Function at 0x14004b880
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x28], xmm6
call fcn.14004a260
mov rcx, rax
call fcn.14004a2f0
test eax, eax
je 0x14004bc75
mov dword [0x140140058], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140140060], rax
test rax, rax
je 0x14004bc75
call fcn.14004a260
mov rcx, rax
call fcn.14004a2f0
test eax, eax
je 0x14004bc8e
mov dword [0x140140058], eax
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140140060], rax
test rax, rax
je 0x14004bc8e
mov r8d, Ordinal_27
lea rdx, str.AWM_Y_LOCATION_ACTIVATING
lea rcx, [0x140140038]
call fcn.140056f40
movups xmm6, xmmword [0x140140158]
lea rax, [rbp - 0x39]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xor r14d, r14d
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r14
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bf0fc
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], Ordinal_27
mov qword [rbp - 0x21], Ordinal_33
movups xmm0, xmmword [str.AWM_Y_LOCATION_ACTIVATED]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400df7d8]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], r14b
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], 3
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1400df5c0]
mov word [rbp - 0x19], ax
movzx eax, byte [0x1400df5c2]
mov byte [rbp - 0x17], al
mov byte [rbp - 0x16], r14b
movdqa xmmword [rbp - 0x49], xmm6
lea r9, [rbp - 0x49]
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x19]
call fcn.140045410
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp + 0xf]
mov rdi, qword [rbp + 0x17]
mov ecx, 0x3e
call fcn.1400bf488
mov rbx, rax
mov dword [rax], Ordinal_33
mov dword [rax + 4], 0x660065
mov dword [rax + 8], 0x650066
mov dword [rax + 0xc], 0x740063
mov dword [rax + 0x10], 0x2f0073
mov dword [rax + 0x14], 0x660076
mov dword [rax + 0x18], 0x5f0078
mov dword [rax + 0x1c], 0x6e0069
mov dword [rax + 0x20], 0x670061
mov dword [rax + 0x24], 0x65006d
mov dword [rax + 0x28], 0x6c005f
mov dword [rax + 0x2c], 0x730061
mov dword [rax + 0x30], 0x720065
mov dword [rax + 0x34], 0x73005f
mov dword [rax + 0x38], 0x6f0068
mov word [rax + 0x3c], reloc.WS2_32.dll_WSASetLastError
mov ecx, 0x48
call fcn.1400bf488
mov dword [rax], reloc.WLDAP32.dll_Ordinal_32
mov dword [rax + 4], 0x6e0069
mov dword [rax + 8], 0x610067
mov dword [rax + 0xc], 0x65006d
mov dword [rax + 0x10], 0x70002f
mov dword [rax + 0x14], 0x630069
mov dword [rax + 0x18], 0x75006b
mov dword [rax + 0x1c], 0x2f0070
mov dword [rax + 0x20], 0x690070
mov dword [rax + 0x24], 0x6b0063
mov dword [rax + 0x28], 0x700075
mov dword [rax + 0x2c], 0x61005f
mov dword [rax + 0x30], 0x6d0077
mov dword [rax + 0x34], 0x67005f
mov dword [rax + 0x38], 0x6c006f
mov dword [rax + 0x3c], 0x670064
mov qword [rax + 0x40], 0x6e0075
mov qword [rsp + 0x20], rbx
mov r9, rax
mov r8, rdi
mov rdx, rsi
call fcn.14004d930
lea rcx, [0x140140038]
test al, al
je 0x14004bbbc
mov r8d, Ordinal_27
lea rdx, str.AWM_Y_LOCATION_ACTIVATED
call fcn.140056f40
movups xmm6, xmmword [0x140140158]
lea rax, [rbp - 0x19]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bf0fc
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], Ordinal_27
mov qword [rbp - 1], Ordinal_33
movups xmm0, xmmword [str.AWM_Y_LOCATION_ACTIVATED]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400df7d8]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], r14b
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1400df5c0]
mov word [rbp - 0x39], ax
movzx eax, byte [0x1400df5c2]
mov byte [rbp - 0x37], al
mov byte [rbp - 0x36], r14b
movdqa xmmword [rbp - 0x49], xmm6
lea r9, [rbp - 0x49]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
call fcn.140045410
mov edx, 0x258
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x14004bc8e
mov r8d, Ordinal_33
lea rdx, str.AWM_Y_LOCATION_NOT_ACTIVATED
call fcn.140056f40
movups xmm6, xmmword [0x140140158]
lea rax, [rbp - 0x19]
mov qword [rbp + 0x67], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bf0fc
mov qword [rbp - 0x19], rax
mov qword [rbp - 9], Ordinal_33
mov qword [rbp - 1], Ordinal_33
movups xmm0, xmmword [str.AWM_Y_LOCATION_NOT_ACTIVATED]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400df7f8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400df800]
mov dword [rax + 0x18], ecx
mov byte [rax + 0x1c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], 3
mov qword [rbp - 0x21], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1400df5c0]
mov word [rbp - 0x39], ax
movzx eax, byte [0x1400df5c2]
mov byte [rbp - 0x37], al
mov byte [rbp - 0x36], 0
movdqa xmmword [rbp - 0x49], xmm6
lea r9, [rbp - 0x49]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x39]
call fcn.140045410
jmp 0x14004bc8e
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.OPEN_32_BIT_EMULATOR___
lea rcx, [0x140140038]
call fcn.140056f40
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret