Function at 0x180026440
Capabilities:
Get system information on windows

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x1a8
mov qword [rsp + 0x40], 0
mov r8d, dword [rsp + 0x1b0]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18002647b
jmp 0x180026929
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
movzx r11d, word [rsp + 0x48]
cmp r11d, 9
jne 0x1800264b3
mov dword [rsp + 0x190], reloc.WLDAP32.dll_Ordinal_32
jmp 0x1800264be
mov dword [rsp + 0x190], reloc.WS2_32.dll_recv
mov eax, dword [rsp + 0x190]
mov dword [rsp + 0xa0], eax
movzx eax, word [rsp + 0x48]
cmp eax, 9
jne 0x1800264e3
mov dword [rsp + 0x194], reloc.WS2_32.dll_WSASetLastError
jmp 0x1800264ee
mov dword [rsp + 0x194], 0x40
mov eax, dword [rsp + 0x194]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0xa0]
add eax, 8
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x98]
add eax, 0x10
mov dword [rsp + 0x9c], eax
mov ecx, dword [rsp + 0x88]
call fcn.18003c750
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x80], rax
mov ecx, dword [rsp + 0x9c]
call fcn.18003c750
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x80], 0
jne 0x180026576
jmp 0x180026929
cmp qword [rsp + 0x90], 0
jne 0x180026586
jmp 0x180026929
mov r8d, dword [rsp + 0x9c]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call fcn.18003bb80
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov rcx, qword [rsp + 0x80]
call fcn.18003bb80
cmp dword [rsp + 0x38], 0
je 0x180026780
mov r8d, 0x58
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.18003bb80
lea rcx, [0x1800a0c10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtWow64QueryInformationProcess64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x110], rax
cmp qword [rsp + 0x110], 0
jne 0x180026609
jmp 0x180026929
mov qword [rsp + 0x20], 0
mov r9d, 0x58
lea r8, [rsp + 0xb0]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [rsp + VarUI4FromDisp]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x18002663e
jmp 0x180026929
lea rcx, [0x1800a0c40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtWow64ReadVirtualMemory64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x128], 0
jne 0x180026673
jmp 0x180026929
mov r9d, dword [rsp + 0x88]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x30]
call qword [rsp + Ordinal_301]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x1800266b0
jmp 0x180026929
mov ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + rcx]
mov qword [rsp + 0x118], rax
mov r9d, dword [rsp + 0x9c]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x30]
call qword [rsp + Ordinal_301]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x180026708
jmp 0x180026929
mov ecx, dword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
add rax, rcx
mov qword [rsp + 0x120], rax
mov rax, qword [rsp + 0x120]
movzx ecx, word [rax + 2]
call fcn.18003cbd0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x120]
movzx r9d, word [rax + 2]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x120]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x30]
call qword [rsp + Ordinal_301]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x18002677b
jmp 0x180026929
jmp 0x18002691f
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.18003bb80
lea rcx, [0x1800a0c70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x160], 0
jne 0x1800267ca
jmp 0x180026929
mov qword [rsp + 0x20], 0
mov r9d, Ordinal_50
lea r8, [rsp + 0x130]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [rsp + 0x160]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
jge 0x1800267ff
jmp 0x180026929
mov r9d, dword [rsp + 0x88]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180026834
jmp 0x180026929
mov ecx, dword [rsp + 0xa0]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + rcx]
mov qword [rsp + 0x168], rax
mov r9d, dword [rsp + 0x9c]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180026884
jmp 0x180026929
mov ecx, dword [rsp + 0x98]
mov rax, qword [rsp + 0x90]
add rax, rcx
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
movzx ecx, word [rax + 2]
call fcn.18003c750
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x1800268ce
jmp 0x180026929
mov rax, qword [rsp + 0x170]
movzx r8d, word [rax + 2]
xor edx, edx
mov rcx, qword [rsp + 0x40]
call fcn.18003bb80
mov rax, qword [rsp + 0x170]
movzx r9d, word [rax + 2]
mov qword [rsp + 0x20], 0
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x170]
mov rdx, qword [rdx + 8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x18002691f
jmp 0x180026929
xor eax, eax
test eax, eax
jne 0x180026454
cmp qword [rsp + 0x30], 0
je 0x18002693c
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
add rsp, 0x1a8
ret