Function at 0x1400064f0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov r12, rcx
mov rax, qword [0x140031ef8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov dword [rsp + 0x34], 0x3b2bed7a
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x60]
lea rax, [rsp + 0xac]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [0x140031c90]
mov rcx, qword [0x140031c98]
lea rdx, [rcx - 0x47139c43]
mov qword [rsp + 0xe0], rdx
movzx edx, byte [0x140032b2a]
mov dword [rsp + 0x38], edx
mov edi, 0xfbb63b77
mov r8d, 0xcccccccd
mov r9d, 0x6a16d5fe
mov ebx, 0x18d633fa
jmp 0x1400065b6
je 0x14000665c
cmp edi, 0x18d633fa
jl 0x1400065e0
cmp edi, 0x6a16d5fe
jge 0x1400065b0
cmp edi, 0x18d633fa
jne 0x1400065b6
jmp 0x14000666d
cmp edi, 0xfbb63b77
jge 0x140006640
cmp edi, 0xeed8f2f4
jne 0x1400065b6
mov rdi, qword [rsp + 0xe0]
movsxd rbp, esi
mov edx, ebp
imul rdx, r8
shr rdx, 0x24
shl edx, 2
lea edx, [rdx + rdx*4]
mov esi, ebp
sub esi, edx
movzx edx, byte [rcx + rsi - 0x47139c57]
xor dl, byte [rdi + rbp]
mov byte [rax + rbp - 0x47139c6c], dl
lea esi, [rbp + 1]
cmp esi, 0xa
mov edi, 0xeed8f2f4
cmove edi, r9d
jmp 0x1400065b6
jne 0x1400065b6
mov edi, dword [rsp + 0x38]
cmp edi, 1
mov edi, 0xeed8f2f4
cmove edi, ebx
xor esi, esi
jmp 0x1400065b6
mov byte [0x140032b2a], 1
mov edi, 0x18d633fa
jmp 0x1400065b6
mov rcx, 0xffffffffb8ec6394
add rcx, qword [0x140031c90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
lea rax, [rsp + 0xa4]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rax, qword [0x140031ca0]
mov rcx, qword [0x140031c98]
lea rdx, [rcx - 0x47139bb9]
mov qword [rsp + 0xe0], rdx
movzx edx, byte [0x140032b5c]
mov dword [rsp + 0x38], edx
mov esi, 0xc9a5a4ea
mov r8d, 0x9aead88f
mov r9d, 0xaf0711ce
jmp 0x140006706
je 0x14000679d
cmp esi, 0xc754a2a4
jae 0x140006720
cmp esi, 0xaf0711ce
jb 0x140006780
jne 0x140006706
jmp 0x1400067b4
cmp esi, 0xc9a5a4ea
jae 0x140006700
cmp esi, 0xc754a2a4
jne 0x140006706
mov rsi, qword [rsp + 0xe0]
movsxd rbp, ebx
mov edx, ebp
imul rdx, rdx, 0x8421085
shr rdx, 0x20
mov ebx, ebp
sub ebx, edx
shr ebx, 1
add ebx, edx
shr ebx, 4
mov edx, ebx
shl edx, 5
sub ebx, edx
add ebx, ebp
movzx edx, byte [rcx + rbx - 0x47139bd8]
xor dl, byte [rsi + rbp]
mov byte [rax + rbp - 0x47139c6c], dl
lea ebx, [rbp + 1]
cmp ebx, 0x17
mov esi, 0xc754a2a4
cmove esi, r8d
jmp 0x140006706
cmp esi, 0x9aead88f
jne 0x140006706
mov byte [0x140032b5c], 1
mov esi, 0xaf0711ce
jmp 0x140006706
mov ebx, dword [rsp + 0x38]
cmp ebx, 1
mov esi, 0xc754a2a4
cmove esi, r9d
xor ebx, ebx
jmp 0x140006706
mov rdx, 0xffffffffb8ec6394
add rdx, qword [0x140031ca0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0xa4]
lea rdx, [rsp + 0xa0]
lea r8, [rsp + 0x9c]
call rax
movzx r9d, word [rsp + 0x9c]
mov dword [rsp + 0x9c], r9d
mov r8d, dword [rsp + 0xa0]
mov edx, dword [rsp + 0xa4]
mov rax, qword [0x140031ca8]
mov rcx, qword [0x140031c98]
lea rbp, [rcx - 0x47139b7a]
mov qword [rsp + 0xe0], rbp
movzx ebp, byte [0x140032b73]
mov dword [rsp + 0x38], ebp
mov ebp, 0x5f51f8ba
mov r10d, 0xaaaaaaab
mov r11d, 0x2c8e05b1
mov r14d, 0x2a46ce7d
jmp 0x140006856
je 0x1400068de
cmp ebp, 0x2c8e05b1
jge 0x140006870
cmp ebp, 0x2a46ce7d
jl 0x140006890
jne 0x140006856
jmp 0x1400068f5
cmp ebp, 0x5f51f8ba
jge 0x140006850
cmp ebp, 0x2c8e05b1
jne 0x140006856
mov byte [0x140032b73], 1
mov ebp, 0x2a46ce7d
jmp 0x140006856
cmp ebp, 0xde7b0ef1
jne 0x140006856
mov rbp, qword [rsp + 0xe0]
movsxd rdi, ebx
mov esi, edi
imul rsi, r10
shr rsi, 0x24
shl esi, 3
lea esi, [rsi + rsi*2]
mov ebx, edi
sub ebx, esi
movzx ebx, byte [rcx + rbx - 0x47139b92]
xor bl, byte [rbp + rdi]
mov byte [rax + rdi - 0x47139c6c], bl
lea ebx, [rdi + 1]
cmp ebx, 0x16
mov ebp, 0xde7b0ef1
cmove ebp, r11d
jmp 0x140006856
mov ebx, dword [rsp + 0x38]
cmp ebx, 1
mov ebp, 0xde7b0ef1
cmove ebp, r14d
xor ebx, ebx
jmp 0x140006856
mov rcx, 0xffffffffb8ec6394
add rcx, qword [0x140031ca8]
call fcn.140002c80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [rsp + 0xb0]
mov word [rsp + 0xe8], ax
mov eax, dword [rsp + 0xdc]
mov dword [rsp + 0xea], eax
mov al, byte [rsp + 0xd0]
mov byte [rsp + 0xee], al
mov byte [rsp + 0xef], 1
mov eax, dword [rsp + 0xa4]
mov dword [rsp + 0xf0], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0xf4], eax
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0xf8], eax
mov dword [rsp + 0xfc], 2
mov qword [rsp + 0x90], r12
lea rax, [r12 + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
add eax, 0x38
mov dword [rsp + 0x100], eax
mov dword [rsp + 0x104], 0x10
lea rax, [rsp + 0x108]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rax], 0
mov qword [rsp + 0x110], 0
xor r15d, r15d
mov ecx, 0xb128c810
mov rbx, 0xffffffff96003a7c
mov r14d, 0x10
jmp 0x140006a17
cmp ecx, 0x11349dfb
mov eax, 0x68
mov edx, 0x20
cmovl rax, rdx
mov r10d, 3
mov edx, 0xf
cmove r10, rdx
mov rdx, qword [0x140031cb0]
mov rbp, qword [rdx + rax - 0x47139c6c]
add rbp, rbx
xor esi, esi
cmp ecx, 0x163250c5
setg sil
shl rsi, 4
or rsi, 1
cmp ecx, 0x28ebcff5
mov r11d, 0
mov eax, 0xa
cmovl r11, rax
mov r8d, 5
cmove r8, r14
xor eax, eax
cmp ecx, 0x163250c6
sete al
xor edi, edi
cmp ecx, 0xc0ece0db
setg dil
xor r12d, r12d
cmp ecx, 0xc0ece0dc
sete r12b
xor r13d, r13d
cmp ecx, 0xb128c810
lea r9, [rax + rax*4 + 9]
lea rcx, [rdi + rdi*4 + 2]
lea r12, [r12 + r12*4 + 6]
sete r13b
lea rdi, [r13*4 + 8]
jmp 0x140006add
jmp rbp