Function at 0x1400017b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x14003a0c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x10], rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov r13d, 1
mov dword [rcx + 0x10], r13d
mov dword [rcx + 0x14], 0xffff
lea rcx, [0x14002e968]
mov qword [rbx + 0x18], rcx
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], 0x104
mov word [rbx + 0x40], ax
lea r15, [rbx + 0x48]
mov qword [r15], rcx
mov qword [r15 + 8], rax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x20], 0x104
mov word [r15 + 0x28], ax
mov qword [rbx + 0x78], rcx
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x88], rax
mov qword [rbx + 0x90], rax
mov qword [rbx + 0x98], 0x104
mov word [rbx + 0xa0], ax
mov qword [rbx + 0xa8], rcx
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xc8], 0x104
mov word [rbx + 0xd0], ax
mov qword [rbx + 0xd8], rcx
mov qword [rbx + 0xe0], rax
mov qword [rbx + 0xe8], rax
mov qword [rbx + 0xf0], rax
mov qword [rbx + 0xf8], 0x104
mov word [rbx + 0x100], ax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rbp + 0x20]
mov dword [rbx + 0x14], eax
mov dword [rbx + 0x10], r13d
xor r14b, r14b
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x140001930
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
movzx r14d, r13b
test rax, rax
je 0x140001960
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001952
lea r8, [rbx + 8]
lea rdx, [rbx + 4]
mov rcx, rbx
call rax
test r14b, r14b
je 0x140001960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rbx], 0
jbe 0x1400022cf
and dword [rbx + 8], 0xfffffff
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rax
xor r12d, r12d
mov r9d, r12d
mov eax, 0x100
cmp dword [rbx + 0x10], 1
cmove r9d, eax
xor r8d, r8d
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x68]
call fcn.140003ae0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
mov dword [rsp + 0x28], 0xffffffff
mov byte [rsp + 0x20], al
xor r9d, r9d
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x68]
call fcn.140004320
nop
cmp qword [rbp + 0x50], r12
je 0x1400022bb
cmp dword [rbx], 0xa
jne 0x14000201e
cmp dword [rbx + 8], 0x55f0
jb 0x14000201e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], r12
lea rdi, str.winbrand.dll
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], al
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140001a45
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x48], 1
test r14, r14
jne 0x140001a8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140001a76
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x48], 1
test r14, r14
setne al
test al, al
je 0x140001bca
test r14, r14
je 0x140001bca
lea rdx, str.BrandingFormatString
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001bca
lea rdx, str.BrandingFormatString
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001ac7
lea rcx, str._WINDOWS_LONG_
call rax
mov r12, rax
test r12, r12
je 0x140001bca
lea rax, [0x14002e968]
mov qword [rbp - 0x80], rax
xor ecx, ecx
mov esi, ecx
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], 0x104
mov word [rbp - 0x58], cx
mov rax, r12
mov edi, ecx
cmp word [r12], cx
je 0x140001b0f
lea rax, [rax + 2]
inc rdi
cmp word [rax], cx
jne 0x140001b03
mov r13, rcx
mov qword [rbp - 0x70], rcx
test rdi, rdi
je 0x140001b6d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.1400031f0
mov r13, rdi
mov qword [rbp - 0x70], rdi
mov rsi, qword [rbp - 0x78]
mov rcx, rsi
mov r8, r12
sub r8, rsi
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + r8]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140001b50
test rsi, rsi
je 0x140001b6d
xor eax, eax
mov word [rsi + rdi*2], ax
lea rax, [rbp - 0x80]
cmp r15, rax
je 0x140001ba4
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140001b84
call fcn.1400119f8
mov rax, qword [rbp - 0x68]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x10], r13
mov qword [r15 + 8], rsi
xor eax, eax
mov esi, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
lea rdi, [0x14002e968]
mov qword [rbp - 0x80], rdi
test rsi, rsi
je 0x140001bbc
mov rcx, rsi
call fcn.1400119f8
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor r12d, r12d
jmp 0x140001bd1
lea rdi, [0x14002e968]
cmp qword [r15 + 8], 0
je 0x140001be3
cmp qword [r15 + 0x10], 0
je 0x140001be3
xor al, al
jmp 0x140001be5
mov al, 1
test al, al
je 0x140001f50
mov qword [rbp - 0x50], rdi
mov rsi, r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 0x104
mov word [rbp - 0x28], r12w
lea r12, str.Windows_11
mov rax, r12
xor ecx, ecx
mov edi, ecx
nop dword [rax + rax]
lea rax, [rax + 2]
inc rdi
cmp word [rax], cx
jne 0x140001c20
mov r13, rcx
mov qword [rbp - 0x40], rcx
test rdi, rdi
je 0x140001c7d
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.1400031f0
mov r13, rdi
mov qword [rbp - 0x40], rdi
mov rsi, qword [rbp - 0x48]
mov rcx, rsi
sub r12, rsi
mov rdx, rdi
nop dword [rax + rax]
movzx eax, word [r12 + rcx]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140001c60
test rsi, rsi
je 0x140001c7d
xor eax, eax
mov word [rsi + rdi*2], ax
lea rax, [rbp - 0x50]
cmp r15, rax
je 0x140001cb8
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x140001c94
call fcn.1400119f8
mov rax, qword [rbp - 0x38]
mov qword [r15 + 0x18], rax
mov qword [r15 + 0x10], r13
mov qword [r15 + 8], rsi
xor r13d, r13d
mov esi, r13d
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
jmp 0x140001cbb
xor r13d, r13d
lea rax, [0x14002e968]
mov qword [rbp - 0x50], rax
test rsi, rsi
je 0x140001cd3
mov rcx, rsi
call fcn.1400119f8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
xor r9d, r9d
lea r8, str.EditionID
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.140004030
mov rcx, rax
lea rdx, [0x14002e968]
mov qword [rbp - 0x20], rdx
mov r12, r13
mov qword [rbp - 0x18], r13
mov rsi, r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r13
mov qword [rbp], 0x104
mov word [rbp + 8], r13w
mov rdi, r13
mov r15, r13
lea rax, [rbp - 0x20]
cmp rax, rcx
je 0x140001d67
mov qword [rbp - 8], r13
mov qword [rbp - 0x10], r13
mov rax, qword [rcx + 0x18]
mov qword [rbp - 8], rax
mov rsi, qword [rcx + 0x10]
mov qword [rbp - 0x10], rsi
mov r12, qword [rcx + 8]
mov qword [rbp - 0x18], r12
mov qword [rcx + 8], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], r13
mov rdi, r12
mov r15, rsi
mov qword [rbp + 0x20], rdx
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140001d80
call fcn.1400119f8
lea rdx, [0x14002e968]
test rdi, rdi
je 0x140001d8e
test r15, r15
je 0x140001d8e
xor al, al
jmp 0x140001d90
mov al, 1
test al, al
jne 0x140001f36
mov qword [rsp + 0x50], rdx
mov r15, r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0x104
mov word [rsp + 0x78], r13w
lea rax, [0x14002eafc]
mov rdi, r13
nop dword [rax + rax]
lea rax, [rax + 2]
inc rdi
cmp word [rax], 0
jne 0x140001dd0
mov qword [rsp + 0x60], r13
test rdi, rdi
je 0x140001e41
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400031f0
mov r13, rdi
mov qword [rsp + 0x60], rdi
mov r15, qword [rsp + 0x58]
mov rcx, r15
lea rbx, [0x14002eafc]
sub rbx, r15
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rcx]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x140001e20
test r15, r15
mov rbx, qword [rbp + 0x18]
je 0x140001e41
xor eax, eax
mov word [r15 + rdi*2], ax
test r12, r12
je 0x140001eb0
cmp word [r12], 0
je 0x140001eb0
test rsi, rsi
je 0x140001eb0
add r13, rsi
mov r8b, 1
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.1400031f0
mov r15, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
lea rcx, [r15 + rax*2]
test rcx, rcx
je 0x140001eab
movzx eax, word [r12]
test ax, ax
je 0x140001eab
mov rdx, r12
sub rdx, rcx
nop dword [rax]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rsi, 1
je 0x140001ea6
movzx eax, word [rcx + rdx]
test ax, ax
jne 0x140001e90
xor eax, eax
mov word [rcx], ax
mov qword [rsp + 0x60], r13
lea rsi, [0x14002e968]
mov qword [rbp + 0x20], rsi
xor ecx, ecx
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], 0x104
mov word [rbp + 0x48], cx
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x30], rcx
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x28], r15
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rcx
mov edi, 1
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x50], rsi
lea rcx, [rbx + 0x48]
mov r8, r13
mov rdx, r15
call fcn.1400030c0
mov eax, edi
and eax, 0xfffffffe
mov dword [rsp + 0x30], eax
mov qword [rbp + 0x20], rsi
test r15, r15
je 0x140001f3d
mov rcx, r15
call fcn.1400119f8
jmp 0x140001f3d
lea rsi, [0x14002e968]
mov qword [rbp - 0x20], rsi
test r12, r12
je 0x140001f57
mov rcx, r12
call fcn.1400119f8
jmp 0x140001f57
lea rsi, [0x14002e968]
cmp byte [rsp + 0x48], 0
je 0x140001f6c
test r14, r14
je 0x140001f6c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13d, 1
xor r12d, r12d
lea rax, str._64_bit
lea rdx, str._32_bit
cmp dword [rbx + 0x10], 0
cmovne rdx, rax
mov rax, rdx
mov r8, r12
cmp word [rdx], 0
je 0x140001fad
nop word [rax + rax]
lea rax, [rax + 2]
inc r8
cmp word [rax], 0
jne 0x140001fa0
lea rcx, [rbx + 0x48]
call fcn.1400030c0
lea rcx, [rbx + 0xd8]
mov r8d, dword [rbx + 8]
lea rdx, [0x14002e978]
call fcn.140003520
mov r8d, dword [rbx]
cmp r8d, 6
jbe 0x1400021b2
xor r9d, r9d
lea r8, str.ReleaseId
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.140004030
nop
mov rdx, qword [rax + 8]
mov r8d, r12d
mov ecx, r12d
test rdx, rdx
je 0x1400020ed
movzx eax, word [rdx]
cmp ax, 0x20
je 0x140002018
cmp ax, 9
jne 0x1400020a1
add rdx, 2
jmp 0x140002005
xor r9d, r9d
lea r8, [0x14002eb00]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.140004030
mov rsi, rax
lea rdi, [rbx + 0x48]
cmp rdi, rax
je 0x14000207f
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002053
call fcn.1400119f8
mov qword [rdi + 8], r12
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r12
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x18], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rsi, [0x14002e968]
mov qword [rbp + 0x20], rsi
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140001f75
call fcn.1400119f8
jmp 0x140001f75
cmp ax, 0x2d
jne 0x1400020b4
mov r13d, 0xffffffff
add rdx, 2
movzx eax, word [rdx]
cmp ax, 0x30
jb 0x1400020ed
nop word [rax + rax]
cmp ax, 0x39
ja 0x1400020e2
add rdx, 2
lea ecx, [rcx + rcx*4]
movzx eax, ax
lea ecx, [rcx - 0x18]
lea ecx, [rax + rcx*2]
inc r8d
movzx eax, word [rdx]
cmp ax, 0x30
jae 0x1400020c0
test r8d, r8d
je 0x1400020ed
imul ecx, r13d
jmp 0x1400020f0
mov ecx, r12d
mov dword [rbx + 0xc], ecx
mov qword [rbp + 0x20], rsi
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x140002105
call fcn.1400119f8
lea rcx, [rbx + 0xa8]
mov eax, dword [rbx + 8]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx]
mov r8d, dword [rbx + 0xc]
lea rdx, str._u_Bulid__u._u._u
call fcn.140003520
lea rcx, [rbx + 0x78]
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
mov r8d, dword [rbx]
lea rdx, str._u._u._u
call fcn.140003520
mov dword [rbp + 0x18], r12d
lea r8, [rbp + 0x18]
lea rdx, [0x14002eb90]
lea rcx, [rbp + 0x50]
call fcn.140003f90
test al, al
je 0x140002237
lea rcx, [rbx + 0xa8]
mov r8d, dword [rbp + 0x18]
lea rdx, [0x14002eb98]
call fcn.140003160
lea rcx, [rbx + 0x78]
mov r8d, dword [rbp + 0x18]
lea rdx, [0x14002eb98]
call fcn.140003160
lea rcx, [rbx + 0xd8]
mov r8d, dword [rbp + 0x18]
lea rdx, [0x14002eb98]
call fcn.140003160
jmp 0x140002237
lea rcx, [rbx + 0xa8]
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
lea rdx, str._u._u._u
call fcn.140003520
lea r14, [rbx + 0xa8]
lea rdi, [rbx + 0x78]
cmp rdi, r14
je 0x140002237
mov rsi, qword [r14 + 0x10]
mov r14, qword [r14 + 8]
mov qword [rdi + 0x10], r12
test r14, r14
je 0x140002225
test rsi, rsi
je 0x140002225
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1400031f0
mov qword [rdi + 0x10], rsi
mov rdx, r12
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
cmp rdx, rsi
jb 0x140002210
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140002237
mov rax, qword [rdi + 0x10]
mov word [rcx + rax*2], r12w
xor r9d, r9d
lea r8, str.EditionID
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x50]
call fcn.140004030
mov rsi, rax
lea rdi, [rbx + 0x18]
cmp rdi, rax
je 0x140002298
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000226c
call fcn.1400119f8
mov qword [rdi + 8], r12
mov qword [rdi + 0x18], r12
mov qword [rdi + 0x10], r12
mov rax, qword [rsi + 0x18]
mov qword [rdi + 0x18], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [0x14002e968]
mov qword [rbp + 0x20], rax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x1400022b1
call fcn.1400119f8
lea rcx, [rbp + 0x50]
call fcn.140003b60
nop
lea rcx, [rbp + 0x50]
call fcn.140003b10
nop
lea rcx, [rbp + 0x68]
call fcn.140003b10
nop
mov rax, rbx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140011e80
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret