Function at 0x140018250
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov esi, ecx
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r14, qword [rsp + 0xd8]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rdi, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
cmp rdi, r15
jae 0x140018346
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
movabs r13, 0x1000000010000001
jmp 0x1400182da
add rdi, qword [rsp + 0x48]
cmp rdi, r15
jae 0x140018346
mov rcx, qword [0x140071450]
mov r9d, 0x30
mov rdx, rdi
mov r8, rbx
call r12
cmp dword [rsp + 0x58], 0x20000
jne 0x1400182d0
mov eax, dword [rsp + 0x54]
add eax, 0xfffffffc
cmp eax, 0x3c
ja 0x1400182d0
bt r13, rax
jae 0x1400182d0
mov rax, qword [rsp + 0x30]
cmp rax, r14
ja 0x1400182d0
add rax, qword [rsp + 0x48]
cmp rax, r14
jb 0x1400182d0
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x14006f4a0], xmm2
movups xmmword [0x14006f490], xmm1
movups xmmword [0x14006f480], xmm0
jmp 0x1400182d0
cmp byte [0x14006f47c], 0
jne 0x140018436
mov rax, qword [0x14006f480]
cmp rax, qword [0x14006f4d8]
je 0x140018436
mov rdx, qword [0x14006f498]
mov rcx, qword [0x140071450]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x30], rax
lea rbx, [0x140071460]
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9d, 4
call fcn.1400256b0
mov edi, 0x1b23c
add edi, dword [0x14006f4bc]
mov r14, qword [0x14006f498]
mov r15, qword [0x14006f480]
mov ecx, edi
call fcn.140034ea0
test r14d, r14d
jle 0x1400183f6
mov r12d, r14d
xor r13d, r13d
nop dword [rax + rax]
movzx ebp, byte [r15 + r13]
xor bpl, dil
mov byte [r15 + r13], bpl
call fcn.140034eb8
cdq
idiv r14d
inc dl
xor dl, bpl
mov byte [r15 + r13], dl
inc r13
cmp r12, r13
jne 0x1400183d0
mov rax, qword [0x14006f498]
mov rdx, qword [0x14006f480]
mov rcx, qword [0x140071450]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9d, 1
call fcn.1400256b0
mov byte [0x14006f47c], 1
mov rdx, qword [0x14006f468]
mov rcx, qword [0x140071450]
lea r14, [0x140071458]
mov qword [rsp + 0x20], r14
lea rdi, [0x14006f470]
mov rbx, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0xc
mov r8, rdi
call rbx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], 0
mov rdx, qword [0x14006f468]
mov rcx, qword [0x140071450]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xc
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x68], 0xc3500000
mov qword [rsp + 0x60], 0xb848
lea rax, [method.std::_Facet_base.virtual_0]
mov qword [rsp + 0x62], rax
mov rdx, qword [0x14006f468]
mov rcx, qword [0x140071450]
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x60]
mov r9d, 0xc
call rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140028140
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret