Function at 0x140327e0b
Capabilities:
Get system information on windows

Disassembly:
push rax
pushf
mov eax, 0xf1f8c19b
pushf
not eax
add eax, 0xc4e977d1
xor eax, 0xed4ea414
rol eax, 0x97
popf
pushf
not eax
add eax, 0x83c60561
xor eax, 0xef31779b
rol eax, 0x71
popf
pushf
not eax
add eax, 0x8a714038
xor eax, 0xe6d80809
rol eax, 0x87
popf
cmp eax, 4
jne 0x140327e5b
popf
pop rax
jmp 0x1403281ab
cmp eax, 0
jne 0x140327e6a
popf
pop rax
jmp 0x140327f69
cmp eax, 3
jne 0x140327e79
popf
pop rax
jmp 0x140328119
cmp eax, 1
jne 0x140327e88
popf
pop rax
jmp 0x140328015
cmp eax, 0xd
jne 0x140327e97
popf
pop rax
jmp 0x14032864f
cmp eax, 7
jne 0x140327ea6
popf
pop rax
jmp 0x1403283ee
cmp eax, 0xe
jne 0x140327eb5
popf
pop rax
jmp 0x1403286c6
cmp eax, 0xb
jne 0x140327ec4
popf
pop rax
jmp 0x140328598
cmp eax, 0xc
jne 0x140327ed3
popf
pop rax
jmp 0x1403285fe
cmp eax, 8
jne 0x140327ee2
popf
pop rax
jmp 0x1403284a6
cmp eax, 0x10
jne 0x140327ef1
popf
pop rax
jmp 0x1403288d3
cmp eax, 2
jne 0x140327f00
popf
pop rax
jmp 0x140328085
cmp eax, 9
jne 0x140327f0f
popf
pop rax
jmp 0x140328506
cmp eax, 0x12
jne 0x140327f1e
popf
pop rax
jmp 0x1403289cf
cmp eax, 6
jne 0x140327f2d
popf
pop rax
jmp 0x14032836d
cmp eax, 0x11
jne 0x140327f3c
popf
pop rax
jmp 0x140328928
cmp eax, 5
jne 0x140327f4b
popf
pop rax
jmp 0x1403282ed
cmp eax, 0xf
jne 0x140327f5a
popf
pop rax
jmp 0x1403287ca
cmp eax, 0xa
jne 0x140327f69
popf
pop rax
jmp 0x140328591
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, 0x5f740ebf
pushf
not ecx
add ecx, 0xcb99bbdf
xor ecx, 0xaf89d54f
rol ecx, 0x9f
popf
pushf
not ecx
add ecx, 0x8e1b84e0
xor ecx, 0xf6e0c9ca
rol ecx, 0x70
popf
pushf
not ecx
add ecx, 0xf332fdf0
xor ecx, 0xf1b5234f
rol ecx, 0xc1
popf
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
push rax
pushf
mov eax, 0x5f019b31
pushf
not eax
add eax, 0xcdca18a1
xor eax, 0xbe24aac4
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x85541c74
xor eax, 0xd610691d
rol eax, 0xdd
popf
jmp 0x140327e4c
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140328052
push rax
pushf
mov eax, 0xdf422cc4
pushf
not eax
add eax, 0x81490676
xor eax, 0xa829054b
rol eax, 0x20
popf
pushf
not eax
add eax, 0xc1e6f409
xor eax, 0xb6b7170e
rol eax, 0xe9
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0xb037a68a
pushf
not eax
add eax, 0x8efdb87d
xor eax, 0x9e5c2aa6
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x85088021
xor eax, 0xe46e44cc
rol eax, 0xc3
popf
jmp 0x140327e4c
cmp qword [rsp + 0x28], 0
je 0x1403280d3
push rax
pushf
mov eax, 0xf8c4d4c9
pushf
not eax
add eax, 0xc67247b7
xor eax, 0xd93a48f2
rol eax, 0x86
popf
pushf
not eax
add eax, 0xc2727181
xor eax, 0x8c813a04
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x9a1fd7f5
xor eax, 0x9ddf4cc6
rol eax, 0xfb
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0x87d7131e
pushf
not eax
add eax, 0xfb64a265
xor eax, 0xf2055933
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xe7be3fda
xor eax, 0xd8b2b4a7
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xbee77f32
xor eax, 0xcb77305f
rol eax, 0xe1
popf
jmp 0x140327e4c
mov r8d, 0x8ab01b69
pushf
not r8d
add r8d, 0xeac1d57f
xor r8d, 0x843a3376
rol r8d, 0x46
popf
pushf
not r8d
add r8d, 0xdd550441
xor r8d, 0xbc055cb3
rol r8d, 0x55
popf
pushf
not r8d
add r8d, 0xed454968
xor r8d, 0xeeb76a69
rol r8d, 0x23
popf
xor edx, edx
mov rcx, qword [rsp + 0x28]
jmp 0x140328172
call qword [sym.imp.KERNEL32.dll_VirtualFree]
push rax
pushf
mov eax, 0xf45fac61
pushf
not eax
add eax, 0x8da48b2a
xor eax, 0xe8f2939d
rol eax, 0xa8
popf
pushf
not eax
add eax, 0x8be964e6
xor eax, 0xd5bc0f74
rol eax, 0xd
popf
jmp 0x140327e4c
mov eax, dword [rsp + 0x24]
mov r9d, 0x92de8d2c
pushf
not r9d
add r9d, 0xa25ee475
xor r9d, 0xdda5fb7e
rol r9d, 0xe7
popf
pushf
not r9d
add r9d, 0xe5bdf785
xor r9d, 0xd2a7dc1b
rol r9d, 0x2c
popf
mov r8d, 0xb73c3d57
pushf
not r8d
add r8d, 0x995c727a
xor r8d, 0xd3468587
rol r8d, 0xd6
popf
pushf
not r8d
add r8d, 0xeedf5a9a
xor r8d, 0x84fca44a
rol r8d, 0xaf
popf
pushf
not r8d
add r8d, 0x87bb0fd8
xor r8d, 0xad676f20
rol r8d, 0xf1
popf
mov edx, eax
xor ecx, ecx
jmp 0x14032823d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xfd8562d
pushf
not ecx
add ecx, 0xbf739194
xor ecx, 0xf50b888a
rol ecx, 0x32
popf
pushf
not ecx
add ecx, 0xb3c8de3b
xor ecx, 0xe4177678
rol ecx, 0xd9
popf
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
jmp 0x140328015
cmp dword [rsp + 0x30], 0
jge 0x140328327
push rax
pushf
mov eax, 0x9dd101d0
pushf
not eax
add eax, 0x9e3d0c3d
xor eax, 0xff736a8b
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x99c2e8a0
xor eax, 0x9d456480
rol eax, 0x5a
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0x10f570cf
pushf
not eax
add eax, 0xb35ec78c
xor eax, 0xa05d4013
rol eax, 0x72
popf
pushf
not eax
add eax, 0xbe5633a3
xor eax, 0xd43512ed
rol eax, 0x4f
popf
pushf
not eax
add eax, 0x83f98159
xor eax, 0xe7d9a4a1
rol eax, 0x5b
popf
jmp 0x140327e4c
cmp qword [rsp + 0x28], 0
je 0x1403283bb
push rax
pushf
mov eax, 0x307438de
pushf
not eax
add eax, 0xb13e81c8
xor eax, 0x90a8a717
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xf12c9243
xor eax, 0xa385104a
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xdbc6cfc2
xor eax, 0xa54e6160
rol eax, 0x6e
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0x62c2323e
pushf
not eax
add eax, 0xd17df0d5
xor eax, 0xd1f289e5
rol eax, 0xed
popf
pushf
not eax
add eax, 0xf351acee
xor eax, 0xcc637504
rol eax, 0x95
popf
jmp 0x140327e4c
mov r8d, 0xc7cd2b57
pushf
not r8d
add r8d, 0xb5572ee8
xor r8d, 0xa572450e
rol r8d, 0x19
popf
pushf
not r8d
add r8d, 0xcb988c65
xor r8d, 0xbe1d0a15
rol r8d, 0xa0
popf
pushf
not r8d
add r8d, 0xb595a8ce
xor r8d, 0x8c7a170b
rol r8d, 0x14
popf
xor edx, edx
mov rcx, qword [rsp + 0x28]
jmp 0x140328447
call qword [sym.imp.KERNEL32.dll_VirtualFree]
push rax
pushf
mov eax, 0xbfeb92d8
pushf
not eax
add eax, 0xcc9032b2
xor eax, 0x9be900b5
rol eax, 0xba
popf
pushf
not eax
add eax, 0xd7835bb3
xor eax, 0xdab24a42
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xaec54476
xor eax, 0x854da99e
rol eax, 0xae
popf
pushf
not eax
add eax, 0x91d49ec4
xor eax, 0xe88f93d6
rol eax, 0x71
popf
jmp 0x140327e4c
xor eax, eax
jmp 0x1403289cf
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14032855e
push rax
pushf
mov eax, 0x774bfd14
pushf
not eax
add eax, 0xafe48e47
xor eax, 0x92d9193b
rol eax, 0xae
popf
pushf
not eax
add eax, 0xf1af9e4c
xor eax, 0xa0886bee
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x8f5c462e
xor eax, 0xe5e61b6b
rol eax, 0x91
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0x3201ac4d
pushf
not eax
add eax, 0xd49f0d10
xor eax, 0xa8076868
rol eax, 0x30
popf
pushf
not eax
add eax, 0xb6d90e16
xor eax, 0xae2e637b
rol eax, 0xf3
popf
jmp 0x140327e4c
xor eax, eax
jmp 0x1403289cf
mov dword [rsp + 0x20], 0
jmp 0x14032864f
mov eax, dword [rsp + 0x20]
jmp 0x140328603
inc eax
mov dword [rsp + 0x20], eax
push rax
pushf
mov eax, 0xae55a096
pushf
not eax
add eax, 0xcb82944d
xor eax, 0x9a27b387
rol eax, 0x30
popf
pushf
not eax
add eax, 0xf8031f48
xor eax, 0xd047eb48
rol eax, 0x97
popf
pushf
not eax
add eax, 0xdd206673
xor eax, 0x82ec9b38
rol eax, 0x23
popf
jmp 0x140327e4c
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140328693
push rax
pushf
mov eax, 0x38a28020
pushf
not eax
add eax, 0xb6795873
xor eax, 0xfd840b77
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xe5f7cbac
xor eax, 0x9af72602
rol eax, 0x41
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0xb23f8772
pushf
not eax
add eax, 0xea98933c
xor eax, 0x8c8e70b4
rol eax, 0x99
popf
pushf
not eax
add eax, 0x99e77b79
xor eax, 0xde7dcc86
rol eax, 2
popf
jmp 0x140327e4c
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400054f0
mov rax, qword [rsp + 0x90]
mov rcx, rax
call fcn.140005330
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov rcx, rax
call fcn.140005330
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
jmp 0x140328734
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140328784
push rax
pushf
mov eax, 0x61356bfe
pushf
not eax
add eax, 0x88d3e212
xor eax, 0xff4205ca
rol eax, 0x5b
popf
pushf
not eax
add eax, 0xeb274235
xor eax, 0xd9c60d3d
rol eax, 0x6a
popf
pushf
not eax
add eax, 0x936e549b
xor eax, 0xfa1fa464
rol eax, 0xbb
popf
jmp 0x140327e4c
push rax
pushf
mov eax, 0xe9868700
pushf
not eax
add eax, 0xe3e1bc40
xor eax, 0xcadad9f9
rol eax, 0xc
popf
pushf
not eax
add eax, 0xa7a28685
xor eax, 0x80fd407d
rol eax, 0x39
popf
pushf
not eax
add eax, 0xffeac339
xor eax, 0xfdda6c76
rol eax, 0x22
popf
jmp 0x140327e4c
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0xcf02619f
pushf
not r8d
add r8d, 0xf7c302cf
xor r8d, 0xd72e8945
rol r8d, 0x8a
popf
pushf
not r8d
add r8d, 0xce01af83
xor r8d, 0xcf54eae6
rol r8d, 0x83
popf
pushf
not r8d
add r8d, 0xb7866005
xor r8d, 0xf9082368
rol r8d, 0xfe
popf
pushf
not r8d
add r8d, 0x857a25fd
xor r8d, 0xfe445c0d
rol r8d, 0xa5
popf
xor edx, edx
mov rcx, qword [rsp + 0x28]
jmp 0x140328856
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.140005460
mov rax, qword [rsp + 0x58]
jmp 0x1403289cf
lea rcx, [rsp + 0x60]
call fcn.140005460
jmp 0x1403285fe
mov r8d, 0xaf4f81d6
pushf
not r8d
add r8d, 0xc92336d8
xor r8d, 0xbaea0b7f
rol r8d, 0xd3
popf
pushf
not r8d
add r8d, 0xf0361a02
xor r8d, 0xf781d4ea
rol r8d, 0x8b
popf
pushf
not r8d
add r8d, 0xf7a1ff89
xor r8d, 0xf8fb0f2a
rol r8d, 0x14
popf
xor edx, edx
mov rcx, qword [rsp + 0x28]
jmp 0x140328981
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
push rax
pushf
mov eax, 0x2b2086b3
pushf
not eax
add eax, 0xf45344c4
xor eax, 0xc686781b
rol eax, 4
popf
pushf
not eax
add eax, 0xed43f81c
xor eax, 0xe45e3193
rol eax, 0xa7
popf
pushf
not eax
add eax, 0x8ce89441
xor eax, 0xb8311836
rol eax, 0x4f
popf
jmp 0x140327e4c
add rsp, 0x88
ret