Function at 0x140030da0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
mov rdi, rcx
test rdx, rdx
je 0x140030e33
mov r12d, r9d
mov rbx, r8
mov r14, rdx
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
jne 0x140030df2
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
je 0x140030e33
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x378]
mov rcx, rsi
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x140030e3f
mov qword [rdi], 2
mov rcx, rsi
call fcn.1401268a4
jmp 0x1400315c5
mov qword [rdi], 2
jmp 0x1400315c5
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], 0x800000
mov edx, pe_nt_image_headers64
mov ecx, 0x40
call sub.KERNEL32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0xac], r12d
je 0x1400310f7
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140030f68
test eax, eax
jne 0x140031063
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400310f7
movzx r8d, word [rsp + 0x40]
shr r8d, 1
lea rcx, [rsp + 0x168]
call dbg.from_wide
lea rcx, [rsp + 0x168]
call dbg.as_mut_slice
mov rcx, rax
call sym.std::path::Path::file_name::ha7da384c2c7edd94
test rax, rax
je 0x140031078
mov r8, rdx
lea rcx, [rsp + 0x60]
mov rdx, rax
call sym.std::sys::windows::os_str::Slice::to_string_lossy::hea383edc9246b293
mov r13, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
test r13, r13
mov rbp, r13
mov qword [rsp + 0x58], rax
cmove rbp, rax
mov r15, qword [rsp + 0x70]
test r15, r15
je 0x14003107d
js 0x1400315f4
mov rax, qword [0x140166748]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r15
call sym.__rust_alloc
mov r12, rax
test rax, rax
jne 0x140031083
mov ecx, 1
mov rdx, r15
call dbg.handle_alloc_error
jmp 0x1400315f9
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140030f77
call sub.KERNEL32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.KERNEL32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400310f7
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140030eb4
cmp eax, 0xc0000004
jne 0x140031063
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140030fce
call sub.KERNEL32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.KERNEL32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400310f7
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140030eb4
cmp eax, 0xc0000004
jne 0x140031063
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140031021
call sub.KERNEL32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.KERNEL32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400310f7
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140030eb4
cmp eax, 0xc0000004
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400310f7
call sub.KERNEL32.dll_LocalFree
jmp 0x1400310f7
xor r12d, r12d
jmp 0x1400310ae
mov r12d, 1
mov rcx, r12
mov rdx, rbp
mov r8, r15
call sym.memcpy
test r13, r13
mov rdx, qword [rsp + 0x58]
je 0x1400310ae
test rdx, rdx
je 0x1400310ae
mov r8d, 1
mov rcx, r13
call sym.__rust_dealloc
mov rcx, qword [rsp + 0x48]
call sub.KERNEL32.dll_LocalFree
mov rdx, qword [rsp + 0x170]
test rdx, rdx
je 0x1400310d8
mov rcx, qword [rsp + 0x168]
mov r8d, 1
call sym.__rust_dealloc
test r12, r12
je 0x1400310f7
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x118], r12
jmp 0x14003110e
mov qword [rsp + 0x118], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
lea r15, [rsp + 0x168]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9d, 0x105
call sub.PSAPI.DLL_GetModuleFileNameExW
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x168]
mov r8d, 0x105
call sym.sysinfo::windows::process::null_terminated_wchar_to_string::h7a389f6995460bfb
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x38]
call dbg.from_string
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x79]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x93], eax
test r13, r13
mov qword [rsp + 0x108], r12
je 0x1400311d7
js 0x1400315ed
mov rax, qword [0x140166748]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r13
call sym.__rust_alloc
mov r15, rax
test rax, rax
jne 0x1400311dd
mov ecx, 1
mov rdx, r13
call dbg.handle_alloc_error
jmp 0x1400315f9
mov r15d, 1
mov rcx, r15
mov rdx, qword [rsp + 0x58]
mov r8, r13
call sym.memcpy
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
movzx eax, byte [rsp + 0x37]
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x38]
call sym.std::path::PathBuf::pop::ha7eed44679798629
lea rbp, [rsp + 0x168]
lea rdx, [rsp + 0x138]
mov rcx, rbp
call sym.sysinfo::windows::process::get_process_params::he8d50a5837f1a071
cmp byte [rsp + 0x1b0], 2
mov qword [rsp + 0x130], r14
jne 0x1400312f4
mov qword [rsp + 0xb0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xd0], 8
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xf0], 1
movups xmmword [rsp + 0xf8], xmm0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
call dbg.from_string
mov rsi, rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xf0], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x70], rax
jmp 0x140031361
mov rsi, rbx
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x168]
movaps xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0x140], xmm0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xe0], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x60]
mov r14, qword [rsp + 0x88]
mov rcx, r14
mov r8, rbp
mov r9, rbp
call sub.KERNEL32.dll_GetProcessTimes
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x60]
shr rdx, 0x17
movabs rbp, 0xfffffffd49ef6f00
add rbp, rdx
xor ebx, ebx
cmp rbp, rsi
cmovbe rbx, rbp
xor r15d, r15d
cmp qword [rsp + 0x110], 0
setne r12b
lea rcx, [rsp + 0x168]
mov rdx, r14
mov r8d, dword [rsp + 0xac]
call sym.sysinfo::windows::process::get_process_user_id::h490b2402ca0f33da
mov rax, qword [0x140166748]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x1400315dc
sub rsi, rbx
mov r15b, r12b
mov qword [rax], 1
mov qword [rax + 8], 1
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x128]
mov qword [rdi + 0x88], rcx
movups xmm0, xmmword [rsp + 0x118]
movups xmmword [rdi + 0x78], xmm0
mov rcx, qword [rsp + 0x178]
mov qword [rdi + 0xd8], rcx
movups xmm0, xmmword [rsp + 0x168]
movups xmmword [rdi + 0xc8], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x90], xmm0
mov rcx, qword [rsp + 0xc0]
mov qword [rdi + 0xa0], rcx
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdi + 0xa8], xmm0
mov rcx, qword [rsp + 0xe0]
mov qword [rdi + 0xb8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], r13
movzx ecx, byte [rsp + 0x37]
mov byte [rdi + 0x30], cl
mov ecx, dword [rsp + 0x90]
mov edx, dword [rsp + 0x93]
mov dword [rdi + 0x31], ecx
mov dword [rdi + 0x34], edx
mov rcx, qword [rsp + 0xa0]
mov qword [rdi + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rdi + 0x40], rcx
movaps xmm0, xmmword [rsp + 0x150]
movups xmmword [rdi + 0x48], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x68], xmm1
movups xmmword [rdi + 0x58], xmm0
xorps xmm0, xmm0
movups xmmword [rdi + 0xf8], xmm0
movups xmmword [rdi + 0x108], xmm0
mov qword [rdi], r15
mov rcx, qword [rsp + 0x110]
mov qword [rdi + 8], rcx
mov dword [rdi + 0x10], 1
mov rcx, qword [rsp + 0x130]
mov qword [rdi + 0xc0], rcx
movups xmmword [rdi + 0xe0], xmm0
mov qword [rdi + 0xf0], rax
mov qword [rdi + 0x118], rbp
mov qword [rdi + 0x120], rsi
movups xmmword [rdi + 0x138], xmm0
movups xmmword [rdi + 0x128], xmm0
mov dword [rdi + 0x148], 0
mov byte [rdi + 0x14c], 1
mov rax, rdi
add rsp, 0x3a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
jmp 0x1400315f9
call dbg.capacity_overflow
jmp 0x1400315f9
call dbg.capacity_overflow
ud2