Function at 0x14001e9a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov r15, r9
mov r12, r8
mov rsi, rdx
mov rdi, rcx
movaps xmm0, xmmword [rsp + 0x160]
movaps xmm1, xmmword [rsp + 0x150]
movaps xmm2, xmmword [rsp + 0x140]
movups xmmword [rsp + 0xb0], xmm2
movups xmmword [rsp + 0xc0], xmm1
movups xmmword [rsp + 0xd0], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x88], 0
mov word [rsp + 0x98], 0
lea rcx, [rsp + 0xa0]
lea rbx, [rsp + 0x40]
mov rdx, rbx
call fcn.140001140
mov r13, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
cmp r13, 3
jne 0x14001eafe
mov qword [rsp + 0x38], r14
mov r13, qword [rsi]
mov r14, qword [rsi + 0x10]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r15
mov eax, dword [0x1400f92c4]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x98]
test rax, rax
je 0x14001ebc1
add rax, 0x110
jmp 0x14001ebc6
movzx eax, byte [0x1400f92c0]
mov rcx, qword [0x1400f91f8]
test rcx, rcx
jne 0x14001eb2a
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14001ecfe
mov rcx, rax
mov qword [0x1400f91f8], rax
mov r8d, 0x10
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x14001ecfe
mov qword [rax], r13
mov qword [rax + 8], r14
mov qword [rdi], rax
lea rax, [0x1400b28e8]
mov qword [rdi + 8], rax
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14001eb91
lea r14, [rdi + 8]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14001eb79
add r14, 0x20
dec rbx
je 0x14001eb91
cmp qword [r14], 0
je 0x14001eb70
mov r8, qword [r14 - 8]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call r15
jmp 0x14001eb70
cmp qword [rsi + 8], 0
je 0x14001ecea
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.kernel32.dll_HeapFree]
call fcn.1400685e0
mov rax, qword [rax]
mov r8, qword [rax + 0x210]
xor eax, eax
cmp r14, 0xffffffffffffffff
sete al
cmp rax, r8
cmova r8, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 1
mov rcx, r14
xor edx, edx
call fcn.140012fe0
mov rax, qword [0x1400f90f8]
mov qword [rdi + 8], rax
mov qword [rdi], 0
mov rdi, qword [rsp + 0x38]
lock dec qword [rdi + 0x1d8]
jne 0x14001ec79
mov rax, qword [rdi + 0x210]
test rax, rax
je 0x14001ec79
mov r14, qword [rdi + 0x200]
add rdi, 0x1e0
shl rax, 3
lea r15, [rax + rax*8]
xor r12d, r12d
xor ebx, ebx
jmp 0x14001ec5c
add r12, 0x48
inc rbx
cmp r15, r12
je 0x14001ec79
mov eax, 3
xchg qword [r14 + r12 + 0x30], rax
cmp rax, 2
jne 0x14001ec50
mov rcx, rdi
mov rdx, rbx
call fcn.140066fa0
jmp 0x14001ec50
mov rax, qword [rsp + 0x38]
lock dec qword [rax]
jne 0x14001ec8e
lea rcx, [rsp + 0x38]
call fcn.140067650
mov rdi, qword [rsi]
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x14001ecd1
lea r14, [rdi + 8]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14001ecb9
add r14, 0x20
dec rbx
je 0x14001ecd1
cmp qword [r14], 0
je 0x14001ecb0
mov r8, qword [r14 - 8]
mov rcx, qword [0x1400f91f8]
xor edx, edx
call r15
jmp 0x14001ecb0
cmp qword [rsi + 8], 0
je 0x14001ecea
mov rcx, qword [0x1400f91f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x10
call fcn.1400a9bd0
ud2