Function at 0x1401c2ac0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rax - 0x47]
sub rsp, 0xb0
xor r14d, r14d
lea r9, [0x1403f553c]
mov qword [rsp + 0x30], r14
mov rdi, r8
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbp + 0x77]
lea r8d, [r14 + 1]
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x51], r14
call fcn.1401836fc
mov ebx, eax
test eax, eax
jns 0x1401c2b2f
mov ecx, eax
call fcn.140082a8c
jmp 0x1401c2d39
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x5d]
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
js 0x1401c2b23
mov r12d, r14d
cmp dword [rbp - 0x5d], r14d
jbe 0x1401c2d26
mov rax, qword [rdi]
mov rbx, qword [rax + 0x20]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x49]
mov edx, r12d
mov rcx, rdi
call rax
mov ebx, eax
test eax, eax
js 0x1401c2b23
cmp dword [rbp + 0x6f], 0
mov esi, r14d
mov rdx, qword [rbp - 0x49]
mov r13, rdx
mov dword [rbp - 0x61], reloc.OLEAUT32.dll_SafeArrayGetElement
jbe 0x1401c2ce0
mov rdi, qword [rbp + 0x67]
mov rcx, qword [rdi]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1401c2bd0
inc r14d
add rdi, 0x18
cmp r14d, dword [rbp + 0x6f]
jae 0x1401c2ce0
mov rdx, qword [rbp - 0x49]
jmp 0x1401c2bac
mov eax, dword [rdi + 0x14]
xor r14d, r14d
cmp qword [rdi + 8], r14
mov dword [rbp - 0x61], eax
cmovne r13, qword [rdi + 8]
cmp dword [rdi + 0x10], r14d
je 0x1401c2bf3
cmp qword [rbp + 0x7f], r14
lea ecx, [r14 + 1]
cmovne esi, ecx
cmp eax, 0xffffffff
je 0x1401c2d14
test esi, esi
je 0x1401c2ce3
cmp qword [rbp + 0x7f], r14
je 0x1401c2ce3
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x1401c2c37
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov qword [rbp - 0x59], r14
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x1401c2c60
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov qword [rbp - 0x51], r14
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x59]
call fcn.140082960
mov ebx, eax
test eax, eax
js 0x1401c2b23
mov rcx, qword [rbp - 0x31]
lea rdx, [rbp - 0x51]
call fcn.140082960
mov ebx, eax
test eax, eax
js 0x1401c2b23
mov ecx, dword [rbp - 0x3d]
test ecx, ecx
je 0x1401c2caf
mov rax, qword [rbp - 0x39]
lea rdx, [rbp - 9]
mov dword [rbp - 1], ecx
mov rcx, qword [rbp - 0x59]
mov qword [rbp - 9], rax
call fcn.1400ca8d4
jmp 0x1401c2cb2
mov eax, r14d
lea r8, [rbp - 0x59]
mov edx, eax
lea rcx, [rbp - 0x41]
call fcn.14016e584
mov ebx, eax
test eax, eax
jns 0x1401c2cce
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
jns 0x1401c2ce3
mov ecx, ebx
jmp 0x1401c2b25
xor r14d, r14d
mov rax, qword [rbp - 0x31]
mov r9, r13
mov r8d, dword [rbp - 0x61]
mov rdx, qword [rbp + 0x77]
mov rcx, qword [rbp + 0x4f]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1401836fc
mov ebx, eax
test eax, eax
js 0x1401c2b23
inc r12d
cmp r12d, dword [rbp - 0x5d]
jae 0x1401c2d26
mov rdi, qword [rbp + 0x5f]
jmp 0x1401c2b61
cmp qword [rbp + 0x7f], r14
je 0x1401c2d39
mov rdx, qword [rbp + 0x7f]
lea rcx, [rbp - 0x41]
call fcn.14016cd30
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x19], 0
lea rax, [0x14003155c]
mov r14d, 3
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x59]
mov qword [rbp - 0x29], r14
mov edi, 0xb9
mov qword [rbp - 0x11], rax
xor r9d, r9d
lea rdx, [rbp - 0x29]
lea esi, [r14 + 0x1d]
mov ecx, edi
mov r8d, esi
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x19], 0
lea rax, [0x14002ee5c]
mov qword [rbp - 0x21], rax
lea rdx, [rbp - 0x29]
lea rax, [rbp - 0x41]
mov qword [rbp - 0x29], r14
xor r9d, r9d
mov qword [rbp - 0x11], rax
mov r8d, esi
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
add rsp, 0xb0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret