Function at 0x1400360e0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
movaps xmmword [rsp + 0x150], xmm6
mov r13, rcx
mov rax, qword [0x14022c040]
xor rax, rsp
mov qword [rsp + 0x148], rax
lea rdi, [rsp + 0xf0]
mov qword [rdi], rdx
mov rcx, rdi
call fcn.1400a4690
mov rsi, qword [rdi]
mov rax, qword [0x140244c90]
test rax, rax
je 0x140036724
mov rcx, qword [0x140244c98]
cmp rcx, rsi
ja 0x140036779
cmp rax, rsi
jb 0x140036779
lea r8, [rsp + 0x60]
mov qword [r8], 0
mov rdx, qword [rsp + 0xf0]
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x14003676e
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x140036195
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400a7ad0
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x140036761
xor ebx, ebx
mov qword [rsp + 0x58], rbx
call fcn.1400a7ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.1400a7ad0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsp + 0x12b], ebx
mov dword [rsp + 0x128], ebx
movaps xmm6, xmmword [0x1401fa990]
lea rdx, [rsp + 0x130]
movaps xmmword [rdx], xmm6
lea r8, [rsp + 0x124]
mov dword [r8], 0xaaaaaaaa
lea r9, [rsp + 0x118]
mov qword [r9], rbx
lea rax, [rsp + 0x110]
mov qword [rax], rbx
lea r10, [0x1401fc760]
lea rcx, [rsp + 0x60]
mov qword [rcx], r10
mov qword [rcx + 8], rdi
mov qword [rsp + 0x20], rax
call fcn.140036840
movabs rbp, 0xaaaaaaaaaaaaaaaa
test al, al
mov qword [rsp + 0x50], r13
je 0x1400367ff
xorps xmm0, xmm0
lea rbx, [rsp + 0x60]
movaps xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x118]
mov r8, rbx
call fcn.1400db890
test al, al
je 0x140036818
movsx rax, byte [rsp + 0x77]
test rax, rax
cmovs rax, qword [rsp + 0x68]
cmovs rbx, qword [rsp + 0x60]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xd0], rax
test rax, rax
js 0x14003675f
sete al
test rbx, rbx
setne cl
or cl, al
je 0x14003675f
lea r15, [rsp + 0xd8]
lea rdx, [rsp + 0xc8]
mov rcx, r15
call fcn.1400f4790
lea r12, [rsp + 0xf0]
mov rcx, r15
mov rdx, r12
call fcn.1401030c0
mov rax, qword [r12]
mov qword [rsp + 0x48], rax
mov rbx, qword [r12 + 8]
mov eax, dword [r12 + 0x10]
mov dword [rsp + 0x128], eax
mov eax, dword [r12 + 0x13]
mov dword [rsp + 0x12b], eax
mov sil, byte [r12 + 0x17]
mov byte [r12 + 0x17], 0
mov word [r12], 0
cmp byte [r15 + 0x17], 0
jns 0x140036321
mov rcx, qword [rsp + 0xd8]
call fcn.140133b2c
mov qword [rsp + 0x100], rbp
movaps xmmword [rsp + 0xf0], xmm6
lea rdx, [rsp + 0x130]
mov rcx, r12
call fcn.140036970
lea rax, [0x140217e44]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], 3
movsx rax, byte [rsp + 0x107]
test rax, rax
jns 0x14003637a
mov rax, qword [rsp + 0xf8]
mov r12, qword [rsp + 0xf0]
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], rax
test rax, rax
js 0x14003675f
sete al
test r12, r12
setne cl
or cl, al
je 0x14003675f
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0xb8]
lea r12, [rsp + 0xf0]
mov r8, r12
call fcn.140122030
mov edx, dword [rsp + 0x124]
mov rcx, r15
call fcn.1400340a0
movsx r14, byte [rsp + 0xef]
test r14, r14
jns 0x1400363f1
mov r14, qword [rsp + 0xe0]
mov r15, qword [rsp + 0xd8]
test r14, r14
sete al
test r15, r15
setne cl
or cl, al
je 0x14003675f
movsx rax, byte [rsp + 0x107]
mov edx, 0xa
mov r13, rax
test rax, rax
jns 0x140036438
movabs rdx, 0x7fffffffffffffff
and rdx, qword [rsp + 0x100]
dec rdx
mov r13, qword [rsp + 0xf8]
mov rcx, rdx
sub rcx, r13
cmp rcx, r14
jb 0x140036699
test r14, r14
je 0x1400364a3
test al, al
jns 0x140036458
mov r12, qword [rsp + 0xf0]
test r14, r14
js 0x14003675f
lea rcx, [r12 + r13*2]
cmp rcx, r15
ja 0x140036477
lea rax, [rcx + r14*2]
cmp rax, r15
ja 0x14003675f
lea r8, [r14 + r14]
mov rdx, r15
call fcn.14016a030
add r13, r14
cmp byte [rsp + 0x107], 0
jns 0x140036713
mov qword [rsp + 0xf8], r13
mov word [r12 + r13*2], 0
cmp byte [rsp + 0xef], 0
js 0x140036795
lea rax, [rsp + 0xf0]
movsx rcx, byte [rax + 0x17]
test rcx, rcx
cmovs rcx, qword [rax + 8]
cmovs rax, qword [rax]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
test rcx, rcx
js 0x14003675f
sete cl
test rax, rax
setne al
or al, cl
je 0x14003675f
lea r13, [rsp + 0xd8]
lea rdx, [rsp + 0x98]
mov rcx, r13
call fcn.140110920
mov r15, qword [r13]
mov r12, qword [r13 + 8]
mov r14, qword [r13 + 0x10]
cmp byte [rsp + 0x107], 0
jns 0x14003652f
mov rcx, qword [rsp + 0xf0]
call fcn.140133b2c
cmp byte [rsp + 0x77], 0
jns 0x140036540
mov rcx, qword [rsp + 0x60]
call fcn.140133b2c
lea r13, [rsp + 0xf0]
mov qword [r13 + 0x10], rbp
movaps xmmword [r13], xmm6
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
mov r8, r13
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
test eax, eax
je 0x1400367a7
mov ecx, 0x58
call fcn.140133b54
mov r13, rax
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
call fcn.1400a7ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.1400a7ad0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rax, fcn.14006e430
mov qword [r13], rax
mov qword [r13 + 8], 0
call fcn.1400a7ad0
cmp qword [r13 + 8], rdi
je 0x1400365f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp qword [r13 + 8], 0
jne 0x1400367b4
mov qword [r13 + 8], rdi
call fcn.1400a7ad0
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x70]
mov qword [r13 + 0x20], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [r13 + 0x10], xmm0
test r14, r14
jns 0x1400367c8
lea rcx, [r13 + 0x28]
mov rdx, r15
mov r8, r12
call fcn.1400a8a50
test sil, sil
mov r12, qword [rsp + 0x48]
jns 0x1400366ec
mov rcx, r13
add rcx, 0x40
mov rdx, r12
mov r8, rbx
call fcn.140110450
xor edi, edi
test r14, r14
jns 0x140036650
mov rcx, r15
call fcn.140133b2c
test sil, sil
jns 0x14003665d
mov rcx, r12
call fcn.140133b2c
test rdi, rdi
jne 0x1400367d9
mov rdi, qword [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rax], r13
mov r13, rax
test rdi, rdi
jne 0x1400367ec
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
cmp rcx, qword [0x14022c040]
je 0x1400366cd
call fcn.1401363f0
int3
lea r8, [r14 + r13]
sub r8, rdx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xf0]
mov r9, r13
call fcn.140009fe0
jmp 0x1400364a3
mov rax, r13
movaps xmm6, xmmword [rsp + 0x150]
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [r13 + 0x40], r12
mov qword [r13 + 0x48], rbx
mov eax, dword [rsp + 0x128]
mov ecx, dword [rsp + 0x12b]
mov dword [r13 + 0x50], eax
mov dword [r13 + 0x53], ecx
mov byte [r13 + 0x57], sil
jmp 0x140036641
mov eax, r13d
and al, 0x7f
mov byte [rsp + 0x107], al
jmp 0x14003649c
movaps xmm0, xmmword [0x1401fa990]
lea rdi, [rsp + 0x60]
movaps xmmword [rdi + 0x20], xmm0
movaps xmmword [rdi + 0x10], xmm0
movaps xmmword [rdi], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
mov qword [0x140244c90], rax
mov qword [0x140244c98], rcx
jmp 0x14003613d
ud2
mov qword [r13], 0
jmp 0x14003667f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140036176
lea rdi, [rsp + 0x58]
mov qword [rdi], 0
mov rcx, rdi
call fcn.1401b5400
mov rdi, qword [rdi]
jmp 0x140036195
mov rcx, qword [rsp + 0xd8]
call fcn.140133b2c
jmp 0x1400364b1
xor r13d, r13d
mov r12, qword [rsp + 0x48]
jmp 0x140036643
call fcn.1400a7ad0
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1400365e5
mov qword [r13 + 0x28], r15
mov qword [r13 + 0x30], r12
mov qword [r13 + 0x38], r14
jmp 0x140036621
call fcn.1400a7ad0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140036666
call fcn.1400a7ad0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14003667f
mov qword [rsp + 0x48], 0
xor esi, esi
xor r12d, r12d
xor r14d, r14d
xor r15d, r15d
jmp 0x140036540
mov qword [rsp + 0x48], 0
xor ebx, ebx
xor esi, esi
xor r12d, r12d
xor r14d, r14d
xor r15d, r15d
jmp 0x14003652f