Function at 0x1400149b0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x14007c080]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov rax, qword [rbp + 0x3b8]
mov rbx, r9
mov r12, qword [rbp + 0x3c8]
mov r14d, ecx
mov rdi, qword [rbp + 0x3c0]
lea rcx, [0x14007c7a8]
mov rsi, qword [rbp + 0x3d0]
mov r13, r8
mov r15, qword [rbp + 0x3e0]
mov qword [rbp - 0x78], rax
xor eax, eax
mov dword [rbp + 0xa4], eax
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xc0], r12
call fcn.140058958
xor eax, eax
lea rcx, [0x14007c7a8]
mov dword [rbp + 0x288], eax
mov byte [rbp + 0x298], al
mov eax, 1
mov dword [rbp + 0x268], eax
call fcn.140058958
lea rcx, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
test al, 0xe
je 0x140014ab1
xor eax, eax
lea rdx, [0x14007c7a8]
mov qword [rsp + 0x50], rax
lea r9, [fcn.140056b90]
mov qword [rsp + 0x48], rax
lea r8, [rbp + 0xa4]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x20], rax
call fcn.140016f30
lea rcx, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
xor eax, eax
xorps xmm0, xmm0
mov byte [rbp + 0xa0], al
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x40], xmm1
mov dword [rbp + 0x50], eax
mov qword [rbp + 0x54], rax
movdqa xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rax
mov dword [rbp + 0x98], eax
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x70], rax
mov byte [rbp - 0x10], al
mov qword [rbp - 8], rax
mov qword [rbp], rax
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x14], eax
test r15, r15
je 0x140014b32
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15 + 0x20], xmm0
test r14d, 0xfffff8c0
je 0x140014b58
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11a6
mov qword [rsp + 0x68], rax
lea rax, str.Valid_flags_check_failed:_Flags
jmp 0x140014b9a
test r13, r13
jne 0x140014b7a
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11a8
mov qword [rsp + 0x68], rax
lea rax, str.Not_null_check_failed:_IsoLayer
jmp 0x140014b9a
test rbx, rbx
jne 0x140014bca
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11a9
mov qword [rsp + 0x68], rax
lea rax, str.Not_null_check_failed:_GetOperationCallback
mov qword [rsp + 0x70], rcx
mov r8d, 0xc000000d
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x80], rax
mov dword [rbp + 0xa4], 0xc000000d
call fcn.140052a48
mov ebx, dword [rbp + 0xa4]
xor esi, esi
jmp 0x140015690
mov qword [rbp + 0xa8], rax
mov rax, qword [r13]
movabs r10, 0xb94c27ff5c553b70
mov rax, qword [rax + 8]
lea r8, [rbp + 0xa8]
lea rdx, [0x140065a08]
mov rcx, r13
call qword [case.0x1400569a6.0]
mov ebx, eax
test eax, eax
jns 0x140014c0b
mov dword [rbp + 0xa4], eax
jmp 0x1400151f3
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x10]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rax, qword [rcx]
movabs r10, 0xd1e10f3e3c55d370
mov rax, qword [rax + 0x10]
call qword [case.0x1400569a6.0]
mov rbx, rax
mov rcx, qword [rax + 0x28]
mov rdx, qword [rcx]
movabs r10, 0xd281b7de72d36870
mov rax, qword [rdx + 0xe8]
call qword [case.0x1400569a6.0]
xor esi, esi
test al, al
je 0x140014cad
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rcx]
movabs r10, 0x915497707cde6370
mov rax, qword [rdx + 0x100]
call qword [case.0x1400569a6.0]
test al, al
je 0x140014cad
mov rcx, qword [rbx + 0x38]
mov rax, qword [rcx]
movabs r10, 0x9f9596941a5d7270
mov rax, qword [rax + 0x50]
call qword [case.0x1400569a6.0]
test al, al
je 0x140014cad
lea r8d, [rsi + 1]
mov cl, r8b
jmp 0x140014cb6
mov cl, sil
mov r8d, 1
mov al, r14b
mov byte [rbp + 0x55], cl
and al, r8b
mov qword [rbp + 0x30], r15
mov byte [rbp + 0x56], al
mov eax, r14d
shr eax, 0xa
and al, r8b
mov qword [rbp + 0x38], r12
mov byte [rbp + 0x57], al
lea rax, [rbp - 0x40]
mov qword [rbp + 0x28], rax
mov eax, r14d
shr eax, 8
test r8b, al
je 0x140014cf8
mov dl, r8b
mov word [rbp + 0x59], 0x101
mov byte [rbp + 0x5b], r8b
jmp 0x140014cfb
mov dl, byte [rbp + 0x58]
mov eax, r14d
mov rdi, rsi
shr eax, 9
mov r12d, 2
test r8b, al
movzx eax, dl
cmovne eax, r8d
mov byte [rbp + 0x58], al
test cl, cl
je 0x140014da4
lea ebx, [r12 + 0x3e]
xor edx, edx
mov r8d, ebx
lea rcx, [rbp + 0x220]
call sub.ntdll.dll_memset
xor r9d, r9d
lea rdx, [rbp + 0x220]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014d83
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11cb
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.NtQuerySystemInformation_SystemBasicInformation__SystemInformation__sizeof_SystemInformation___nullptr_
jmp 0x1400151d8
movzx eax, byte [rbp + 0x258]
cmp al, r12b
mov ecx, eax
cmovl ecx, r12d
movzx eax, cl
mov ecx, 0xa
cmp al, cl
cmovg eax, ecx
movsx rdi, al
mov rax, qword [r13]
movabs r10, 0xfe08361a5a541970
mov rax, qword [rax + 0x58]
lea rdx, [rbp - 8]
mov rcx, r13
call qword [case.0x1400569a6.0]
mov ebx, eax
test eax, eax
jns 0x140014dd4
mov dword [rbp + 0xa4], eax
jmp 0x1400151f3
xor ebx, ebx
mov qword [rbp], r13
cmp byte [rbp + 0x56], bl
je 0x140014e20
cmp byte [rbp + 0x55], bl
jne 0x140014e20
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11d9
mov qword [rsp + 0x68], rax
mov r8d, 0xc000000d
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov dword [rbp + 0xa4], 0xc000000d
mov qword [rsp + 0x70], rax
lea rax, str._GlobalContext.fPendingDeletesBehavior__GlobalContext.fAgainstUnbufferedSil
jmp 0x1400151df
movzx eax, byte [rbp - 0x10]
mov r12d, r14d
and r12d, 0x18
cmovne eax, ebx
mov byte [rbp - 0x10], al
test al, al
je 0x140015027
mov rax, qword [rbp - 0x40]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140014e47
int3
mov esi, 0x1f0003
lea rcx, [rbp - 0x40]
mov edx, esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtCreateIoCompletion]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014e97
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11e3
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::NtCreateIoCompletion_CompletionContext.DispatcherPort.GetInitPointer______0x000F0000L__0x00100000L_0x3___nullptr__0_
jmp 0x1400151d8
mov rax, qword [rbp - 0x38]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140014ea5
int3
xor r9d, r9d
lea rcx, [rbp - 0x38]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.ntdll.dll_NtCreateIoCompletion]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014ef0
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11e4
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::NtCreateIoCompletion_CompletionContext.WorkerPort.GetInitPointer______0x000F0000L__0x00100000L_0x3___nullptr__0_
jmp 0x1400151d8
cmp qword [rbp - 0x30], rbx
je 0x140014ef7
int3
mov r9d, 1
mov byte [rsp + 0x20], bl
xor r8d, r8d
lea rcx, [rbp - 0x30]
mov edx, esi
call qword [sym.imp.ntdll.dll_NtCreateEvent]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014f49
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11e6
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::NtCreateEvent_CompletionContext.DispatcherEvent.GetInitPointer______0x000F0000L__0x00100000L_0x3___nullptr__SynchronizationEvent__0__
jmp 0x1400151d8
cmp qword [rbp - 0x28], rbx
je 0x140014f50
int3
mov r9d, 1
mov byte [rsp + 0x20], bl
xor r8d, r8d
lea rcx, [rbp - 0x28]
mov edx, esi
call qword [sym.imp.ntdll.dll_NtCreateEvent]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014fa2
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11e7
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::NtCreateEvent_CompletionContext.WorkerEvent.GetInitPointer______0x000F0000L__0x00100000L_0x3___nullptr__SynchronizationEvent__0__
jmp 0x1400151d8
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [0x140016650]
call qword [sym.imp.ntdll.dll_TpSimpleTryPost]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
jns 0x140014fef
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11e9
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::TpSimpleTryPost_DispatcherCallback__CompletionContext__nullptr_
jmp 0x1400151d8
test rdi, rdi
je 0x140015027
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [0x1400167f0]
call qword [sym.imp.ntdll.dll_TpSimpleTryPost]
nop dword [rax + rax]
mov r8d, eax
test eax, eax
js 0x1400151b1
lock inc dword [rbp - 0x20]
inc rbx
cmp rbx, rdi
jb 0x140014ff4
xor ebx, ebx
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x148]
call qword [sym.imp.ntdll.dll_NtQueryPerformanceCounter]
nop dword [rax + rax]
mov rdi, qword [rbp + 0x3b0]
mov eax, r14d
shr eax, 1
test al, 1
je 0x140015136
cmp byte [rbp + 0xa0], bl
jne 0x140015136
mov rsi, qword [rbp + 0xc0]
xor edx, edx
lea rcx, [rbp + 0x1b0]
lea r8d, [rdx + 0x50]
call sub.ntdll.dll_memset
mov rax, qword [rbp - 0x78]
xorps xmm0, xmm0
mov qword [rbp + 0x208], rax
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x200], rdi
movabs r10, 0xc50ca71058d7e270
mov rcx, rax
lea r9, [rbp + 0xa0]
mov rax, qword [rbp + 0xb8]
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x1b0]
call qword [case.0x1400569a6.0]
cmp byte [rbp + 0xa0], bl
jne 0x14001523f
mov ebx, dword [rbp + 0x210]
lea rdx, [rbp + 0x1b0]
mov r8, rsi
call fcn.140014960
mov rax, qword [rbp + 0x200]
cmp ebx, 0x10
je 0x1400151fa
xor ebx, ebx
test rax, rax
je 0x14001512a
cmp dword [rbp + 0x210], ebx
je 0x14001512a
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x208]
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x1b0]
call qword [case.0x1400569a6.0]
cmp byte [rbp + 0xa0], bl
je 0x140015068
mov esi, r14d
mov dword [rbp + 0x170], ebx
shr esi, 5
xorps xmm0, xmm0
and esi, 1
movdqa xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x178], rbx
mov al, bl
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], rbx
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rbx
mov qword [rbp + 0x1a0], rbx
mov byte [rsp + 0x60], bl
test r12d, r12d
je 0x1400152d1
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.14000caf8
mov ebx, eax
test eax, eax
jns 0x1400152cb
mov dword [rbp + 0xa4], eax
xor esi, esi
jmp 0x14001564f
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x11ee
mov qword [rsp + 0x68], rax
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rsp + 0x70], rax
lea rax, str.::TpSimpleTryPost_WorkerCallback__CompletionContext__nullptr_
mov dword [rbp + 0xa4], r8d
lea rcx, [rsp + 0x68]
mov qword [rbp - 0x80], rax
call fcn.140052a48
mov ebx, dword [rbp + 0xa4]
xor esi, esi
jmp 0x140015667
xor ebx, ebx
mov byte [rbp + 0x54], 1
test rax, rax
je 0x140015136
cmp dword [rbp + 0x210], ebx
je 0x140015136
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x208]
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x1b0]
call qword [case.0x1400569a6.0]
jmp 0x140015136
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rsp + 0x78], 0x1213
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rbp - 0x80], rbx
mov r8d, 0xc000000d
mov qword [rsp + 0x70], rax
mov dword [rbp + 0xa4], 0xc000000d
call fcn.140052a48
mov rax, qword [rbp + 0x200]
xor esi, esi
mov ebx, dword [rbp + 0xa4]
test rax, rax
je 0x140015667
cmp dword [rbp + 0x210], esi
je 0x140015667
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x208]
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x1b0]
call qword [case.0x1400569a6.0]
jmp 0x140015667
mov al, byte [rsp + 0x60]
xor ebx, ebx
test al, al
je 0x1400152e5
mov eax, r14d
or esi, 4
shr eax, 3
test al, 1
je 0x1400152e5
or esi, 2
cmp byte [rbp + 0xa0], bl
jne 0x140015537
mov r12, qword [rbp - 0x70]
shr r14d, 2
and r14b, 1
test r14b, r14b
je 0x14001530b
cmp byte [rbp + 0x54], bl
jne 0x140015537
xor edx, edx
lea rcx, [rbp + 0xd0]
lea r8d, [rdx + 0x50]
call sub.ntdll.dll_memset
mov rax, qword [rbp - 0x78]
xorps xmm0, xmm0
mov qword [rbp + 0x128], rax
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x120], rdi
movabs r10, 0xc50ca71058d7e270
mov rcx, rax
lea r9, [rbp + 0xa0]
mov rax, qword [rbp + 0xb8]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xd0]
call qword [case.0x1400569a6.0]
cmp byte [rbp + 0xa0], bl
jne 0x1400154fe
lea rax, [rbp + 0x160]
mov rdx, r13
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0xd0]
mov ecx, esi
call fcn.1400146ac
mov edi, eax
cmp byte [rbp - 0x10], bl
jne 0x1400153af
mov r8, qword [rbp + 0xc0]
lea rdx, [rbp + 0xd0]
call fcn.140014960
mov eax, dword [rbp + 0x98]
test edi, edi
js 0x140015413
test eax, eax
js 0x140015411
mov rax, qword [rbp + 0x120]
inc r12
test rax, rax
je 0x1400153f9
cmp dword [rbp + 0x130], ebx
je 0x1400153f9
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x128]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xd0]
call qword [case.0x1400569a6.0]
mov rdi, qword [rbp + 0x3b0]
cmp byte [rbp + 0xa0], bl
je 0x1400152fd
jmp 0x140015537
test edi, edi
cmovns edi, eax
cmp byte [rbp - 0x10], bl
je 0x14001542d
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x14], edi
call fcn.14000dba4
mov ebx, eax
test eax, eax
js 0x140015459
test r15, r15
je 0x1400154a9
mov eax, dword [rbp + 0x130]
lea rdx, [r15 + 0x18]
lea rcx, [rbp + 0x130]
mov dword [r15 + 4], eax
mov dword [r15], edi
mov qword [r15 + 0x10], r12
call fcn.140008b40
mov ebx, eax
test eax, eax
jns 0x140015461
mov dword [rbp + 0xa4], ebx
jmp 0x1400154b6
mov rax, qword [rbp + 0x120]
xor ebx, ebx
test rax, rax
je 0x140015537
cmp dword [rbp + 0x130], ebx
je 0x140015537
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x128]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xd0]
call qword [case.0x1400569a6.0]
jmp 0x140015537
test edi, edi
js 0x1400154ae
int3
mov dword [rbp + 0xa4], edi
mov ebx, edi
mov rax, qword [rbp + 0x120]
xor esi, esi
test rax, rax
je 0x14001564f
cmp dword [rbp + 0x130], esi
je 0x14001564f
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x128]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xd0]
call qword [case.0x1400569a6.0]
jmp 0x14001564f
mov rax, qword [rbp + 0x120]
test rax, rax
je 0x140015537
cmp dword [rbp + 0x130], ebx
je 0x140015537
movabs r10, 0xca519ebc18d2a170
mov rcx, qword [rbp + 0x128]
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0xd0]
call qword [case.0x1400569a6.0]
cmp byte [rbp - 0x10], bl
je 0x1400156e8
lea rcx, [rbp - 0x40]
call fcn.14000dba4
xor esi, esi
mov ebx, eax
test eax, eax
jns 0x14001555c
mov dword [rbp + 0xa4], eax
jmp 0x14001564f
xor ebx, ebx
cmp byte [rbp - 0x10], bl
je 0x1400156e8
mov eax, dword [rbp - 0x14]
test eax, eax
jns 0x14001558a
test r15, r15
jne 0x1400156e8
mov ebx, dword [rbp - 0x14]
test ebx, ebx
js 0x14001557f
int3
mov dword [rbp + 0xa4], ebx
jmp 0x14001564f
mov ecx, dword [rbp - 0x18]
mov eax, dword [rbp - 0x1c]
cmp eax, ecx
je 0x1400156e8
mov eax, dword [rbp - 0x1c]
lea r8, str.ASYNC:_Did_not_complete_expected_number_of_operations.____Expected:_0____Actual:_1
mov qword [rbp + 0xb8], rax
lea rdx, [0x14007c7a8]
mov eax, dword [rbp - 0x18]
mov r9d, 2
mov qword [rbp + 0xc0], rax
xor ecx, ecx
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [0x140017390]
mov qword [rsp + 0x40], rax
lea rax, [0x1400659f8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x30], rax
lea rax, [0x140017390]
mov qword [rsp + 0x28], rax
lea rax, str.0132
mov qword [rsp + 0x20], rax
call fcn.14000c8d8
lea rax, str.onecore_basewcppoqpoqsil.cpp
mov dword [rbp - 0x58], 0x127f
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x68]
lea rax, str.RtlRunPrimitiveOperationsFromCallbacksAgainstSil
mov qword [rbp - 0x50], rbx
mov r8d, 0xc00000e5
mov qword [rbp - 0x60], rax
mov dword [rbp + 0xa4], 0xc00000e5
call fcn.140052a48
mov ebx, dword [rbp + 0xa4]
lea rcx, [rbp + 0x160]
call fcn.14000c9fc
lea rcx, [rbp + 0x160]
call fcn.140016e00
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140015690
mov qword [rbp + 0xa8], rsi
mov rax, qword [rcx]
movabs r10, 0xaaa4b7fc7cd10a70
mov rax, qword [rax]
call qword [case.0x1400569a6.0]
lea rcx, [rbp - 0x40]
call fcn.14000dd44
lea rcx, [rbp + 0x60]
call fcn.140015888
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x1400156d1
mov rcx, rdi
call fcn.140016fec
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, [rbp + 0x260]
mov qword [rbp + 0x10], rsi
call fcn.140016c94
mov eax, ebx
jmp 0x140015855
lea rcx, [rbp + 0x160]
call fcn.14000c9fc
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.ntdll.dll_NtQueryPerformanceCounter]
nop dword [rax + rax]
mov r9, qword [rbp + 0x140]
movabs rax, 0x431bde82d7b634db
imul qword [rbp + 0xb0]
sub r9, qword [rbp + 0x148]
mov edi, 1
mov r8, rdx
sar r8, 0x12
mov rcx, r8
shr rcx, 0x3f
add r8, rcx
mov qword [rbp + 0xb0], r8
jne 0x140015756
mov qword [rbp + 0xb0], rdi
mov r8d, edi
xor edx, edx
lea rsi, [0x14007c7a8]
mov rax, r9
mov rcx, rsi
div r8
mov qword [rbp + 0x150], rax
call fcn.140058958
shr eax, 0x11
test dil, al
je 0x1400157b4
lea rax, [rbp + 0x150]
mov r9, rdi
mov qword [rsp + 0x30], rax
lea r8, str.CSI_Perf_Trace_nCSIPERF:POQEXECUTE:us_n
lea rax, [0x140056630]
mov rdx, rsi
mov qword [rsp + 0x28], rax
mov ecx, edi
lea rax, [0x140065238]
mov qword [rsp + 0x20], rax
call fcn.14000c8d8
lea rcx, [rbp + 0x160]
mov byte [rbp + 0x298], dil
call fcn.14000c9fc
lea rcx, [rbp + 0x160]
call fcn.140016e00
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x1400157fc
mov qword [rbp + 0xa8], rbx
mov rax, qword [rcx]
movabs r10, 0xaaa4b7fc7cd10a70
mov rax, qword [rax]
call qword [case.0x1400569a6.0]
lea rcx, [rbp - 0x40]
call fcn.14000dd44
lea rcx, [rbp + 0x60]
call fcn.140015888
mov rbx, qword [rbp + 0x10]
xor edi, edi
test rbx, rbx
je 0x14001583f
mov rcx, rbx
call fcn.140016fec
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
lea rcx, [rbp + 0x260]
mov qword [rbp + 0x10], rdi
call fcn.140016c94
mov eax, dword [rbp + 0xa4]
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.14005cab0
mov rbx, qword [rsp + 0x498]
add rsp, 0x450
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret