Function at 0x140172cac
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa0]
xor r14d, r14d
mov r15, qword [rbp + 0xa8]
mov rbx, rdx
mov qword [rbp - 0x80], r8
mov r13, rcx
xor edx, edx
mov qword [rbp - 0x70], rax
lea r8d, [r14 + 0x48]
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], r14
mov r12, r9
mov qword [rsp + 0x40], r14
mov edi, r14d
mov qword [rsp + 0x58], r14
mov esi, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
mov qword [rbp - 0x10], r14
lea r9, [rsp + 0x38]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [rbp - 0x68]
mov rcx, rbx
lea rdx, [rbp]
call fcn.140173cc4
mov r14d, eax
test eax, eax
jns 0x140172d5e
mov ecx, eax
call fcn.140078308
xor r15d, r15d
jmp 0x140172e9a
cmp dword [rsp + 0x38], esi
je 0x140172d8a
lea r8, [rbp - 0x68]
mov rcx, r15
lea rdx, [rbp]
call fcn.14017568c
xor r15d, r15d
mov r14d, eax
test eax, eax
jns 0x140172d8a
mov ecx, eax
call fcn.140078308
jmp 0x140172e9a
mov r15, qword [r13 + 0x18]
xor r14d, r14d
cmp dword [0x1404230f8], 1
cmove r14, qword [0x1404227a0]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r15
call rbx
xor r15d, r15d
mov r14d, eax
test eax, eax
js 0x140172d7e
mov eax, dword [rbp + 0x98]
test al, 0x40
je 0x140172ff3
cmp dword [0x1404230f8], 1
jne 0x140172df1
mov r9, qword [0x140422880]
mov r8, qword [0x140422878]
jmp 0x140172df7
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [rbp + 0x90], 4
jne 0x140172fc8
lea rdx, [0x1403a8b94]
mov r8d, dword [r12]
lea rcx, [rsp + 0x40]
call fcn.140077544
mov r14d, eax
test eax, eax
js 0x140172d7e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x140172e60
mov ecx, 0x8007000e
mov rdi, r15
mov r14d, ecx
jmp 0x140172d80
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov r14, qword [rax + 0xd8]
mov rcx, r14
call qword [0x1403a2250]
mov rdx, rdi
mov rcx, rbx
call r14
mov r14d, eax
test eax, eax
js 0x140172d7e
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.1400753a4
mov ecx, r14d
call fcn.140078324
mov r12d, 3
mov qword [rsp + 0x70], r15
lea rax, [0x1400058e0]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov ebx, 0xb9
lea r13d, [r12 + 0x1d]
mov qword [rsp + 0x78], rax
mov r8d, r13d
xor r9d, r9d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14003a920]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], r15
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, r13d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x140172f36
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140078324
test rdi, rdi
je 0x140172f44
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140172f72
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140078324
mov ebx, 0xb9
lea rax, [0x140033aa0]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], r15
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, r13
mov rcx, rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14035a4e0
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x1404230f8], 1
mov r9d, 1
mov rdx, qword [rsp + 0x30]
mov r8, r15
cmove r8, qword [0x140422870]
mov rcx, qword [r13 + 0x18]
call fcn.1401750e8
jmp 0x140172e81
test al, al
jns 0x140173044
cmp dword [0x1404230f8], 1
jne 0x140173010
mov r9, qword [0x140422888]
mov r8, qword [0x140422878]
jmp 0x140173016
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [rbp + 0x90], 4
jne 0x140172fc8
lea rdx, [0x1403ab5a0]
jmp 0x140172e24
bt eax, 8
jae 0x1401730a9
cmp dword [0x1404230f8], 1
jne 0x140173063
mov r9, qword [0x140422890]
mov r8, qword [0x140422878]
jmp 0x140173069
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [rbp + 0x90], 8
jne 0x140172fc8
mov r8, qword [r12]
lea rdx, str._I64u
lea rcx, [rsp + 0x40]
call fcn.140077544
jmp 0x140172e32
bt eax, 9
jae 0x140173120
mov ebx, 1
cmp dword [0x1404230f8], ebx
jne 0x1401730cc
mov r9, qword [0x140422898]
mov r8, qword [0x140422878]
jmp 0x1401730d2
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x140173112
mov eax, edx
and eax, ebx
test al, al
jne 0x140173112
shr rdx, 1
lea r8, [rsp + 0x40]
mov rcx, r12
call fcn.140077eb8
jmp 0x140172e32
cmp dword [0x1404230f8], ebx
mov r9d, ebx
jmp 0x140172fd5
bt eax, 0xa
jae 0x140173330
cmp dword [0x1404230f8], 1
jne 0x140173143
mov r9, qword [0x1404228a0]
mov r8, qword [0x140422878]
jmp 0x140173149
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov r8d, dword [rbp + 0x90]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.14017452c
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [rsp + 0x4c], r15d
je 0x140172e8c
cmp dword [rsp + 0x38], r15d
je 0x140172e8c
mov rcx, qword [rbp - 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1401731ac
cmp rax, 0x26
jne 0x1401731e0
cmp word [rcx], 0x7b
jne 0x1401731e6
cmp word [rcx + 0x4a], 0x7d
jne 0x1401731e6
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.14006dc40
mov ebx, eax
test eax, eax
jns 0x1401731f2
mov ecx, eax
jmp 0x1401731ed
cmp rax, 0x24
je 0x1401731cd
mov ecx, 0x80070057
mov ebx, ecx
call fcn.140078308
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x140172e8c
movups xmm0, xmmword [rbp - 0x68]
lea r8, [rsp + 0x38]
lea rdx, [0x1403bccb4]
lea rcx, [rsp + 0x48]
movdqu xmmword [rbp - 0x40], xmm0
call fcn.1400b5fdc
test al, al
je 0x140173280
movsxd rax, dword [rsp + 0x38]
shl rax, 4
add rax, qword [rsp + 0x50]
mov r14, qword [rax + 8]
test r14, r14
jne 0x140173244
mov r14d, r15d
mov qword [rbp - 0x20], r15
jmp 0x14017326b
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140078324
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, r14
call fcn.1400780c4
mov r14d, eax
test eax, eax
jns 0x14017326b
mov ecx, eax
call fcn.140078308
mov ecx, r14d
call fcn.140078324
test r14d, r14d
jns 0x140173280
mov ecx, r14d
jmp 0x140172d80
lea r8, [rsp + 0x38]
lea rdx, str.pid2
lea rcx, [rsp + 0x48]
call fcn.1400b5fdc
test al, al
je 0x14017331e
movsxd r15, dword [rsp + 0x38]
xor r12d, r12d
mov rax, qword [rsp + 0x50]
add r15, r15
mov r14, qword [rax + r15*8 + 8]
test r14, r14
jne 0x1401732c1
mov r14d, r12d
mov qword [rbp - 0x18], r12
jmp 0x1401732e8
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140078324
lea r8, [rbp - 0x18]
mov edx, ebx
mov rcx, r14
call fcn.1400780c4
mov r14d, eax
test eax, eax
jns 0x1401732e8
mov ecx, eax
call fcn.140078308
mov ecx, r14d
call fcn.140078324
test r14d, r14d
jns 0x1401732fd
mov ecx, r14d
jmp 0x140172d51
mov rax, qword [rsp + 0x50]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax + r15*8 + 8]
call fcn.1400696f0
xor r15d, r15d
mov r14d, eax
test eax, eax
js 0x140172d7e
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call fcn.140175278
jmp 0x140172e81
bt eax, 0xb
jae 0x14017339d
cmp dword [0x1404230f8], 1
jne 0x14017334f
mov r9, qword [0x1404228a8]
mov r8, qword [0x140422878]
jmp 0x140173355
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [rbp + 0x90], 0x10
jne 0x140172fc8
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.140067fb4
mov rsi, qword [rsp + 0x58]
test eax, eax
js 0x140172fc8
mov rcx, rsi
jmp 0x140172e42
bt eax, 0xc
jae 0x1401733d1
cmp dword [0x1404230f8], 1
jne 0x1401733ea
mov r9, qword [0x1404228b0]
jmp 0x1401733e1
test ebx, ebx
je 0x140172e8c
lea r9, [rsp + 0x40]
mov edx, ebx
mov rcx, r12
call fcn.140067434
jmp 0x140172e32
cmp dword [0x1404230f8], 1
jne 0x1401733ea
mov r9, qword [0x1404228b8]
mov r8, qword [0x140422878]
jmp 0x1401733f0
mov r9, r15
mov r8, r15
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401584f8
mov r14d, eax
test eax, eax
js 0x140172d7e
cmp dword [0x1404230f8], 1
mov r8, r15
mov ebx, dword [rbp + 0x90]
mov r9d, ebx
cmove r8, qword [0x1404228c0]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401750e8
mov r14d, eax
test eax, eax
jns 0x1401733b5
jmp 0x140172d7e