Function at 0x180082d90
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
lea rdi, [rsp + 0x20]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x120]
mov rax, qword [0x1805a6200]
xor rax, rsp
mov qword [rsp + 0x108], rax
xor r9d, r9d
mov r8d, 0xb0
lea rdx, [rsp + 0x30]
mov ecx, 0x50
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x18008342b
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 0
jmp 0x180082e1e
mov eax, dword [rsp + 0xf8]
inc eax
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 8
jae 0x180082e71
mov eax, dword [rsp + 0xf8]
mov rax, qword [rsp + rax*8 + 0x58]
mov rcx, qword [rsp + 0xe8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xe8], rax
mov eax, dword [rsp + 0xf8]
mov rax, qword [rsp + rax*8 + 0x98]
mov rcx, qword [rsp + 0xf0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf0], rax
jmp 0x180082e0e
imul rax, qword [rsp + 0x30], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x534
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0x38], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x535
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0x40], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x536
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0x48], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x537
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0x50], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x546
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0xe8], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x539
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 0
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x542
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 1
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x543
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 2
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x544
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 3
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x545
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 4
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x554
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 5
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x555
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 6
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x556
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 7
imul rax, qword [rsp + rax + 0x58], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x557
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
imul rax, qword [rsp + 0xf0], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x547
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 0
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x548
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 1
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x549
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 2
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54a
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 3
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54b
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 4
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54c
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 5
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54d
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 6
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54e
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov eax, 8
imul rax, rax, 7
imul rax, qword [rsp + rax + 0x98], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x54f
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
cmp dword [0x18059ff7c], 0x3e
jb 0x18008340d
imul rax, qword [rsp + 0xd8], 0x1000
mov edx, 0xffffffff
mov rcx, rax
call sym.ProcessMonitor.dll_PhFormatSize
mov rcx, rax
call sym.ProcessMonitor.dll_PhAutoDereferenceObject
mov r8, qword [rax + 8]
mov edx, 0x55d
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
jmp 0x180083426
lea r8, [0x1803b2e88]
mov edx, 0x55d
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
jmp 0x180083683
lea r8, [0x1803ad3c8]
mov edx, 0x534
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x535
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x536
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x537
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x55d
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x546
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x539
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x542
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x543
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x544
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x545
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x554
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x555
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x556
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x557
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x547
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x548
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x549
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54a
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54b
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54c
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54d
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54e
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
lea r8, [0x1803ad3c8]
mov edx, 0x54f
mov rcx, qword [rsp + 0x120]
call sym.ProcessMonitor.dll_PhSetDialogItemText
mov rcx, rsp
lea rdx, [0x1803bb7f0]
call fcn.180014e20
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.18000ce90
add rsp, 0x110
pop rdi
ret