Function at 0x1400dc86d
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x118
movaps xmmword [rsp + 0x100], xmm6
mov r14, r9
mov rsi, r8
mov r15d, edx
mov ebx, ecx
mov rax, qword [0x140162028]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
test r8, r8
je 0x1400dc8cc
mov edx, 0x100
mov rcx, rsi
call fcn.14010e44c
cmp rax, 0x100
je 0x1400dcd5c
cmp byte [0x14016a384], 0
je 0x1400dcad7
cmp byte [0x14016a385], 1
mov edi, 1
adc edi, 0
test ebx, ebx
cmovne edi, ebx
xor eax, eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x58], 0xffffffffffffffff
mov qword [rsp + 0x70], rax
movaps xmmword [rsp + 0x60], xmm0
test rsi, rsi
je 0x1400dcbed
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, rsi
call fcn.14005b33c
movzx ecx, byte [rbx + 0x17]
mov rax, qword [rbx]
mov rdx, rcx
test cl, cl
jns 0x1400dc954
mov rdx, qword [rsp + 0x68]
mov rbx, rax
add rdx, rdx
test rdx, rdx
je 0x1400dd075
cmp word [rbx + rdx - 2], 0x5c
lea rdx, [rdx - 2]
je 0x1400dc957
cmp rdx, 0xfffffffffffffffe
je 0x1400dd075
sar rdx, 1
inc rdx
lea rsi, [rsp + 0x60]
mov rcx, rsi
xor r8d, r8d
call fcn.14005aba6
movzx eax, byte [rsi + 0x17]
test al, al
jns 0x1400dc99e
mov rax, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
test rax, rax
je 0x1400dc9c0
add rax, rax
xor ecx, ecx
cmp word [rsi + rcx], 0x5c
je 0x1400dd129
sar rcx, 1
mov r8, rcx
lea rsi, [rsp + 0x60]
mov rcx, rsi
xor edx, edx
call fcn.14005b5be
movzx eax, byte [rsi + 0x17]
mov rcx, rax
test al, al
jns 0x1400dc9e4
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rcx, rcx
je 0x1400dca02
add rcx, rcx
xor ebx, ebx
cmp word [rsi + rbx], 0x5c
je 0x1400dcae9
add rbx, 2
cmp rcx, rbx
jne 0x1400dc9ee
mov al, byte [rsp + 0x77]
test al, al
jns 0x1400dd08b
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x1400dcbed
bt r15d, 8
jae 0x1400dca31
mov eax, r15d
and eax, 0x200
jne 0x1400dcbed
cmp edi, 2
lea rax, [0x14016a5e0]
lea rcx, [0x14016a7e0]
cmove rcx, rax
cmp word [rcx], 0
jne 0x1400dcbed
xorps xmm0, xmm0
lea rsi, [rsp + 0xc0]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x1400dcbed
cmp byte [0x14016a5d0], 0
setne al
bt r15d, 8
jb 0x1400dcbed
mov ecx, r15d
shr ecx, 9
and ecx, 1
or cl, al
je 0x1400dcbed
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
movzx r12d, byte [rsp + 0x77]
test r12b, r12b
mov dword [rsp + 0x54], r15d
jns 0x1400dcb81
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
jmp 0x1400dcb86
call fcn.1400dc480
test al, al
jne 0x1400dc8d9
jmp 0x1400dcd5c
cmp rcx, rbx
je 0x1400dca02
cmp rbx, 0xfffffffffffffffe
je 0x1400dca02
sar rbx, 1
lea rsi, [rsp + 0x60]
lea rdx, [rbx + 1]
test al, al
jns 0x1400dcb6d
mov rax, qword [rsp + 0x60]
cmp word [rax + rbx*2 + 2], 0x5c
je 0x1400dd2c6
mov rcx, qword [rsp + 0x68]
cmp rcx, rdx
jbe 0x1400dca02
lea rdx, [rax + rdx*2]
add rcx, rcx
add rbx, rbx
sub rcx, rbx
add rcx, 0xfffffffffffffffc
test rcx, rcx
je 0x1400dca02
add rcx, 0xfffffffffffffffe
cmp word [rdx + 2], 0x5c
lea rdx, [rdx + 2]
jne 0x1400dcb3c
sub rdx, rax
sar rdx, 1
mov rbx, rdx
cmp rbx, 0xffffffffffffffff
je 0x1400dca02
mov al, byte [rsp + 0x77]
jmp 0x1400dcb04
cmp word [rsp + rbx*2 + 0x62], 0x5c
je 0x1400dd2c6
movzx ecx, al
mov rax, rsi
jmp 0x1400dcb22
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 0
mov rbp, qword [rsi + 8]
mov r14, r12
sub r14, rbp
jb 0x1400dcbcc
mov rdx, qword [rsi]
mov rcx, rbx
mov r8, rbp
call fcn.140104844
test eax, eax
je 0x1400dd02d
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x1400dcbaa
cmp dword [rsp + 0x38], 0
mov r14, qword [rsp + 0x30]
mov r15d, dword [rsp + 0x54]
jne 0x1400dd13b
movabs r12, 0x7fffffffffffffef
cmp edi, 2
jne 0x1400dcc0a
cmp word [0x14016a5e0], 0
jne 0x1400dd093
cmp edi, 1
jne 0x1400dcc1d
cmp word [0x14016a7e0], 0
jne 0x1400dd16d
cmp edi, 2
lea rax, [0x14016a9f0]
lea rsi, str.RegistryMachine_
cmove rsi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
mov rcx, rsi
call fcn.14010e320
cmp rax, r12
ja 0x1400dd2e1
mov rbx, rax
cmp rax, 0xb
jb 0x1400dced1
lea rdi, [rbx + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1400ef770
mov rbp, rax
mov qword [rsp + 0xc0], rax
lea rax, [r12 + 0x11]
or rax, rdi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], rbx
mov r8, rbx
add r8, rbx
mov rcx, rbp
mov rdx, rsi
call fcn.1400f23d0
mov word [rbp + rbx*2], 0
lea rdi, [rsp + 0xc0]
movzx r9d, byte [rdi + 0x17]
test r9b, r9b
cmovs r9, qword [rdi + 8]
mov r8, qword [rdi]
cmovns r8, rdi
xor ebx, ebx
lea rsi, [rsp + 0x60]
mov rcx, rsi
xor edx, edx
call fcn.14005b364
cmp byte [rdi + 0x17], bl
js 0x1400dceb0
or r15d, 1
xor edi, edi
cmp byte [rsp + 0x77], dil
jns 0x1400dccfb
mov rsi, qword [rsp + 0x60]
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, rsi
call qword [0x14016a398]
lea r8, [rsp + 0x80]
mov dword [r8], 0x30
mov qword [r8 + 8], 0
mov dword [r8 + 0x18], 0x40
mov qword [r8 + 0x10], rbx
xorps xmm0, xmm0
movaps xmmword [r8 + 0x20], xmm0
lea rcx, [rsp + 0x58]
mov edx, r15d
xor r9d, r9d
call qword [0x14016a3a0]
mov esi, eax
cmp byte [rsp + 0x77], dil
js 0x1400dcec2
test esi, esi
jns 0x1400dcd8c
xor esi, esi
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.1400f0560
mov eax, esi
movaps xmm6, xmmword [rsp + 0x100]
add rsp, 0x118
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x38], r12
mov rbp, qword [rsp + 0x58]
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
mov qword [rsp + 0xd0], 0
cmp byte [0x14016a384], 0
je 0x1400dd225
mov r15, qword [rsp + 0x180]
lea rcx, [rsp + 0x80]
movaps xmmword [rcx], xmm6
mov rdx, r14
call qword [0x14016a398]
lea rax, [rsp + 0x60]
mov dword [rax], 0x18
mov ecx, 0x18
call fcn.1400ef770
mov rsi, rax
lea r13, [rax + 0x18]
mov r8d, 0x18
mov rcx, rax
xor edx, edx
call fcn.1400f27e0
mov eax, 0x18
mov r12d, 4
add qword [rsp + 0x38], 0x10
mov r14, r13
mov ebx, eax
mov rdi, r13
sub rdi, rsi
cmp rdi, rbx
jb 0x1400dce7b
jbe 0x1400dce2b
add rbx, rsi
mov r13, rbx
mov eax, dword [rsp + 0x60]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
mov rcx, rbp
lea rdx, [rsp + 0x80]
mov r8d, 1
mov r9, rsi
call qword [0x14016a3a8]
cmp eax, 0xc0000023
je 0x1400dce69
cmp eax, 0x80000005
jne 0x1400dcf6e
test r12d, r12d
je 0x1400dcf9c
mov eax, dword [rsp + 0x60]
dec r12d
jmp 0x1400dce16
mov qword [rsp + 0x30], rbp
mov rbp, rbx
sub rbp, rdi
mov rax, r14
sub rax, r13
cmp rax, rbp
jb 0x1400dceea
test rbp, rbp
je 0x1400dcea6
mov rcx, r13
add r13, rbp
xor edx, edx
mov r8, rbp
call fcn.1400f27e0
mov rbp, qword [rsp + 0x30]
jmp 0x1400dce2b
mov rcx, qword [rsp + 0xc0]
call fcn.1400ef7cc
jmp 0x1400dcce9
mov rcx, qword [rsp + 0x60]
call fcn.1400ef7cc
jmp 0x1400dcd58
lea rbp, [rsp + 0xc0]
mov byte [rbp + 0x17], bl
test rbx, rbx
jne 0x1400dcc9b
jmp 0x1400dccac
sub r14, rsi
lea r15, [r14 + r14]
cmp r15, rbx
cmovb r15, rbx
movabs rax, 0x3fffffffffffffff
cmp r14, rax
cmovae r15, qword [rsp + 0x38]
test r15, r15
je 0x1400dd2d9
mov rcx, r15
call fcn.1400ef770
mov r14, rax
lea rcx, [r14 + rdi]
xor edx, edx
mov r8, rbp
call fcn.1400f27e0
test rdi, rdi
jle 0x1400dcf40
mov rcx, r14
mov rdx, rsi
mov r8, rdi
call fcn.1400f23d0
add r15, r14
add rbx, r14
test rsi, rsi
mov rbp, qword [rsp + 0x30]
je 0x1400dcf58
mov rcx, rsi
call fcn.1400ef7cc
mov rsi, r14
mov r13, rbx
mov r14, r15
mov r15, qword [rsp + 0x180]
jmp 0x1400dce2b
test eax, eax
js 0x1400dcf9c
mov edi, dword [rsi + 4]
mov r8d, dword [rsi + 0xc]
test r8, r8
je 0x1400dd018
mov edx, dword [rsi + 8]
add rdx, rsi
add r8, rdx
lea rcx, [rsp + 0xc0]
call fcn.140039310
xor ebx, ebx
jmp 0x1400dcfe3
test rsi, rsi
jne 0x1400dcfdf
xor esi, esi
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
jne 0x1400dcfd0
mov rdi, qword [rsp + 0x58]
cmp byte [0x14016a384], 0
je 0x1400dd237
mov rcx, rdi
call qword [0x14016a388]
jmp 0x1400dcd5e
mov qword [rsp + 0xc8], rcx
call fcn.1400ef7cc
jmp 0x1400dcfb0
mov bl, 1
xor edi, edi
mov rcx, rsi
call fcn.1400ef7cc
xor esi, esi
test bl, bl
jne 0x1400dcfa3
dec edi
cmp edi, 1
ja 0x1400dcfa3
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400dc7a7
mov rdx, qword [rsi]
mov rcx, r15
call fcn.14005b33c
mov sil, 1
jmp 0x1400dcfa3
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc8], rax
jmp 0x1400dcf98
movzx edx, word [rbx + rbp*2]
cmp dx, 0x5c
je 0x1400dd040
test dx, dx
jne 0x1400dcbcc
lea rax, [rbx + rbp*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
mov dword [rsp + 0x38], ebp
cmp ebp, 1
je 0x1400dd24b
cmp dword [rsp + 0x38], 2
jne 0x1400dd241
mov rbx, rax
lea rcx, str.WOW6432Node
jmp 0x1400dd24b
test cl, cl
js 0x1400dd2b3
mov word [rsp + 0x60], 0
mov byte [rsp + 0x77], 0
xor eax, eax
movzx eax, al
jmp 0x1400dca13
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
lea rcx, [0x14016a9f0]
call fcn.14010e320
cmp rax, r12
ja 0x1400dd2e1
mov rsi, rax
mov rbp, r12
cmp rax, 0xb
jb 0x1400dd27f
lea rdi, [rsi + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1400ef770
mov rbx, rax
mov qword [rsp + 0xc0], rax
lea rax, [rbp + 0x11]
or rax, rdi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], rsi
mov r8, rsi
add r8, rsi
lea rdx, [0x14016a9f0]
mov rcx, rbx
call fcn.1400f23d0
mov word [rbx + rsi*2], 0
lea rdx, [0x14016a5e0]
jmp 0x1400dd1fe
add rcx, 2
cmp rax, rcx
jne 0x1400dc9af
jmp 0x1400dc9c0
lea rcx, [rsp + 0x60]
cmp byte [rcx + 0x17], 0
mov rax, rcx
jns 0x1400dd14e
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x40]
sub rdx, rax
sar rdx, 1
mov r8, qword [rsp + 0x48]
call fcn.14005b58e
mov r14, qword [rsp + 0x30]
jmp 0x1400dcbed
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
lea rcx, [0x14016a9f0]
call fcn.14010e320
cmp rax, r12
ja 0x1400dd2e1
mov rsi, rax
mov rbp, r12
cmp rax, 0xb
jb 0x1400dd299
lea rdi, [rsi + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1400ef770
mov rbx, rax
mov qword [rsp + 0xc0], rax
lea rax, [rbp + 0x11]
or rax, rdi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc8], rsi
mov r8, rsi
add r8, rsi
lea rdx, [0x14016a9f0]
mov rcx, rbx
call fcn.1400f23d0
mov word [rbx + rsi*2], 0
lea rdx, [0x14016a7e0]
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.14005b0d0
lea rdx, [0x1401355a4]
mov rcx, rsi
call fcn.14005b0d0
mov r12, rbp
jmp 0x1400dccb3
call fcn.1400dc480
test al, al
jne 0x1400dcdba
jmp 0x1400dcfa1
call fcn.1400dc480
jmp 0x1400dcfc2
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
cmp dx, 0x5c
jne 0x1400dd25f
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x1400dd251
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov r12, r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
xor r15d, r15d
mov rbx, rax
jmp 0x1400dcbd3
lea rbx, [rsp + 0xc0]
mov byte [rbx + 0x17], sil
test rsi, rsi
jne 0x1400dd102
jmp 0x1400dd117
lea rbx, [rsp + 0xc0]
mov byte [rbx + 0x17], sil
test rsi, rsi
jne 0x1400dd1dc
jmp 0x1400dd1f1
mov word [rax], 0
mov qword [rsp + 0x68], 0
jmp 0x1400dca02
mov r8d, 1
mov rcx, rsi
call fcn.14005b5be
jmp 0x1400dcb5d
xor r14d, r14d
jmp 0x1400dcf1f
lea rcx, [rsp + 0xc0]
call fcn.14005994c
int3