Function at 0x1401ba490
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov byte [rsp + 8], cl
sub rsp, 0x158
movabs rax, 0x7df634512a374d
mov qword [rsp + 0x70], rax
movzx eax, byte [rsp + 0x170]
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xc0], rax
movabs rax, 0x753331a9b56db4
cmp qword [rsp + 0xc0], rax
je 0x1401ba5b9
movabs rax, 0x7df634512a374d
cmp qword [rsp + 0xc0], rax
je 0x1401ba512
jmp 0x1401ba5c7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xe0], rax
movabs rax, 0x7df634512a374d
cmp qword [rsp + 0xe0], rax
je 0x1401ba546
jmp 0x1401ba5a1
movzx eax, byte [rsp + 0x170]
movzx ecx, byte [rsp + 0x40]
add eax, ecx
movzx ecx, byte [rsp + 0x168]
movzx edx, byte [rsp + 0x160]
sub ecx, edx
cmp eax, ecx
jne 0x1401ba59f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x100], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov dword [rsp + 0x68], 0xfb5a
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
jmp 0x1401ba5b7
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x40]
and eax, ecx
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
jmp 0x1401ba5c7
mov rcx, qword [rsp + 0x88]
call fcn.1401b9aa0
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [section..data]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 0xffffbbe4
je 0x1401ba609
cmp dword [rsp + 0x80], 0x3233
je 0x1401ba6a8
jmp 0x1401ba6be
lea rax, [rsp + 0x48]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
movzx ecx, al
mov eax, dword [rsp + 0x48]
sar eax, cl
cmp eax, dword [section..data]
jle 0x1401ba68f
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x50], rax
mov eax, MakeDragList
mov word [rsp + 0x44], ax
mov byte [rsp + 0x41], 0x50
lea rax, [rsp + 0x41]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 5
xor r9d, r9d
mov r8d, 8
mov edx, 0x40000000
lea rcx, str.C:ObsessingJargonsConstabulariesOceanography
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x108], rax
jmp 0x1401ba6a6
mov edx, 0xe8
mov ecx, 0xe7
call qword [sym.imp.ole32.dll_CoCancelCall]
mov dword [rsp + 0xb4], eax
jmp 0x1401ba6be
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x168]
xor eax, ecx
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x84], al
cmp byte [rsp + 0x84], 0x41
je 0x1401baa3f
cmp byte [rsp + 0x84], 0x50
je 0x1401ba6e7
jmp 0x1401bab3c
cmp dword [rsp + 0x68], 0x3c4f
jae 0x1401ba7c6
movsx eax, word [rsp + 0x44]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x583
je 0x1401ba710
jmp 0x1401ba74c
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
lea r9, [rsp + 0x44]
mov r8d, 0xa0
mov edx, 0x8a
mov rcx, qword [rsp + 0x110]
call sub.WINSPOOL.DRV_FindFirstPrinterChangeNotification
mov qword [rsp + 0x118], rax
jmp 0x1401ba7b2
movabs rax, 0x75105f77f683a0
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x70]
jbe 0x1401ba79c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x178], rax
movzx eax, word [rsp + 0x44]
mov word [rsp + 0x20], ax
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
call fcn.1401bb150
nop
movzx eax, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x160]
sub eax, ecx
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
movsx eax, word [rsp + 0x44]
sub eax, 0x728
mov word [rsp + 0x44], ax
jmp 0x1401ba98f
movsx eax, word [rsp + 0x44]
cmp eax, 0xd6
jge 0x1401ba8a4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0xdc], eax
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0x6d
je 0x1401ba812
jmp 0x1401ba88f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xc8], rax
movabs rax, 0x76f0d1547dce55
cmp qword [rsp + 0xc8], rax
je 0x1401ba882
movabs rax, 0x7b58c8d732b875
cmp qword [rsp + 0xc8], rax
je 0x1401ba849
jmp 0x1401ba88f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x178], rax
mov rcx, qword [rsp + 0xe8]
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [rsp + 0xa4], eax
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
jmp 0x1401ba88f
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x178], rax
movzx edx, word [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
call fcn.1401b9400
nop
jmp 0x1401ba94b
mov rax, qword [rsp + 0x50]
shl rax, 0x11
cmp rax, qword [rsp + 0x178]
jl 0x1401ba932
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x160]
sar eax, cl
mov byte [rsp + 0x40], al
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax]
mov byte [rsp + 0x98], al
cmp byte [rsp + 0x98], 0x21
je 0x1401ba8e8
jmp 0x1401ba910
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
xor eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
movzx edx, word [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
call fcn.1401b9400
nop
jmp 0x1401ba932
mov eax, dword [rsp + 0x68]
or eax, 0xa3b
mov dword [rsp + 0x68], eax
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x48]
and ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
mov edx, 0x9d
mov rcx, qword [rsp + 0xe8]
call sub.WINSPOOL.DRV_ScheduleJob
mov dword [rsp + 0x9c], eax
mov r9, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
movzx r8d, byte [rax]
movzx edx, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x170]
call fcn.1401ba490
lea r9, [rsp + 0x40]
mov r8d, 0x1b
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xd0]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0x9c], eax
movabs rax, 0x7504aef2173fbb
mov rcx, qword [rsp + 0x88]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xf0], rax
movabs rax, 0x7c3fccc3fb15dc
cmp qword [rsp + 0xf0], rax
je 0x1401ba9d1
jmp 0x1401ba9e2
mov rax, qword [rsp + 0x78]
mov eax, dword [rax]
add eax, dword [section..data]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoIsHandlerConnected]
mov dword [rsp + 0xa0], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x178], rax
movsx eax, byte [rsp + 0x41]
sub eax, 0x12
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
lea r9, [rsp + 0xa0]
mov r8d, 0xea
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0xd0]
call sub.WINSPOOL.DRV_ReadPrinter
mov dword [rsp + 0xa4], eax
jmp 0x1401bab3c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x178], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 0x13d4
je 0x1401baa69
jmp 0x1401bab26
movzx eax, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x168]
sub eax, ecx
mov rcx, qword [rsp + 0x60]
movzx ecx, byte [rcx]
mov dword [rsp + 0xac], ecx
movzx edx, byte [rsp + 0x170]
movzx ecx, dl
mov edx, dword [rsp + 0xac]
shl edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x1401baad3
mov rax, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x48]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx], eax
call qword [sym.imp.ole32.dll_CoRevokeMallocSpy]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
and eax, 0x51
mov byte [rsp + 0x41], al
jmp 0x1401bab24
movzx eax, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x160]
or eax, ecx
movzx ecx, byte [rsp + 0x168]
mov dword [rsp + 0xb0], ecx
movzx edx, byte [rsp + 0x170]
movzx ecx, dl
mov edx, dword [rsp + 0xb0]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x1401bab24
mov edx, dword [rsp + 0xb4]
lea rcx, [rsp + 0x41]
call qword [sym.imp.ole32.dll_CoMarshalHresult]
mov dword [rsp + 0xb8], eax
jmp 0x1401bab3c
movzx eax, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x160]
add eax, ecx
mov rcx, qword [rsp + 0x60]
mov byte [rcx], al
mov r9, qword [rsp + 0x178]
movzx r8d, byte [rsp + 0x40]
movzx edx, byte [rsp + 0x40]
mov rax, qword [rsp + 0x60]
movzx ecx, byte [rax]
call fcn.1401ba490
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
sub eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
add eax, 0x47
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
movzx ecx, byte [rcx]
and eax, ecx
movzx ecx, byte [rsp + 0x160]
movzx edx, byte [rsp + 0x170]
add ecx, edx
cmp eax, ecx
je 0x1401bac17
lea rax, [rsp + 0x41]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0xae
lea rax, [rsp + 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0xea
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ole32.dll_CoGetInstanceFromIStorage]
mov dword [rsp + 0xd8], eax
movabs rax, 0x71d2b5788bb928
mov rcx, qword [rsp + 0x178]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x41]
add eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
mov eax, dword [section..data]
add rsp, 0x158
ret