Function at 0x140021e30
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
mov rdi, rcx
test rdx, rdx
je 0x140021ec3
mov r12d, r9d
mov rbx, r8
mov r14, rdx
mov ecx, 0x410
xor edx, edx
mov r8d, r14d
call sub.kernel32.dll_OpenProcess
mov rsi, rax
test rax, rax
jne 0x140021e82
mov ecx, 0x1000
xor edx, edx
mov r8d, r14d
call sub.kernel32.dll_OpenProcess
mov rsi, rax
test rax, rax
je 0x140021ec3
mov qword [rsp + 0x138], rsi
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x378]
mov rcx, rsi
xor edx, edx
mov r9d, 0x30
call sub.ntdll.dll_NtQueryInformationProcess
test eax, eax
je 0x140021ecf
mov qword [rdi], 2
mov rcx, rsi
call fcn.1402681e4
jmp 0x140022655
mov qword [rdi], 2
jmp 0x140022655
mov rax, qword [rsp + 0x3a0]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x40], 0x800000
mov edx, pe_nt_image_headers64
mov ecx, 0x40
call sub.kernel32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0xac], r12d
je 0x140022187
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140021ff8
test eax, eax
jne 0x1400220f3
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140022187
movzx r8d, word [rsp + 0x40]
shr r8d, 1
lea rcx, [rsp + 0x168]
call dbg.from_wide
lea rcx, [rsp + 0x168]
call dbg.as_mut_slice
mov rcx, rax
call sym.std::path::Path::file_name::ha7da384c2c7edd94
test rax, rax
je 0x140022108
mov r8, rdx
lea rcx, [rsp + 0x60]
mov rdx, rax
call sym.std::sys::windows::os_str::Slice::to_string_lossy::hea383edc9246b293
mov r13, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
test r13, r13
mov rbp, r13
mov qword [rsp + 0x58], rax
cmove rbp, rax
mov r15, qword [rsp + 0x70]
test r15, r15
je 0x14002210d
js 0x140022684
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r15
call sym.__rust_alloc
mov r12, rax
test rax, rax
jne 0x140022113
mov ecx, 1
mov rdx, r15
call dbg.handle_alloc_error
jmp 0x140022689
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140022007
call sub.kernel32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.kernel32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140022187
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140021f44
cmp eax, 0xc0000004
jne 0x1400220f3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002205e
call sub.kernel32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.kernel32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140022187
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140021f44
cmp eax, 0xc0000004
jne 0x1400220f3
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400220b1
call sub.kernel32.dll_LocalFree
movzx edx, word [rsp + 0x42]
mov ecx, 0x40
call sub.kernel32.dll_LocalAlloc
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140022187
lea rdx, [rsp + 0x38]
mov ecx, 0x58
mov r8d, 0x18
xor r9d, r9d
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x140021f44
cmp eax, 0xc0000004
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140022187
call sub.kernel32.dll_LocalFree
jmp 0x140022187
xor r12d, r12d
jmp 0x14002213e
mov r12d, 1
mov rcx, r12
mov rdx, rbp
mov r8, r15
call sym.memcpy
test r13, r13
mov rdx, qword [rsp + 0x58]
je 0x14002213e
test rdx, rdx
je 0x14002213e
mov r8d, 1
mov rcx, r13
call sym.__rust_dealloc
mov rcx, qword [rsp + 0x48]
call sub.kernel32.dll_LocalFree
mov rdx, qword [rsp + 0x170]
test rdx, rdx
je 0x140022168
mov rcx, qword [rsp + 0x168]
mov r8d, 1
call sym.__rust_dealloc
test r12, r12
je 0x140022187
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x118], r12
jmp 0x14002219e
mov qword [rsp + 0x118], 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
lea r15, [rsp + 0x168]
mov r8d, 0x20a
mov rcx, r15
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rsi
xor edx, edx
mov r8, r15
mov r9d, 0x105
call sub.psapi.dll_GetModuleFileNameExW
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0x168]
mov r8d, 0x105
call sym.sysinfo::windows::process::null_terminated_wchar_to_string::h07a17d9979366ce5
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x38]
call dbg.from_string
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x79]
mov dword [rsp + 0x90], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x93], eax
test r13, r13
mov qword [rsp + 0x108], r12
je 0x140022267
js 0x14002267d
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov edx, 1
mov rcx, r13
call sym.__rust_alloc
mov r15, rax
test rax, rax
jne 0x14002226d
mov ecx, 1
mov rdx, r13
call dbg.handle_alloc_error
jmp 0x140022689
mov r15d, 1
mov rcx, r15
mov rdx, qword [rsp + 0x58]
mov r8, r13
call sym.memcpy
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
movzx eax, byte [rsp + 0x37]
mov byte [rsp + 0x50], al
lea rcx, [rsp + 0x38]
call sym.std::path::PathBuf::pop::ha7eed44679798629
lea rbp, [rsp + 0x168]
lea rdx, [rsp + 0x138]
mov rcx, rbp
call sym.sysinfo::windows::process::get_process_params::h170190925aa4cc22
cmp byte [rsp + 0x1b0], 2
mov qword [rsp + 0x130], r14
jne 0x140022384
mov qword [rsp + 0xb0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xd0], 8
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xf0], 1
movups xmmword [rsp + 0xf8], xmm0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0xf0]
call dbg.from_string
mov rsi, rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x140], xmm0
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0xf0], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x70], rax
jmp 0x1400223f1
mov rsi, rbx
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x168]
movaps xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rsp + 0x180]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x98], rax
movups xmm0, xmmword [rsp + 0x1a8]
movaps xmmword [rsp + 0x140], xmm0
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xe0], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x168], 0
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x60]
mov r14, qword [rsp + 0x88]
mov rcx, r14
mov r8, rbp
mov r9, rbp
call sub.kernel32.dll_GetProcessTimes
movabs rax, 0xd6bf94d5e57a42bd
mul qword [rsp + 0x60]
shr rdx, 0x17
movabs rbp, 0xfffffffd49ef6f00
add rbp, rdx
xor ebx, ebx
cmp rbp, rsi
cmovbe rbx, rbp
xor r15d, r15d
cmp qword [rsp + 0x110], 0
setne r12b
lea rcx, [rsp + 0x168]
mov rdx, r14
mov r8d, dword [rsp + 0xac]
call sym.sysinfo::windows::process::get_process_user_id::h0be0fafad8a0e3ba
mov rax, qword [str.Qp__]
movzx eax, byte [rax]
mov ecx, 0x18
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x14002266c
sub rsi, rbx
mov r15b, r12b
mov qword [rax], 1
mov qword [rax + 8], 1
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x128]
mov qword [rdi + 0x88], rcx
movups xmm0, xmmword [rsp + 0x118]
movups xmmword [rdi + 0x78], xmm0
mov rcx, qword [rsp + 0x178]
mov qword [rdi + 0xd8], rcx
movups xmm0, xmmword [rsp + 0x168]
movups xmmword [rdi + 0xc8], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [rdi + 0x90], xmm0
mov rcx, qword [rsp + 0xc0]
mov qword [rdi + 0xa0], rcx
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [rdi + 0xa8], xmm0
mov rcx, qword [rsp + 0xe0]
mov qword [rdi + 0xb8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rdi + 0x18], rcx
mov rcx, qword [rsp + 0x108]
mov qword [rdi + 0x20], rcx
mov qword [rdi + 0x28], r13
movzx ecx, byte [rsp + 0x37]
mov byte [rdi + 0x30], cl
mov ecx, dword [rsp + 0x90]
mov edx, dword [rsp + 0x93]
mov dword [rdi + 0x31], ecx
mov dword [rdi + 0x34], edx
mov rcx, qword [rsp + 0xa0]
mov qword [rdi + 0x38], rcx
mov rcx, qword [rsp + 0x98]
mov qword [rdi + 0x40], rcx
movaps xmm0, xmmword [rsp + 0x150]
movups xmmword [rdi + 0x48], xmm0
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x68], xmm1
movups xmmword [rdi + 0x58], xmm0
xorps xmm0, xmm0
movups xmmword [rdi + 0xf8], xmm0
movups xmmword [rdi + 0x108], xmm0
mov qword [rdi], r15
mov rcx, qword [rsp + 0x110]
mov qword [rdi + 8], rcx
mov dword [rdi + 0x10], 1
mov rcx, qword [rsp + 0x130]
mov qword [rdi + 0xc0], rcx
movups xmmword [rdi + 0xe0], xmm0
mov qword [rdi + 0xf0], rax
mov qword [rdi + 0x118], rbp
mov qword [rdi + 0x120], rsi
movups xmmword [rdi + 0x138], xmm0
movups xmmword [rdi + 0x128], xmm0
mov dword [rdi + 0x148], 0
mov byte [rdi + 0x14c], 1
mov rax, rdi
add rsp, 0x3a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x18
call dbg.handle_alloc_error
jmp 0x140022689
call dbg.capacity_overflow
jmp 0x140022689
call dbg.capacity_overflow
ud2