Function at 0x140016d04
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x120
mov rax, qword [0x14028b7c8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rcx
mov edi, 0x9c
lea rcx, [rsp + 0x70]
mov r8, rdi
xor edx, edx
call fcn.140158a90
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor r13d, r13d
cmp eax, r13d
jne 0x140016d9b
mov edi, DllRegisterServer
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, rdi
call fcn.140158a90
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, r13d
jne 0x140016d9b
lea rdx, str._vGetOSVersion__GetVersionEx_returned_NULL_n
mov rcx, rbx
call fcn.140016c48
jmp 0x140016f45
mov eax, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x74]
lea rdx, str._vGetOSVersion__m_iOSVersion___d___d._d__n
mov rcx, rbx
mov dword [rbx + 0xb1c], r8d
mov dword [rbx + 0xb20], r9d
mov dword [rbx + 0xb24], eax
mov dword [rsp + 0x20], eax
call fcn.140016c48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x40]
mov r12, rax
mov rbp, r13
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x1401ce318]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
cmp rax, r13
je 0x140016e4c
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r13
je 0x140016e1b
lea rcx, [rsp + 0x40]
call rax
lea rdx, str.IsWow64Process
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsWow64Process2
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140016e51
mov rdi, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x40]
mov esi, 1
mov dword [rbx + 0xb38], ecx
sub ecx, 2
je 0x140016ead
sub ecx, 3
je 0x140016e7d
sub ecx, esi
je 0x140016ea5
sub ecx, esi
je 0x140016ead
sub ecx, 2
je 0x140016e85
cmp ecx, 3
jne 0x140016eb3
mov dword [rbx + 0xb34], esi
jmp 0x140016eb3
cmp rbp, r13
je 0x140016eb3
lea rdx, [rsp + 0x38]
mov rcx, r12
call rbp
cmp eax, r13d
je 0x140016eb3
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0xb28], eax
jmp 0x140016eb3
mov dword [rbx + 0xb2c], esi
jmp 0x140016eb3
mov dword [rbx + 0xb30], esi
cmp rdi, r13
je 0x140016f14
mov word [rsp + 0x34], r13w
mov word [rsp + 0x30], r13w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x34]
mov rcx, rax
call rdi
cmp eax, r13d
je 0x140016f14
movzx r9d, word [rsp + 0x30]
movzx r8d, word [rsp + 0x34]
lea rdx, str._vGetOSVersion__process_machine0x_X__native_machine0x_X_n
mov rcx, rbx
call fcn.140016c48
mov r11d, 0xaa64
cmp word [rsp + 0x30], r11w
jne 0x140016f14
mov dword [rbx + 0xb34], esi
mov dword [rbx + 0xb28], r13d
mov eax, dword [rbx + 0xb34]
mov r9d, dword [rbx + 0xb2c]
mov r8d, dword [rbx + 0xb28]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0xb30]
lea rdx, str._vGetOSVersion__IsAMD64_d__IsIA64_d__IsAlpha_d__IsARM_d_n
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140016c48
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140156fd0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret