Function at 0x1401836fc
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov r13d, r8d
mov qword [rbp - 0x40], r14
mov ebx, r14d
mov qword [rbp - 0x48], r14
mov edi, r14d
mov esi, r14d
cmp r8d, 0xffffffff
jne 0x140183744
lea r14d, [rsi + 1]
jmp 0x140183ad3
or r12, 0xffffffffffffffff
mov rax, r12
inc rax
cmp word [r9 + rax*2], r14w
jne 0x14018374b
mov r15d, eax
mov ecx, 0x80070216
mov qword [rbp - 0x38], r15
cmp rax, r15
je 0x140183770
mov r14d, ecx
call fcn.140082a8c
jmp 0x140183777
xor ecx, ecx
call fcn.140082b34
mov ecx, r14d
call fcn.140082b34
test r14d, r14d
jns 0x140183791
mov ecx, r14d
call fcn.140082a8c
jmp 0x140183ad3
test r15d, r15d
je 0x1401837d7
test r13b, 8
je 0x1401837d7
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.1401849bc
mov r14d, eax
test eax, eax
js 0x140183784
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor r14d, r14d
mov r15, rax
test rax, rax
je 0x1401837cd
mov rbx, rax
test rax, rax
jne 0x1401837e6
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140183787
mov rcx, qword [rbp + 0x60]
lea rdx, [rbp - 0x48]
call fcn.140082960
jmp 0x1401837a9
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140183812
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov qword [rbp - 0x48], r14
mov rbx, qword [rbp + 0x68]
test rbx, rbx
jne 0x140183866
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, [0x1403da578]
call fcn.1400826b4
mov r14d, eax
test eax, eax
js 0x140183852
lea rcx, [0x1403da578]
mov edx, dword [rbp + 0x58]
lea r8, [rbp - 0x48]
call fcn.140082808
mov r14d, eax
test eax, eax
jns 0x140183859
mov ecx, eax
call fcn.140082a8c
mov ecx, r14d
call fcn.140082b34
jmp 0x140183902
test r13b, 4
je 0x14018389c
mov rax, qword [rbp + 0x48]
cmp dword [rax + 4], r14d
jne 0x14018389c
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x58]
lea rcx, str._exc_
call fcn.1400826b4
mov r14d, eax
test eax, eax
js 0x140183852
lea rcx, str._exc_
jmp 0x14018383f
inc r12
cmp word [rbx + r12*2], r14w
jne 0x14018389c
mov eax, r12d
cmp r12, rax
je 0x1401838c1
mov ecx, 0x80070216
mov r14d, ecx
call fcn.140082a8c
mov r12, qword [rbp - 0x38]
jmp 0x1401838c8
xor ecx, ecx
call fcn.140082b34
mov ecx, r14d
call fcn.140082b34
test r14d, r14d
jns 0x1401838e5
mov ecx, r14d
call fcn.140082a8c
mov rbx, r15
jmp 0x140183ad3
test r12d, r12d
je 0x14018390b
test r13b, 0x10
je 0x14018390b
lea r8, [rbp - 0x48]
mov edx, r12d
mov rcx, rbx
call fcn.140167f64
mov r14d, eax
test r14d, r14d
js 0x1401838d5
mov rbx, qword [rbp - 0x48]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov r12, rax
test rax, rax
je 0x140183926
mov rdi, rax
test rax, rax
jne 0x140183930
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x1401838d8
mov rdi, qword [rbp + 0x70]
test rdi, rdi
je 0x14018396c
test r13b, 0x40
jne 0x14018396c
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rsi, rax
test rax, rax
jne 0x14018396c
mov esi, ecx
mov ecx, 0x8007000e
mov r14d, ecx
call fcn.140082a8c
mov rbx, r15
mov rdi, r12
jmp 0x140183ad3
test r13b, 1
je 0x1401839de
mov rbx, qword [rbp + 0x48]
mov r9, r12
mov rdx, qword [rbp + 0x50]
mov r8, r15
mov rcx, qword [rbx + 0x18]
call fcn.140169600
mov r14d, eax
xor eax, eax
test r14d, r14d
jns 0x140183998
mov ecx, r14d
jmp 0x14018395c
test rdi, rdi
je 0x1401839cc
test r13b, 0x40
jne 0x1401839cc
cmp dword [0x140452a78], 1
mov r8, rax
mov rdx, qword [rbp + 0x50]
mov r9, rsi
cmove r8, qword [0x140452150]
mov rcx, qword [rbx + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
js 0x140183993
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x40]
call fcn.14016f740
jmp 0x140183abb
mov rax, qword [rbp + 0x48]
mov r14, qword [rax + 0x18]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
test r13b, 2
je 0x140183b78
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x40]
mov rdx, r15
mov rcx, r14
call rax
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140183993
mov rbx, qword [rbp + 0x48]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbx + 0x18]
test r13b, 0x20
je 0x140183be6
mov r8, r12
call fcn.140185328
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140183993
test rdi, rdi
je 0x140183a87
test r13b, 0x40
jne 0x140183a87
cmp dword [0x140452a78], 1
mov r8d, eax
mov rdx, qword [rbp - 0x40]
mov r9, rsi
cmove r8, qword [0x140452150]
mov rcx, qword [rbx + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
js 0x140183993
mov rdi, qword [rbp + 0x50]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x40]
mov rax, rbx
xor r8d, r8d
mov rcx, rdi
call rax
mov r14d, eax
test eax, eax
js 0x140183993
mov rdx, qword [rbp + 0x78]
mov rbx, r15
mov rdi, r12
test rdx, rdx
je 0x140183ad3
mov rcx, qword [rbp - 0x40]
call fcn.14016f740
mov ecx, r14d
call fcn.140082b34
test rsi, rsi
je 0x140183ae9
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test rdi, rdi
je 0x140183af9
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x140183b07
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140183b2f
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
xor r9d, r9d
mov qword [rbp - 0x30], 3
lea rax, [0x140028cdc]
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x40]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x18], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x140452a78], 1
mov rdi, rcx
mov rcx, rbx
cmove rdi, qword [0x140452138]
call rax
mov rax, rbx
lea r8, [rbp - 0x40]
mov rdx, rdi
mov rcx, r14
call rax
xor edi, edi
mov r14d, eax
test eax, eax
jns 0x140183bae
mov ecx, eax
jmp 0x14018395c
cmp dword [0x140452a78], 1
mov r8, rdi
mov rbx, qword [rbp + 0x48]
mov r9, r15
cmove r8, qword [0x140452140]
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbx + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
js 0x140183ba7
mov rdi, qword [rbp + 0x70]
xor eax, eax
jmp 0x140183a27
cmp dword [0x140452a78], 1
mov r8, rax
mov r9, r12
cmove r8, qword [0x140452148]
call fcn.140169600
jmp 0x140183a41