Function at 0x1400036a0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov rax, qword [0x140062030]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [rcx + 0x1c], 0
je 0x140003e5e
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x60], r9
mov r15d, dword [rcx + 0x18]
test r15b, 4
jne 0x140003e69
mov rcx, r14
mov r15, rcx
movzx eax, byte [rcx]
cmp eax, 0x48
jne 0x140003de2
cmp byte [r15 + 1], 0xff
mov rcx, r15
je 0x140003dbd
cmp r15, rcx
jne 0x1400036f0
cmp r15, r14
jne 0x140003e94
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], r14
mov dword [rsp + 0x108], 0
cmp byte [rsi + 0x1c], 0
je 0x140003e5e
mov r15d, dword [rsi + 0x18]
mov qword [rsp + 0x58], rsi
and r15d, 1
shl r15d, 0x1e
mov eax, dword [0x140064b04]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003d2a
mov ebp, dword [0x140064b00]
lea rcx, [rsp + 0x68]
mov edx, ebp
mov r8, r15
mov r9d, r15d
call fcn.140004280
mov eax, dword [0x140064b18]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003c98
lea rcx, [0x140064b20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12b, byte [rsp + 0x78]
test r12b, r12b
jne 0x140003a7e
xor ebx, ebx
xor esi, esi
mov r14, qword [0x140064af8]
test r14, r14
jne 0x140003801
mov ecx, 0x18
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov qword [rax], 0x18
mov qword [0x140064af8], rax
test r12b, r12b
jne 0x140003a9d
cmp qword [r14 + 8], 0
jne 0x140003877
mov ecx, 0x20
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov dword [rax + 0x18], 0
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
jne 0x140003843
mov rcx, r14
call fcn.140004450
mov rax, qword [r14 + 8]
mov rcx, qword [r14]
lea rax, [rax + rax*2]
mov qword [rcx + rax*8], rbx
mov qword [rcx + rax*8 + 8], rsi
mov qword [rcx + rax*8 + 0x10], r15
inc qword [r14 + 8]
mov r14, qword [0x140064af8]
test r14, r14
je 0x140003e89
cmp qword [r14 + 8], 0
je 0x140003e89
mov rdi, qword [r14]
add rdi, 0x10
mov r14, qword [rdi]
test r14, r14
je 0x140003ec0
test ebp, ebp
je 0x140003ec0
cmp qword [r14 + 8], 0
jne 0x140003db4
mov eax, dword [0x140064b04]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003d6f
mov esi, dword [0x140064b00]
mov eax, ebp
xor edx, edx
div esi
sub esi, edx
test edx, edx
cmove esi, edx
add esi, ebp
lea rbx, [r14 + 0x10]
mov dword [r14 + 0x10], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test r12b, r12b
jne 0x140003b81
mov edx, esi
xor ecx, ecx
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x140003eb2
mov qword [r14 + 8], rax
cmp dword [rbx], 0
je 0x140003ec0
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], r14
mov byte [rsp + 0xf0], 1
lea rcx, [0x140064b20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x140064b18]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140003ce1
lea r15, [0x140064b20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r12, [rsp + 0xa0]
mov rcx, r14
mov rdx, r12
call fcn.140004630
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [r12 + 0x38], 0
je 0x140003ee4
mov rax, qword [rsp + 0xa0]
lea r14, [rsp + 0x68]
mov qword [r14], rax
mov eax, dword [rsp + 0xa8]
mov dword [r14 + 8], eax
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [r14 + 0x20], xmm0
mov eax, dword [rsp + 0xd0]
mov dword [r14 + 0x30], eax
mov al, byte [rsp + 0xd4]
mov byte [r14 + 0x34], al
mov dword [rsp + 0xa8], 0
mov byte [rsp + 0xd4], 0
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x28], rsi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xf8]
lea r8, [rsp + 0xe0]
mov rcx, rdi
mov r9, r14
call fcn.140004870
cmp qword [rsi], 0
setne sil
mov rcx, qword [r14 + 0x10]
test rcx, rcx
je 0x140003a58
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x140003a58
lea r9, [rsp + 0x70]
mov edx, dword [r9 + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14002fba0
mov eax, esi
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x140003ea7
mov rbx, qword [rsp + 0x70]
lea rsi, [rax + rbx]
dec rsi
jmp 0x1400037d2
mov qword [rsp + 0x40], rsi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
mov rdi, rax
test rcx, rcx
jle 0x140003ae8
mov r8, rcx
mov rdi, rax
mov rdx, rcx
mov r10, qword [rsp + 0x40]
shr rdx, 1
lea r9, [rdx + rdx*2]
lea r9, [rdi + r9*8]
cmp qword [r9], rbx
jae 0x140003f08
add r9, 0x18
not rdx
add rdx, r8
mov rdi, r9
mov r8, rdx
test rdx, rdx
jg 0x140003abf
lea rcx, [rcx + rcx*2]
lea rax, [rax + rcx*8]
cmp rdi, rax
jne 0x140003eeb
mov ecx, 0x20
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov dword [rax + 0x18], 0
mov rax, qword [r14]
mov r13, qword [r14 + 8]
sub rdi, rax
sar rdi, 3
movabs rsi, 0xaaaaaaaaaaaaaaab
imul rsi, rdi
cmp rsi, r13
jne 0x140003f1d
mov rcx, rsi
cmp rsi, qword [r14 + 0x10]
mov rdi, qword [rsp + 0x40]
jne 0x140003b57
mov rcx, r14
call fcn.140004450
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rcx, [rcx + rcx*2]
mov qword [rax + rcx*8], rbx
mov qword [rax + rcx*8 + 8], rdi
mov qword [rax + rcx*8 + 0x10], r15
inc qword [r14 + 8]
mov rax, qword [r14]
lea rcx, [rsi + rsi*2]
lea rdi, [rax + rcx*8]
add rdi, 0x10
jmp 0x14000387e
mov r12, qword [rsp + 0x68]
test r12, r12
je 0x140003ea7
mov r15, rax
mov r13, qword [rsp + 0x70]
mov eax, dword [0x140064b58]
mov ecx, dword [0x1400624b8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x140003c1d
lea rcx, [0x140064b58]
call fcn.14002ea70
cmp dword [0x140064b58], 0xffffffff
jne 0x140003c1d
lea rcx, str.kernelbase.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140064b48], rax
mov qword [0x140064b50], 0
test rax, rax
je 0x140003c11
lea rdx, str.VirtualAlloc2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140064b50], rax
test rax, rax
je 0x1400041e1
lea rcx, [0x140064b58]
call fcn.14002ea10
mov rax, qword [0x140064b50]
mov ebp, esi
test rax, rax
je 0x140003ffc
lea rcx, [r12 + r13]
dec rcx
lea rdx, [rsp + 0xa0]
mov qword [rdx], r13
mov qword [rdx + 8], rcx
mov qword [rdx + 0x10], 0
lea rcx, [rsp + 0x110]
mov qword [rcx], 1
mov qword [rcx + 8], rdx
mov edx, 1
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
mov rcx, r15
xor edx, edx
mov r8, rbp
mov r9d, 0x2000
call qword [0x140068010]
mov qword [r14 + 8], rax
test rax, rax
jne 0x140003911
jmp 0x140003ec0
lea rcx, [0x140064b18]
call fcn.14002ea70
cmp dword [0x140064b18], 0xffffffff
jne 0x1400037b3
lea rcx, [0x140064b20]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x140064b14], 1
lea rcx, [0x140064b18]
call fcn.14002ea10
jmp 0x1400037b3
lea rcx, [0x140064b18]
call fcn.14002ea70
cmp dword [0x140064b18], 0xffffffff
jne 0x140003969
lea rcx, [0x140064b20]
mov edx, 0xfa0
mov r8d, 0x1000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov byte [0x140064b14], 1
lea rcx, [0x140064b18]
call fcn.14002ea10
jmp 0x140003969
lea rcx, [0x140064b04]
call fcn.14002ea70
cmp dword [0x140064b04], 0xffffffff
jne 0x140003776
lea r14, [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r14 + 0x28]
mov dword [0x140064b00], eax
lea rcx, [0x140064b04]
call fcn.14002ea10
jmp 0x140003776
lea rcx, [0x140064b04]
call fcn.14002ea70
cmp dword [0x140064b04], 0xffffffff
jne 0x1400038c2
lea r15, [rsp + 0xa0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [r15 + 0x28]
mov dword [0x140064b00], eax
lea rcx, [0x140064b04]
call fcn.14002ea10
jmp 0x1400038c2
lea rbx, [r14 + 0x10]
jmp 0x140003911
mov eax, 3
cmp byte [r15 + 2], 0x25
mov rcx, r15
jne 0x14000370d
lea rcx, [r15 + rax]
movsxd rax, dword [r15 + rax]
mov rcx, qword [rax + rcx + 4]
jmp 0x14000370d
cmp eax, 0xe9
je 0x1400041fe
cmp eax, 0xff
je 0x14000420f
mov rcx, r15
cmp eax, 0xeb
jne 0x14000370d
mov rdi, rsi
movsx rax, byte [r15 + 1]
lea r12, [r15 + rax]
add r12, 2
mov eax, r12d
sub eax, r15d
shl eax, 0x18
add eax, 0xfe000000
mov edx, eax
sar edx, 0x18
test eax, eax
js 0x14000421e
mov rcx, r15
mov rsi, rdi
je 0x14000370d
xor eax, eax
lea ecx, [rax + 2]
cmp byte [r15 + rcx], 0x90
jne 0x140004274
inc al
movsx eax, al
cmp edx, eax
jg 0x140003e3f
mov rcx, r12
jmp 0x140004277
int3
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], r14
mov dword [rsp + 0x108], 0
jmp 0x140003744
int3
mov rcx, r15
call fcn.140051b80
test al, al
cmovne r14, r15
jmp 0x14000371b
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [r14 + 8], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], 0
lea rcx, [0x140064b20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor esi, esi
jmp 0x140003a58
cmp qword [rdi], rbx
ja 0x140003af9
mov rax, qword [rsp + 0x40]
cmp qword [rdi + 8], rax
jae 0x14000387a
jmp 0x140003af9
jne 0x140003ae0
cmp qword [r9 + 8], r10
jb 0x140003ad3
jmp 0x140003ae0
lea rdi, [r13*2]
add rdi, r13
movups xmm0, xmmword [rax + rdi*8 - 0x18]
movaps xmmword [rsp + 0xa0], xmm0
mov rcx, qword [rax + rdi*8 - 8]
mov qword [rsp + 0x48], rcx
mov qword [rax + rdi*8 - 8], 0
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
jne 0x140003f5e
mov rcx, r14
call fcn.140004450
mov rax, qword [r14 + 8]
mov rcx, qword [r14]
lea rax, [rax + rax*2]
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rcx + rax*8], xmm0
mov rdx, qword [rsp + 0x48]
mov qword [rcx + rax*8 + 0x10], rdx
inc qword [r14 + 8]
dec r13
cmp r13, rsi
jbe 0x140003fc9
lea rdi, [rdi*8 - 8]
mov rax, qword [r14]
movups xmm0, xmmword [rax + rdi - 0x28]
movups xmmword [rax + rdi - 0x10], xmm0
mov rdx, qword [rax + rdi - 0x18]
mov qword [rax + rdi - 0x18], 0
mov rcx, qword [rax + rdi]
mov qword [rax + rdi], rdx
test rcx, rcx
je 0x140003fbd
call qword [sym.imp.mozglue.dll_free]
dec r13
add rdi, 0xffffffffffffffe8
cmp r13, rsi
ja 0x140003f8f
mov rax, qword [r14]
lea rdx, [rsi + rsi*2]
mov qword [rax + rdx*8], rbx
mov rcx, qword [rsp + 0x40]
mov qword [rax + rdx*8 + 8], rcx
mov rcx, qword [rax + rdx*8 + 0x10]
mov qword [rax + rdx*8 + 0x10], r15
test rcx, rcx
je 0x140003b6d
call qword [sym.imp.mozglue.dll_free]
jmp 0x140003b6d
add r12, r13
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
mov rcx, r15
mov rdx, rbp
mov r8, r13
mov r9, r12
call fcn.140034c80
test rax, rax
je 0x140003eb8
mov rcx, rax
mov rdx, rbp
mov r8d, 0x2000
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000390d
xor ecx, ecx
mov rdx, rbp
jmp 0x1400038f2
mov rcx, qword [0x140064b48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140064b48], 0
jmp 0x140003c11
movsxd rax, dword [r15 + 1]
lea rcx, [r15 + rax]
add rcx, 5
jmp 0x14000370d
mov eax, 2
cmp byte [r15 + 1], 0x25
jmp 0x140003dc7
add dl, 2
mov rcx, r15
call fcn.140052470
mov rcx, r15
test al, al
mov rsi, rdi
je 0x14000370d
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x100], r12
mov dword [rsp + 0x108], 0
lea r8, [rsp + 0xa0]
mov rcx, r12
xor edx, edx
call fcn.14002e950
mov rcx, r15
test al, al
je 0x14000370d
jmp 0x140003736
mov rcx, r15
mov rsi, rdi
jmp 0x14000370d