Function at 0x1400016f0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rbp + 0xc8], rax
mov r13, rdx
mov qword [rbp - 0x70], rdx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov qword [rbp - 0x58], rdx
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rbp - 0x10]
mov qword [rsp + 0x48], rdi
mov r12, qword [rbp - 0x18]
mov qword [rsp + 0x40], r12
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
xor esi, esi
mov qword [rbp + 0x20], rsi
mov r14, qword [r13]
mov r13, qword [r13 + 8]
cmp r14, r13
je 0x14000193f
nop
mov rdx, r14
lea rcx, [rbp + 0x68]
call fcn.140002720
nop
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbp + 0x20]
je 0x1400017a1
lea rdx, [rbp + 0x68]
mov rcx, rax
call fcn.140002720
mov r9, qword [rbp + 0x18]
add r9, 0x20
mov qword [rbp + 0x18], r9
jmp 0x1400017b5
lea r8, [rbp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.140003750
mov r9, qword [rbp + 0x18]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov rcx, rsi
mov qword [rbp + 0x38], rcx
mov edx, 0xf
mov qword [rbp + 0x40], rdx
mov byte [rbp + 0x28], 0
lea rbx, [rbp + 0x68]
mov r15, qword [rbp + 0x80]
cmp r15, 0x10
setae r12b
mov rsi, qword [rbp + 0x68]
jb 0x1400017f4
mov rbx, rsi
mov r8, rsi
mov r10, rsi
jmp 0x1400017fb
lea r8, [rbp + 0x68]
mov r10, rbx
mov rdi, qword [rbp + 0x78]
add rdi, r8
cmp r10, rdi
je 0x140001885
movzx r9d, byte [rbx]
cmp rcx, rdx
jae 0x140001830
lea rax, [rcx + 1]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x28]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001839
lea rcx, [rbp + 0x28]
call fcn.140002f20
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
cmp rcx, rdx
jae 0x140001863
lea rax, [rcx + 1]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x28]
mov word [rax + rcx], 0
jmp 0x14000186f
xor r9d, r9d
lea rcx, [rbp + 0x28]
call fcn.140002f20
inc rbx
cmp rbx, rdi
je 0x140001881
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
jmp 0x140001807
mov r9, qword [rbp + 0x18]
cmp r9, qword [rbp + 0x20]
je 0x14000189e
lea rdx, [rbp + 0x28]
mov rcx, r9
call fcn.140002720
add qword [rbp + 0x18], 0x20
jmp 0x1400018af
lea r8, [rbp + 0x28]
mov rdx, r9
lea rcx, [rbp + 0x10]
call fcn.140003750
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x1400018eb
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a74
call fcn.140003ae4
nop
test r12b, r12b
je 0x140001921
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001919
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a7b
mov rcx, rsi
call fcn.140003ae4
add r14, 0x20
xor esi, esi
cmp r14, r13
jne 0x140001770
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
cmp r12, rdi
jae 0x140001db9
mov r9d, 0x30
lea r8, [rbp - 0x50]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test dword [rbp - 0x30], 0x1000
je 0x140001d86
test byte [rbp - 0x2c], 4
je 0x140001d86
mov rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x48]
call fcn.140002600
nop
lea r8, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae r8, qword [rbp + 0x48]
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp - 0x38]
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001d4f
mov r15, qword [rbp + 0x10]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x40], rax
cmp r15, rax
je 0x140001d4f
nop dword [rax]
nop dword [rax + rax]
mov rdx, r15
lea rcx, [rbp + 0x88]
call fcn.140002720
nop
mov rdi, qword [rbp + 0x98]
mov rdx, rdi
lea rcx, [rbp + 0xa8]
call fcn.140002600
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x68], rax
movups xmmword [rsp + 0x50], xmm0
xor edx, edx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rdx
lea rsi, [rbp + 0x88]
mov r13, qword [rbp + 0xa0]
cmp r13, 0x10
setae byte [rsp + 0x30]
mov r14, qword [rbp + 0x88]
cmovae rsi, r14
movabs rcx, 0x7fffffffffffffff
cmp rdi, rcx
ja 0x140001e98
mov qword [rsp + 0x68], 0xf
cmp rdi, 0x10
jae 0x140001a82
mov qword [rsp + 0x60], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x50], xmm0
jmp 0x140001b23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001aa1
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001ac8
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001aea
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e9e
mov rcx, rax
call fcn.140003aa0
mov rcx, rax
test rax, rax
je 0x140001d8f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001af9
test rcx, rcx
je 0x140001af6
call fcn.140003aa0
jmp 0x140001af9
mov rax, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
movabs rcx, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], rdx
mov rdi, qword [rbp + 0x58]
lea rsi, [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae rsi, qword [rbp + 0x48]
cmp rdi, rcx
ja 0x140001eaa
mov qword [rbp - 0x78], 0xf
cmp rdi, 0x10
jae 0x140001b6d
mov qword [rbp - 0x80], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x70], xmm0
jmp 0x140001c01
mov rbx, rdi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001b8c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001bb3
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001bd5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001ea4
mov rcx, rax
call fcn.140003aa0
mov rcx, rax
test rax, rax
je 0x140001d96
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001be4
test rcx, rcx
je 0x140001be1
call fcn.140003aa0
jmp 0x140001be4
mov rax, rdx
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x28]
call fcn.140001580
mov rdi, qword [rbp + 0x30]
mov rbx, qword [rbp + 0x28]
xor esi, esi
cmp rbx, rdi
je 0x140001c6f
mov r13, qword [rsp + 0x38]
nop dword [rax + rax]
mov rdx, qword [rbx]
add rdx, r12
mov qword [rsp + 0x20], rsi
mov r9d, 0x20
lea r8, [rbp + 0xa8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001c5b
inc dword [0x140008708]
add rbx, 8
cmp rbx, rdi
jne 0x140001c30
mov r13, qword [rbp + 0xa0]
mov rbx, qword [rbp + 0x28]
test rbx, rbx
je 0x140001cc0
mov rax, qword [rbp + 0x38]
sub rax, rbx
sar rax, 3
lea rdx, [rax*8]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001cac
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d9d
mov rcx, rbx
call fcn.140003ae4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rsi
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x140001d02
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001da4
call fcn.140003ae4
nop
cmp byte [rsp + 0x30], 0
je 0x140001d36
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001d2e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dab
mov rcx, r14
call fcn.140003ae4
add r15, 0x20
cmp r15, qword [rsp + 0x40]
jne 0x1400019d0
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140001d86
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001db2
call fcn.140003ae4
add r12, qword [rbp - 0x38]
jmp 0x14000193f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140001e13
mov rdx, qword [rbp + 0x18]
call fcn.140003190
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003ae4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
mov rbx, qword [rbp - 0x70]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001e67
mov rdx, qword [rbx + 8]
call fcn.140003190
mov rcx, qword [rbx]
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140001e57
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001e91
mov rcx, r8
call fcn.140003ae4
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbp + 0xc8]
xor rcx, rsp
call fcn.140003a80
mov rbx, qword [rsp + 0x220]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
int3
call fcn.1400011b0
int3