Function at 0x1400b6fe0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
cmp qword [rcx + 0x68], 0
mov rbx, rcx
jne 0x1400b7144
movsx r8d, byte [0x14015f3d8]
mov edx, 4
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
shl r8, 3
mov qword [rsp + 0x98], rsi
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
movsx r8d, byte [0x14015f3d8]
xor r9d, r9d
shl r8d, 3
mov rdx, rax
mov rsi, rax
lea ecx, [r9 + 0x53]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x1400b7128
movsx edi, byte [0x14015f3d8]
xor r11d, r11d
xor edx, edx
cmp edi, 4
jb 0x1400b70c2
mov eax, edi
mov r9d, edi
and eax, 3
xorps xmm2, xmm2
sub r9d, eax
movdqa xmm1, xmm2
mov r8d, 2
movq xmm0, qword [rsi + rdx*8]
lea eax, [r8 - 1]
movhpd xmm0, qword [rsi + rax*8]
add edx, 4
mov eax, r8d
paddq xmm0, xmm2
movdqa xmm2, xmm0
movq xmm0, qword [rsi + rax*8]
lea eax, [r8 + 1]
movhpd xmm0, qword [rsi + rax*8]
add r8d, 4
paddq xmm0, xmm1
movdqa xmm1, xmm0
cmp edx, r9d
jb 0x1400b7071
paddq xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movq r11, xmm1
xor r8d, r8d
xor r9d, r9d
cmp edx, edi
jae 0x1400b7110
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x1400b7101
mov eax, edi
lea rcx, [rsi + rdx*8]
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov r10d, eax
lea edx, [rdx + rax*2]
nop word [rax + rax]
add r8, qword [rcx]
add r9, qword [rcx + 8]
lea rcx, [rcx + 0x10]
sub r10, 1
jne 0x1400b70f0
cmp edx, edi
jae 0x1400b7109
add r11, qword [rsi + rdx*8]
lea rax, [r9 + r8]
add r11, rax
mov rax, r11
sub rax, qword [rbx + 0x5e0]
mov qword [rbx + 0x5e8], rax
mov qword [rbx + 0x5e0], r11
mov rcx, qword [sym.ProcessHacker.exe_PhHeapHandle]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rsi, qword [rsp + 0x98]
jmp 0x1400b7190
mov rax, qword [rcx + 0x70]
mov rcx, qword [rax + 0x48]
test rcx, rcx
je 0x1400b7190
mov r9d, 0x10
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x16]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x1400b7190
mov rcx, qword [rsp + 0x30]
mov rax, rcx
sub rax, qword [rbx + 0x5e0]
mov qword [rbx + 0x5e8], rax
mov qword [rbx + 0x5e0], rcx
mov rax, qword [rbx + 0x5e0]
or edi, 0xffffffff
test rax, rax
je 0x1400b71cc
xor r8d, r8d
mov dword [rsp + 0x40], 0x10009
lea edx, [rdi + 2]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call sym.ProcessHacker.exe_PhFormat
mov rcx, qword [rbx + 0x820]
mov qword [rbx + 0x820], rax
jmp 0x1400b71de
mov rcx, qword [rbx + 0x820]
mov qword [rbx + 0x820], 0
test rcx, rcx
je 0x1400b71f8
add rcx, 0xfffffffffffffff0
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400b71f8
call fcn.1400258b0
mov rax, qword [rbx + 0x5e8]
test rax, rax
je 0x1400b7232
xor r8d, r8d
mov dword [rsp + 0x60], 0x10009
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x70], rax
lea edx, [r8 + 1]
call sym.ProcessHacker.exe_PhFormat
mov rcx, qword [rbx + 0x828]
mov qword [rbx + 0x828], rax
jmp 0x1400b7244
mov rcx, qword [rbx + 0x828]
mov qword [rbx + 0x828], 0
test rcx, rcx
je 0x1400b725c
add rcx, 0xfffffffffffffff0
lock xadd dword [rcx + 8], edi
cmp edi, 1
jne 0x1400b725c
call fcn.1400258b0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret