Function at 0x1401aa2bc
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword [rbp + 0x90]
xor esi, esi
mov r13, qword [rbp + 0x80]
mov r14, rcx
mov r12, qword [rbp + 0x88]
mov ebx, esi
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x58], rdx
lea r8d, [rsi + 0x48]
mov qword [rbp - 0x70], rcx
xor edx, edx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x58], r9
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
call sub.msvcrt.dll_memset
mov rax, qword gs:[0x58]
lea edi, [rsi + 1]
mov edx, 4
or r15, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x10], rsi
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1404232a4], eax
jg 0x1401aa730
mov rax, qword [r13]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [0x1403a2250]
lea r9, [rsp + 0x50]
mov rcx, r13
lea r8, [rsp + 0x48]
lea rdx, str.windowsComponentEditionPkeyId
call rdi
mov edi, eax
test eax, eax
jns 0x1401aa3a4
mov ecx, eax
call fcn.140078308
xor r13d, r13d
jmp 0x1401aa62f
cmp dword [rsp + 0x50], 1
mov r14, qword [r14 + 0x18]
mov rax, qword [r14]
mov rdi, qword [rax + 0x178]
mov rcx, rdi
jne 0x1401aa3eb
cmp dword [0x140423530], 1
cmove rsi, qword [0x1404229f8]
call qword [0x1403a2250]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r14
call rdi
mov edi, eax
test eax, eax
js 0x1401aa395
mov esi, 1
jmp 0x1401aa415
cmp dword [0x140423530], 1
cmove rsi, qword [0x140422a28]
call qword [0x1403a2250]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r14
call rdi
mov edi, eax
test eax, eax
js 0x1401aa395
xor esi, esi
mov rax, qword [rsp + 0x40]
lea rcx, [rbp - 0x80]
mov r14, qword [rbp - 0x70]
lea r9, [0x1404232b0]
mov rdx, qword [rsp + 0x58]
mov r8, r13
mov qword [rsp + 0x30], rcx
mov rcx, r14
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call fcn.1401abe84
xor r13d, r13d
mov edi, eax
test eax, eax
js 0x1401aa628
test r12, r12
je 0x1401aa4aa
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x1401aa47d
mov ebx, r13d
mov edi, 0x8007000e
mov ecx, edi
jmp 0x1401aa62a
cmp dword [0x140423530], 1
mov r8, r13
mov rdx, qword [rsp + 0x40]
mov r9, rax
cmove r8, qword [0x1404229e8]
mov rcx, qword [r14 + 0x18]
call fcn.1401584f8
mov edi, eax
test eax, eax
js 0x1401aa628
test esi, esi
je 0x1401aa5fe
mov r9, qword [rsp + 0x48]
mov rcx, r14
mov r8, qword [rsp + 0x40]
mov rdx, qword [r14 + 0x10]
mov r9, qword [r9]
call fcn.1401abd34
mov edi, eax
test eax, eax
js 0x1401aa628
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rax, r15
inc rax
cmp word [rcx + rax*2], r13w
jne 0x1401aa4e0
mov esi, 0x80070057
cmp rax, 0x26
jne 0x1401aa519
cmp word [rcx], 0x7b
jne 0x1401aa51f
cmp word [rcx + 0x4a], 0x7d
jne 0x1401aa51f
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.14006dc40
mov edi, eax
test eax, eax
jns 0x1401aa528
mov ecx, eax
jmp 0x1401aa523
cmp rax, 0x24
je 0x1401aa506
mov edi, esi
mov ecx, esi
call fcn.140078308
mov ecx, edi
call fcn.140078324
test edi, edi
js 0x1401aa476
lea r8, [rsp + 0x58]
lea rdx, str.windowsComponentEditionSkuId
lea rcx, [rbp - 0x80]
call fcn.1400b5fdc
test al, al
je 0x1401aa5ad
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
inc r15
cmp word [rcx + r15*2], r13w
jne 0x1401aa561
cmp r15, 0x26
jne 0x1401aa595
cmp word [rcx], 0x7b
jne 0x1401aa59b
cmp word [rcx + 0x4a], 0x7d
jne 0x1401aa59b
add rcx, 2
lea rdx, [rbp - 0x40]
call fcn.14006dc40
mov edx, eax
test eax, eax
jns 0x1401aa5a4
mov ecx, eax
jmp 0x1401aa59f
cmp r15, 0x24
je 0x1401aa582
mov edx, esi
mov ecx, esi
call fcn.140078308
mov ecx, edx
call fcn.140078324
jmp 0x1401aa5b9
movups xmm0, xmmword [0x1403c56c0]
movdqu xmmword [rbp - 0x40], xmm0
cmp dword [0x140423530], 1
mov r8, r13
mov rdx, qword [rsp + 0x40]
mov r9d, 1
cmove r8, qword [0x140422a00]
mov rcx, qword [r14 + 0x18]
call fcn.1401750e8
mov edi, eax
test eax, eax
js 0x1401aa628
mov rcx, qword [rbp - 0x68]
lea rdx, [rbp - 0x50]
call fcn.140175278
mov edi, eax
test eax, eax
js 0x1401aa628
mov rsi, qword [rbp - 0x60]
jmp 0x1401aa602
mov rsi, qword [rbp - 0x58]
mov rax, qword [rsi]
mov rdi, qword [rax + 0xa8]
mov rcx, rdi
call qword [0x1403a2250]
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rsi
call rdi
mov edi, eax
test eax, eax
jns 0x1401aa62f
mov ecx, eax
call fcn.140078308
mov ecx, edi
call fcn.140078324
mov r15d, 3
mov qword [rsp + 0x70], r13
lea rax, [0x1400058e0]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov r14d, 0xb9
lea esi, [r15 + 0x1d]
mov qword [rsp + 0x78], rax
mov r8d, esi
xor r9d, r9d
mov ecx, r14d
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14003a920]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], r13
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, esi
mov ecx, r14d
call sub.ntdll.dll_NtQuerySystemInformation
test rbx, rbx
je 0x1401aa6b8
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1401aa6db
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x48], r13
lea rax, [0x140033aa0]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], r13
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, rsi
mov rcx, r14
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14035a4e0
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x1404232a4]
call fcn.14035aa48
cmp dword [0x1404232a4], r15d
jne 0x1401aa368
xor eax, eax
mov qword [0x1404232b8], rsi
mov qword [0x1404232c0], rax
lea rcx, [0x1404232a4]
lea rax, str.metaInfoType
mov dword [0x1404232c0], esi
mov qword [0x1404232b0], rax
xor eax, eax
mov qword [0x1404232d8], rax
lea rax, str.windowsComponentEditionPkeyId
mov qword [0x1404232c8], rax
lea rax, str.pkeyId
mov qword [0x1404232d0], rax
xor eax, eax
mov qword [0x1404232f0], rax
lea rax, str.windowsComponentEditionSkuId
mov qword [0x1404232e0], rax
lea rax, str.skuId
mov qword [0x1404232e8], rax
mov dword [0x1404232c4], r15d
mov dword [0x1404232d8], edi
mov dword [0x1404232dc], edi
mov dword [0x1404232f0], edi
mov dword [0x1404232f4], edi
call fcn.14035a9e8
jmp 0x1401aa368