Function at 0x140170d64
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor r14d, r14d
mov r12, r9
mov qword [rbp - 0x38], r14
mov r13d, r8d
mov qword [rbp - 0x40], r14
mov edi, r14d
mov ebx, r14d
mov esi, r14d
cmp r8d, 0xffffffff
jne 0x140170dae
lea r14d, [rsi + 1]
jmp 0x140171116
or r15, 0xffffffffffffffff
inc r15
cmp word [r9 + r15*2], r14w
jne 0x140170db2
mov eax, r15d
mov ecx, 0x80070216
cmp r15, rax
je 0x140170dd7
mov r14d, ecx
call fcn.140078308
mov r15d, dword [rbp + 0x50]
jmp 0x140170dde
xor ecx, ecx
call fcn.140078324
mov ecx, r14d
call fcn.140078324
test r14d, r14d
jns 0x140170df8
mov ecx, r14d
call fcn.140078308
jmp 0x140171116
test r15d, r15d
je 0x140170e1a
test r13b, 8
je 0x140170e1a
lea rdx, [rbp - 0x40]
mov rcx, r12
call fcn.140171ffc
mov r14d, eax
test eax, eax
jns 0x140170e28
mov ecx, eax
jmp 0x140170dee
lea rdx, [rbp - 0x40]
mov rcx, r12
call fcn.1400781e4
jmp 0x140170e0f
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor r14d, r14d
mov rdi, rax
test rax, rax
jne 0x140170e4a
mov edi, r14d
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140170dee
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x140170e79
lea r14, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140078324
xor r14d, r14d
mov qword [rbp - 0x40], r14
mov r12, qword [rbp + 0x60]
test r12, r12
jne 0x140170ed6
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x50]
lea rcx, [0x1403a8ac8]
call fcn.140077f90
mov r14d, eax
test eax, eax
js 0x140170eb9
lea rcx, [0x1403a8ac8]
mov edx, dword [rbp + 0x50]
lea r8, [rbp - 0x40]
call fcn.1400780c4
mov r14d, eax
test eax, eax
jns 0x140170ec0
mov ecx, eax
call fcn.140078308
mov ecx, r14d
call fcn.140078324
test r14d, r14d
jns 0x140170f75
jmp 0x140170deb
test r13b, 4
je 0x140170f0c
mov rax, qword [rbp + 0x40]
cmp dword [rax + 4], r14d
jne 0x140170f0c
mov r8d, 0x7fffffff
lea rdx, [rbp + 0x50]
lea rcx, str._exc_
call fcn.140077f90
mov r14d, eax
test eax, eax
js 0x140170eb9
lea rcx, str._exc_
jmp 0x140170ea6
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r12 + rcx*2], r14w
jne 0x140170f10
mov eax, ecx
mov qword [rbp - 0x30], rcx
cmp rcx, rax
je 0x140170f34
mov ecx, 0x80070216
mov r14d, ecx
call fcn.140078308
jmp 0x140170f3f
xor ecx, ecx
call fcn.140078324
mov r15, qword [rbp - 0x30]
mov ecx, r14d
call fcn.140078324
test r14d, r14d
js 0x140170deb
test r15d, r15d
je 0x140170f79
test r13b, 0x10
je 0x140170f79
lea r8, [rbp - 0x40]
mov edx, r15d
mov rcx, r12
call fcn.1401572e8
mov r14d, eax
test eax, eax
js 0x140170e16
mov r12, qword [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rbx, rax
test rax, rax
jne 0x140170f93
mov ebx, ecx
jmp 0x140170e40
mov r12, qword [rbp + 0x68]
test r12, r12
je 0x140170fbc
test r13b, 0x40
jne 0x140170fbc
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov rsi, rax
test rax, rax
jne 0x140170fbc
mov esi, ecx
jmp 0x140170e40
test r13b, 1
je 0x140171031
mov r15, qword [rbp + 0x40]
mov r9, rbx
mov rdx, qword [rbp + 0x48]
mov r8, rdi
mov rcx, qword [r15 + 0x18]
call fcn.1401584f8
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140170deb
test r12, r12
je 0x14017101f
test r13b, 0x40
jne 0x14017101f
cmp dword [0x140422f18], 1
mov r8d, eax
mov rdx, qword [rbp + 0x48]
mov r9, rsi
cmove r8, qword [0x1404224a0]
mov rcx, qword [r15 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140170e16
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp - 0x38]
call fcn.1400753a4
jmp 0x140171104
mov rax, qword [rbp + 0x40]
test r13b, 2
je 0x1401711c1
mov r15, qword [rax + 0x18]
mov rax, qword [r15]
mov r14, qword [rax + 0x178]
mov rcx, r14
call qword [0x1403a2250]
lea r8, [rbp - 0x38]
mov rdx, rdi
mov rcx, r15
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140170deb
mov r15, qword [rbp + 0x40]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [r15 + 0x18]
test r13b, 0x20
je 0x140171243
mov r8, rbx
call fcn.140172148
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140170deb
test r12, r12
je 0x1401710d5
test r13b, 0x40
jne 0x1401710d5
cmp dword [0x140422f18], 1
mov r8d, eax
mov rdx, qword [rbp - 0x38]
mov r9, rsi
cmove r8, qword [0x1404224a0]
mov rcx, qword [r15 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140170e16
mov r15, qword [rbp + 0x48]
mov rax, qword [r15]
mov r14, qword [rax + 0xa8]
mov rcx, r14
call qword [0x1403a2250]
mov rdx, qword [rbp - 0x38]
xor r8d, r8d
mov rcx, r15
call r14
mov r14d, eax
test eax, eax
js 0x140170e16
mov rdx, qword [rbp + 0x70]
test rdx, rdx
je 0x140171116
mov rcx, qword [rbp - 0x38]
call fcn.1400753a4
mov ecx, r14d
call fcn.140078324
test rsi, rsi
je 0x14017112c
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
test rbx, rbx
je 0x14017113c
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x14017114a
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x140171172
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140078324
xor r9d, r9d
mov qword [rbp - 0x28], 3
lea rax, [0x140033aa0]
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
lea rax, [rbp - 0x38]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 0x10], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rsp + 0xb8]
mov eax, r14d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, qword [rax + 0x18]
mov r15, rcx
cmp dword [0x140422f18], 1
cmove r15, qword [0x140422488]
mov rax, qword [r12]
mov r14, qword [rax + 0x178]
mov rcx, r14
call qword [0x1403a2250]
lea r8, [rbp - 0x38]
mov rdx, r15
mov rcx, r12
call r14
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140170deb
cmp dword [0x140422f18], 1
mov r8d, eax
mov r15, qword [rbp + 0x40]
mov r9, rdi
cmove r8, qword [0x140422490]
mov rdx, qword [rbp - 0x38]
mov rcx, qword [r15 + 0x18]
call fcn.1401584f8
mov r14d, eax
xor eax, eax
test r14d, r14d
js 0x140170deb
mov r12, qword [rbp + 0x68]
jmp 0x140171075
cmp dword [0x140422f18], 1
mov r8, rax
mov r9, rbx
cmove r8, qword [0x140422498]
call fcn.1401584f8
jmp 0x14017108f