Function at 0x14001c188
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r14, rcx
xor esi, esi
cmp byte [rcx + 0xe1], sil
jne 0x14001c5dd
or r12, 0xffffffffffffffff
cmp byte [rcx + 0xe2], sil
je 0x14001c41f
cmp byte [rcx + 0xe0], sil
je 0x14001c326
lea r12d, [rsi + 1]
mov dword [rcx + 0xe0], 0x10000
mov rax, qword [rcx + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c603
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.140018bf0
mov dword [rbx + 0x60], esi
mov edx, esi
mov ecx, esi
lea rax, [0x140032a70]
cmp dword [rax + rcx*8], 2
je 0x14001c23b
inc edx
inc rcx
cmp edx, 4
jb 0x14001c21e
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c2aa
mov r13d, esi
lea rax, [rax + rcx*8]
add rax, 4
mov qword [rsp + 0xc8], rax
lea r15, [0x140032a90]
mov bl, byte [rax]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [case.0x14002394e.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [case.0x14002394e.0]
nop
inc r13d
mov rax, qword [rsp + 0xc8]
inc rax
mov qword [rsp + 0xc8], rax
lea r15, [r15 + 4]
cmp r13d, 3
jb 0x14001c255
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x60]
test eax, eax
je 0x14001c2c3
cmp eax, 5
jne 0x14001c2ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x4000
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x14001c2ef
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [r14 + 0x90]
test rcx, rcx
je 0x14001c310
call fcn.1400193f0
test eax, eax
js 0x14001c5fc
mov byte [r14 + 0xe3], 1
movabs rax, 0x7fffffffffffffff
mov qword [r14 + 0xd0], rax
jmp 0x14001c5d2
cmp byte [rcx + 0xe3], sil
je 0x14001c5d2
mov r12d, esi
mov word [rcx + 0xe0], 1
mov rax, qword [rcx + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c60f
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.140018bf0
mov dword [rbx + 0x60], esi
mov edx, esi
mov rcx, rsi
lea rax, [0x140032a70]
cmp dword [rax + rcx*8], 3
je 0x14001c38e
inc edx
inc rcx
cmp edx, 4
jb 0x14001c371
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c3fd
mov r13d, esi
lea rax, [rax + rcx*8]
add rax, 4
mov qword [rsp + 0xc8], rax
lea r15, [0x140032a90]
mov bl, byte [rax]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [case.0x14002394e.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [case.0x14002394e.0]
nop
inc r13d
mov rax, qword [rsp + 0xc8]
inc rax
mov qword [rsp + 0xc8], rax
lea r15, [r15 + 4]
cmp r13d, 3
jb 0x14001c3a8
mov rcx, qword [r14 + 0x90]
test rcx, rcx
je 0x14001c5d2
call fcn.1400194f0
test eax, eax
js 0x14001c608
jmp 0x14001c5d2
mov edx, 1
lea ecx, [rdx + 0x17]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_378]
mov rbx, rax
test rax, rax
je 0x14001c614
mov rax, qword [r14 + 8]
mov dword [rbx], 1
mov dword [rbx + 4], esi
mov qword [rbx + 8], rax
lea rdi, [rbx + 0x10]
mov qword [rdi], rsi
mov dword [rsp + 0x30], 0x20
mov eax, 0x7d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9, rbx
lea r8, [0x14001da70]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
test eax, eax
je 0x14001c482
mov qword [rdi], rsi
mov rdi, qword [r14 + 0xa0]
cmp rdi, rbx
je 0x14001c4d9
test rdi, rdi
je 0x14001c4d2
cmp qword [rdi + 0x10], rsi
je 0x14001c4c9
mov r15d, esi
mov r8, r12
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
test eax, eax
jne 0x14001c4bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14001c4c5
inc r15d
cmp r15d, 2
jl 0x14001c49c
mov qword [rdi + 0x10], rsi
mov rcx, rdi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1110]
mov qword [r14 + 0xa0], rbx
mov rcx, r14
call fcn.14001b414
mov ebx, eax
test eax, eax
js 0x14001c619
mov r12d, 1
mov dword [r14 + 0xe0], 0x10000
mov rax, qword [r14 + 0x98]
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x14001c661
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call fcn.140018bf0
mov dword [rbx + 0x60], esi
mov edx, esi
mov rcx, rsi
lea rax, [0x140032a70]
cmp dword [rax + rcx*8], 2
je 0x14001c54b
inc edx
inc rcx
cmp edx, 4
jb 0x14001c52e
mov ecx, 0x7d4122
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_154]
jmp 0x14001c5a0
lea r13, [rax + 4]
lea r13, [r13 + rcx*8]
lea r15, [0x140032a90]
mov bl, byte [r13]
mov edi, dword [r15]
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [case.0x14002394e.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], bl
xor r9d, r9d
mov r8d, edi
xor edx, edx
mov rcx, r10
call qword [case.0x14002394e.0]
nop
inc esi
inc r13
lea r15, [r15 + 4]
cmp esi, 3
jb 0x14001c55b
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x10]
call qword [case.0x14002394e.0]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x40]
mov byte [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, r10
call qword [case.0x14002394e.0]
nop
mov edx, r12d
mov rcx, r14
call fcn.14001b924
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, eax
call fcn.140007d7c
call fcn.140007698
mov ecx, eax
call fcn.140007d7c
call fcn.140007698
call fcn.14000185c
lea rax, str.HRESULT
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], ebx
mov word [rsp + 0x5c], si
lea rax, [0x140028ca8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.ScreenRecorder::App::RecorderToolbarDialog::OnRecordButtonClicked__StartRecording___
mov qword [rsp + 0x20], rax
mov ecx, 0x12dd2c2
call fcn.140009690
mov ecx, ebx
call fcn.140007d7c
call fcn.140007698
int3