403d9060]
test sil, sil
je 0x140224656
mov dword [rsp + 0x20], 1
call fcn.140149478
jmp 0x14022466d
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], 1
xor r9d, r9d
call fcn.14007ef1c
movzx eax, al
test eax, eax
je 0x14022468b
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x2e0]
call fcn.14014a710
test sil, sil
je 0x140224778
mov rax, qword [rsp + 0x50]
cmp rax, qword [rsp + 0x48]
jne 0x14022475d
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x140224a40
movaps xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x2b0], xmm0
mov qword [rsp + 0xb0], rbx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb8], xmm1
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0xb0]
call fcn.1400682ac
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x48]
call fcn.1400f30a0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14022475d
mov rax, qword [rsp + 0xc0]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x140224758
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140224a4d
call fcn.140261814
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x1f0]
call fcn.14014a5dc
nop
lea rcx, [rsp + 0x2e0]
call fcn.14000ad98
jmp 0x14022478d
mov r15d, 0x30
lea rcx, [rsp + 0x1f0]
call fcn.14000ad98
jmp 0x1402247ab
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 7
mov word [rdi], bx
mov dword [rsp + 0x60], 2
mov rax, qword [rsp + 0x50]
sub rax, qword [rsp + 0x48]
lea rdx, [rax + rax]
cmp rdx, qword [rdi + 0x10]
ja 0x1402247ed
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x1402247e3
mov rax, qword [rdi]
mov qword [rdi + 0x10], rdx
mov word [rax + rdx*2], bx
jmp 0x1402247fb
xor r8d, r8d
sub rdx, rbx
mov rcx, rdi
call fcn.14000b13c
mov esi, ebx
mov rcx, qword [rsp + 0x48]
cmp qword [rsp + 0x50], rcx
je 0x1402248bf
mov rdx, rbx
movzx ecx, byte [rdx + rcx]
mov r9d, 0x10
lea r8d, [r9 - 0xd]
lea rdx, [rsp + 0x7f0]
call fcn.140261fb0
test eax, eax
jne 0x140224a61
cmp word [rsp + 0x7f2], bx
jne 0x14022486a
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14022484a
mov rcx, qword [rdi]
lea r8d, [rsi + rsi]
mov word [rcx + r8*2], r15w
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140224860
mov rdx, qword [rdi]
movzx eax, word [rsp + 0x7f0]
jmp 0x14022489d
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140224877
mov rdx, qword [rdi]
lea r8d, [rsi + rsi]
movzx eax, word [rsp + 0x7f0]
mov word [rdx + r8*2], ax
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140224895
mov rdx, qword [rdi]
movzx eax, word [rsp + 0x7f2]
lea ecx, [r8 + 1]
mov word [rdx + rcx*2], ax
inc esi
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
sub rax, rcx
mov edx, esi
cmp rdx, rax
jb 0x140224810
mov rax, qword [rsp + 0x1a0]
cmp rax, 8
jb 0x140224907
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x188]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1402248fd
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140224a57
call fcn.140261814
mov rcx, qword [rsp + 0x48]
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x198], xmm0
mov word [rsp + 0x188], bx
mov rax, qword [rsp + 0x1c0]
cmp rax, 8
jb 0x140224968
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x1a8]
mov rdx, rcx
cmp rax, 0x1000
jb 0x14022495e
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140224a93
call fcn.140261814
mov rcx, qword [rsp + 0x48]
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x1b8], xmm0
mov word [rsp + 0x1a8], bx
mov rax, qword [rsp + 0x160]
cmp rax, 8
jb 0x1402249c9
lea rax, [rax*2 + 2]
mov rcx, qword [rsp + 0x148]
mov rdx, rcx
cmp rax, 0x1000
jb 0x1402249bf
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140224a9d
call fcn.140261814
mov rcx, qword [rsp + 0x48]
movdqa xmm0, xmmword [0x140333fe0]
movdqu xmmword [rsp + 0x158], xmm0
mov word [rsp + 0x148], bx
test rcx, rcx
je 0x140224a14
mov rdx, rcx
mov rax, qword [rsp + 0x58]
sub rax, rcx
cmp rax, 0x1000
jb 0x140224a0f
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x140224aa7
call fcn.140261814
mov rax, rdi
mov rcx, qword [rsp + 0x7f8]
xor rcx, rsp
call fcn.1402361b0
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
xor edx, edx
mov ecx, 0x245759c
call fcn.140025d34
int3
call fcn.140261a5c
nop
jmp 0x140224a56
nop
call fcn.140261a5c
nop
jmp 0x140224a60
nop
lea r8, str.Failed_to_convert_the_blob_to_hex_string__empty_blob_passed
mov edx, 0x1d
lea rcx, [rsp + 0x460]
call fcn.14014c4b0
lea rdx, [0x14033b8e8]
lea rcx, [rsp + 0x460]
call fcn.1402395b8
nop
jmp 0x140224a92
nop
call fcn.140261a5c
nop
jmp 0x140224a9c
nop
call fcn.140261a5c
nop
jmp 0x140224aa6
nop
call fcn.140261a5c
int3