Function at 0x1400a5990
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r15, rcx
lea rcx, str.kernel32.dll
mov r14d, r9d
mov rbp, r8
xor sil, sil
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14012bcb8]
test rax, rax
je 0x1400a59ea
call rax
jmp 0x1400a59f0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [0x14012c9d4], 0x1720
mov dword [0x14012c9e0], 0xf60
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
cmp al, 5
jb 0x1400a5a5b
mov dword [0x140126558], ebx
cmp al, 0xa
jb 0x1400a5a26
mov dword [0x140126558], 4
jmp 0x1400a5a5b
cmp al, 6
jb 0x1400a5a5b
shr ax, 8
movzx ecx, al
test al, al
je 0x1400a5a51
dec ecx
je 0x1400a5a45
mov dword [0x140126558], 3
jmp 0x1400a5a5b
mov dword [0x140126558], 2
jmp 0x1400a5a5b
mov dword [0x140126558], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x20], ebx
mov qword [0x14012bc80], rbp
mov qword [rsp + 0x60], rbp
mov r9d, ebx
cmp word [rbp], bx
je 0x1400a5b19
nop dword [rax]
lea r11, [rsp + 0x60]
movsxd rax, r9d
mov rdx, rbx
mov r10, qword [r11 + rax*8]
lea r11, [r11 + rax*8]
mov r8d, ebx
cmp word [r10], dx
je 0x1400a5ad6
mov rcx, rbx
nop
cmp word [rcx + r10], 0x20
je 0x1400a5ac9
inc rdx
inc r8d
lea rcx, [rdx + rdx]
cmp word [rcx + r10], bx
jne 0x1400a5ab0
test rdx, rdx
je 0x1400a5ad6
inc r9d
mov dword [rsp + 0x20], r9d
movsxd rax, r9d
mov rcx, qword [rsp + rax*8 + 0x58]
cmp word [rcx + rdx*2], bx
je 0x1400a5b19
mov word [rcx + rdx*2], bx
movsxd r9, dword [rsp + 0x20]
lea eax, [r8 + 1]
movsxd rcx, eax
lea rdx, [rsp + 0x60]
mov rax, qword [rdx + r9*8 - 8]
lea rdx, [rdx + r9*8]
lea r8, [rax + rcx*2]
mov qword [rdx], r8
cmp r9d, 0x20
je 0x1400a5b19
cmp word [r8], bx
jne 0x1400a5a90
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [0x1400d25b0]
call fcn.14003ff30
test eax, eax
jne 0x1400a5b3d
mov eax, 1
jmp 0x1400a5e4a
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x170], r12
cmp dword [rsp + 0x20], ebx
jle 0x1400a5d4e
lea rdi, [rsp + 0x60]
mov r12d, 0xfffd
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi]
or rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x1400a5b80
inc rdx
call fcn.1400aa3f4
mov r8, qword [rdi]
movzx eax, word [r8]
sub ax, 0x2d
test r12w, ax
jne 0x1400a5d2c
movzx ecx, word [r8 + 2]
sub ecx, 0x45
je 0x1400a5c63
sub ecx, 0xb
je 0x1400a5bf8
sub ecx, 2
je 0x1400a5d09
dec ecx
je 0x1400a5bdb
dec ecx
jne 0x1400a5cd4
mov byte [0x14012bc78], 1
jmp 0x1400a5c74
cmp word [r8 + 4], 0x3a
jne 0x1400a5d44
lea rcx, [r8 + 6]
call fcn.1400ab1a4
mov dword [0x14011e268], eax
jmp 0x1400a5c74
cmp word [r8 + 4], 0x3a
jne 0x1400a5d44
movzx eax, word [r8 + 6]
cmp eax, 0x48
je 0x1400a5c74
cmp eax, 0x4c
je 0x1400a5c4d
cmp eax, 0x4e
je 0x1400a5c37
cmp eax, 0x52
jne 0x1400a5d44
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400a5c74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400a5c74
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400a5c74
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x1400a5d44
mov sil, 1
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x20]
jl 0x1400a5b70
test sil, sil
je 0x1400a5d4e
call fcn.140064600
test al, al
jne 0x1400a5d4e
xor r8d, r8d
mov edx, r14d
mov rcx, rbp
call fcn.1400630e0
test eax, eax
je 0x1400a5e38
cmp eax, 0x4c7
je 0x1400a5cca
mov rdx, qword [0x14012bbd0]
lea rcx, str.Error_elevating
call fcn.14009aca0
mov eax, 1
jmp 0x1400a5e3a
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
mov r9d, 0x40
lea r8, [0x1400d25b0]
lea rdx, str.Usage:_Process_Explorer___e____t____p:_rhl_____s:_PID___n_n_e_tRequest_UAC_elevation_n_t_tStart_minimized_in_the_tray_n_p_tRun_at_priority:_realtime__r___high__h___normal__n__or_low__l__n_s_tSelect_the_specified_process_n
cmp al, 6
jae 0x1400a5cfb
lea rdx, str.Usage:_Process_Explorer___t____p:_rhl_____s:_PID___n_n_t_tStart_minimized_in_the_tray_n_p_tRun_at_priority:_realtime__r___high__h___normal__n__or_low__l__n_s_tSelect_the_specified_process_n
call qword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x1400a5e3a
movsxd rax, ebx
mov rcx, qword [rsp + rax*8 + 0x60]
cmp word [rcx + 4], 0x54
jne 0x1400a5d44
xor r8d, r8d
xor edx, edx
xor r9d, r9d
xor ecx, ecx
call fcn.140070550
jmp 0x1400a5e38
lea rdx, str.TASKMGR
mov rcx, r8
call fcn.1400a99c0
test rax, rax
jne 0x1400a5c84
call fcn.1400a5950
jmp 0x1400a5e3a
mov edx, r14d
mov rcx, r15
call fcn.14004e810
test eax, eax
je 0x1400a5e38
lea rdx, str.PROCEXPLORER
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400a5e38
nop
mov rcx, qword [0x14012c9f0]
test rcx, rcx
je 0x1400a5db5
lea r8, [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400a5e1d
mov rcx, qword [0x14012c9f0]
mov rax, qword [0x14012c9e8]
test rax, rax
je 0x1400a5dda
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1400a5e1d
mov rcx, qword [0x14012c9f0]
test rcx, rcx
je 0x1400a5dee
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1400a5e1d
mov rcx, qword [0x14012bbd0]
lea r8, [rsp + 0x28]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400a5e1d
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x28]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1400a5d90
xor eax, eax
mov rdi, qword [rsp + 0x178]
mov r12, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x180
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret