Function at 0x1401c0b28
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword [rbp + 0x90]
xor esi, esi
mov r13, qword [rbp + 0x80]
mov r15, rcx
mov r12, qword [rbp + 0x88]
mov ebx, esi
mov qword [rbp - 0x60], r8
mov qword [rbp - 0x58], rdx
lea r8d, [rsi + 0x48]
mov qword [rbp - 0x70], rcx
xor edx, edx
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x58], r9
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
call sub.msvcrt.dll_memset
mov rax, qword gs:[0x58]
lea edi, [rsi + 1]
mov edx, 4
or r14, 0xffffffffffffffff
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140452ce4], eax
jg 0x1401c0fa9
mov rax, qword [r13]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x48]
mov rcx, r13
lea rdx, str.windowsComponentEditionPkeyId
call rax
mov edi, eax
test eax, eax
jns 0x1401c0c0a
mov ecx, eax
call fcn.140082a8c
xor r12d, r12d
jmp 0x1401c0ea7
cmp dword [rsp + 0x50], 1
mov r15, qword [r15 + 0x18]
mov rax, qword [r15]
mov rdi, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
jne 0x1401c0c58
cmp dword [0x140452f70], 1
cmove rsi, qword [0x140452548]
call rax
mov rax, rdi
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r15
call rax
mov edi, eax
test eax, eax
js 0x1401c0bfb
mov r15d, 1
jmp 0x1401c0c86
cmp dword [0x140452f70], 1
cmove rsi, qword [0x140452578]
call rax
mov rax, rdi
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r15
call rax
mov edi, eax
test eax, eax
js 0x1401c0bfb
xor r15d, r15d
mov rax, qword [rsp + 0x40]
lea rcx, [rbp - 0x80]
mov rdx, qword [rsp + 0x58]
lea r9, [0x140452cf0]
mov qword [rsp + 0x30], rcx
mov r8, r13
mov r13, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov rcx, r13
mov dword [rsp + 0x20], 3
call fcn.1401c2ac0
mov edi, eax
test eax, eax
js 0x1401c0bfb
test r12, r12
je 0x1401c0d13
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor r12d, r12d
mov rsi, rax
test rax, rax
je 0x1401c0d83
cmp dword [0x140452f70], 1
mov r8d, r12d
mov rdx, qword [rsp + 0x40]
mov r9, rax
cmove r8, qword [0x140452538]
mov rbx, rax
mov rcx, qword [r13 + 0x18]
call fcn.140169600
mov edi, eax
test eax, eax
js 0x1401c0ea0
test r15d, r15d
je 0x1401c0e70
mov rax, qword [rsp + 0x48]
mov rcx, r13
mov r8, qword [rsp + 0x40]
mov rdx, qword [r13 + 0x10]
mov r9, qword [rax]
call fcn.1401c2968
mov edi, eax
test eax, eax
js 0x1401c0ea0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1401c0d4a
mov esi, 0x80070057
cmp rax, 0x26
jne 0x1401c0d8f
cmp word [rcx], 0x7b
jne 0x1401c0d95
cmp word [rcx + 0x4a], 0x7d
jne 0x1401c0d95
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.140078228
mov edi, eax
test eax, eax
jns 0x1401c0d9e
mov ecx, eax
jmp 0x1401c0d99
mov edi, 0x8007000e
mov ecx, edi
jmp 0x1401c0ea2
cmp rax, 0x24
je 0x1401c0d70
mov edi, esi
mov ecx, esi
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
test edi, edi
js 0x1401c0d88
lea r8, [rsp + 0x58]
lea rdx, str.windowsComponentEditionSkuId
lea rcx, [rbp - 0x80]
call fcn.1400c8318
test al, al
je 0x1401c0e1f
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x78]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
inc r14
cmp word [rcx + r14*2], r12w
jne 0x1401c0dd3
cmp r14, 0x26
jne 0x1401c0e07
cmp word [rcx], 0x7b
jne 0x1401c0e0d
cmp word [rcx + 0x4a], 0x7d
jne 0x1401c0e0d
add rcx, 2
lea rdx, [rbp - 0x40]
call fcn.140078228
mov edx, eax
test eax, eax
jns 0x1401c0e16
mov ecx, eax
jmp 0x1401c0e11
cmp r14, 0x24
je 0x1401c0df4
mov edx, esi
mov ecx, esi
call fcn.140082a8c
mov ecx, edx
call fcn.140082b34
jmp 0x1401c0e2b
movups xmm0, xmmword [0x1403d7020]
movdqu xmmword [rbp - 0x40], xmm0
cmp dword [0x140452f70], 1
mov r8, r12
mov rdx, qword [rsp + 0x40]
mov r9d, 1
cmove r8, qword [0x140452550]
mov rcx, qword [r13 + 0x18]
call fcn.140187418
mov edi, eax
test eax, eax
js 0x1401c0ea0
mov rcx, qword [rbp - 0x68]
lea rdx, [rbp - 0x50]
call fcn.1401875c4
mov edi, eax
test eax, eax
js 0x1401c0ea0
mov rsi, qword [rbp - 0x60]
jmp 0x1401c0e74
mov rsi, qword [rbp - 0x58]
mov rax, qword [rsi]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rsi
mov rax, rdi
call rax
mov edi, eax
test eax, eax
jns 0x1401c0ea7
mov ecx, eax
call fcn.140082a8c
mov ecx, edi
call fcn.140082b34
mov r15d, 3
mov qword [rsp + 0x70], r12
lea rax, [0x14004a1dc]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov r14d, 0xb9
lea esi, [r15 + 0x1d]
mov qword [rsp + 0x78], rax
mov r8d, esi
xor r9d, r9d
mov ecx, r14d
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14002ee5c]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, esi
mov ecx, r14d
call sub.ntdll.dll_NtQuerySystemInformation
test rbx, rbx
je 0x1401c0f30
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1401c0f53
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x48], r12
lea rax, [0x140028cdc]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, rsi
mov rcx, r14
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140389660
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x140452ce4]
call fcn.140389a9c
cmp dword [0x140452ce4], r14d
jne 0x1401c0bc8
xorps xmm0, xmm0
mov qword [0x140452cf8], rsi
movups xmmword [0x140452d08], xmm0
lea rax, str.metaInfoType
mov dword [0x140452d00], esi
mov qword [0x140452cf0], rax
lea rcx, [0x140452ce4]
xor eax, eax
mov dword [0x140452d04], r14d
mov qword [0x140452d18], rax
lea rax, str.windowsComponentEditionPkeyId
mov qword [0x140452d08], rax
lea rax, str.pkeyId
mov qword [0x140452d10], rax
xor eax, eax
mov qword [0x140452d30], rax
lea rax, str.windowsComponentEditionSkuId
movups xmmword [0x140452d20], xmm0
mov qword [0x140452d20], rax
lea rax, str.skuId
mov qword [0x140452d28], rax
mov dword [0x140452d18], edi
mov dword [0x140452d1c], edi
mov dword [0x140452d30], edi
mov dword [0x140452d34], edi
call fcn.140389a2c
jmp 0x1401c0bc8