Function at 0x14002fd20
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
xor r9d, r9d
lea rdx, [rbp - 0x59]
mov rsi, rcx
mov r8d, 0xb0
lea ecx, [r9 + 0x50]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x14003046a
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov qword [rsp + 0x100], rbx
xor r8d, r8d
mov rbx, qword [rbp + 7]
add rbx, qword [rbp - 1]
add rbx, qword [rbp - 9]
add rbx, qword [rbp - 0x11]
lea edx, [r8 + 1]
add rbx, qword [rbp - 0x19]
add rbx, qword [rbp - 0x21]
add rbx, qword [rbp - 0x29]
add rbx, qword [rbp - 0x31]
mov qword [rsp + 0x108], rdi
mov rdi, qword [rbp + 0x47]
add rdi, qword [rbp + 0x3f]
add rdi, qword [rbp + 0x37]
add rdi, qword [rbp + 0x2f]
add rdi, qword [rbp + 0x27]
add rdi, qword [rbp + 0x1f]
add rdi, qword [rbp + 0x17]
add rdi, qword [rbp + 0xf]
mov byte [rbp - 0x6f], al
mov rax, qword [rbp - 0x59]
shl rax, 0xc
mov dword [rbp - 0x79], 0x10c
mov qword [rbp - 0x69], rax
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x534
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x51]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x535
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x49]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x536
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x41]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x537
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x39]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x546
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
xor r8d, r8d
shl rbx, 0xc
mov dword [rbp - 0x79], 0x10c
mov byte [rbp - 0x6f], al
mov qword [rbp - 0x69], rbx
lea edx, [r8 + 1]
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x539
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x31]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x542
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x29]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x543
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x21]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x544
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dword [rbp - 0x79], 0x10c
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x19]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x545
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 0x11]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x554
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 9]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x555
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp - 1]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x556
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 7]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x557
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
mov dword [rbp - 0x79], 0x10c
xor r8d, r8d
shl rdi, 0xc
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
mov qword [rbp - 0x69], rdi
lea edx, [r8 + 1]
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x547
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0xf]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x548
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x17]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x549
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x1f]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54a
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x27]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54b
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
mov byte [rbp - 0x6f], al
mov rax, qword [rbp + 0x2f]
mov dword [rbp - 0x79], 0x10c
xor r8d, r8d
shl rax, 0xc
lea rcx, [rbp - 0x79]
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54c
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x37]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54d
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x3f]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54e
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x47]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x54f
mov rcx, rsi
mov r8, qword [rax + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
cmp dword [sym.ProcessJacker.exe_WindowsVersion], 0x3e
mov rdi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
jb 0x140030459
movzx eax, byte [0x140158690]
lea rcx, [rbp - 0x79]
mov byte [rbp - 0x6f], al
xor r8d, r8d
mov rax, qword [rbp + 0x4f]
shl rax, 0xc
mov qword [rbp - 0x69], rax
lea edx, [r8 + 1]
mov dword [rbp - 0x79], 0x10c
call sym.ProcessJacker.exe_PhFormat
mov rcx, rax
call sym.ProcessJacker.exe_PhAutoDereferenceObject
mov edx, 0x55d
mov r8, qword [rax + 8]
jmp 0x140030659
lea r8, [0x14012c110]
mov edx, 0x55d
jmp 0x140030659
lea r8, [0x140128998]
mov edx, 0x534
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x535
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x536
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x537
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x55d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x546
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x539
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x542
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x543
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x544
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x545
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x554
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x555
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x556
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x557
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x547
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x548
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x549
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54a
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54b
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54c
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea r8, [0x140128998]
mov edx, 0x54f
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rsi, qword [rsp + 0x110]
add rsp, 0xf0
pop rbp
ret