Function at 0x1401ab278
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov rax, qword [0x140418d28]
xor rax, rsp
mov qword [rbp], rax
mov rax, qword [rbp + 0x88]
xor esi, esi
mov rdi, qword [rbp + 0x80]
mov r13, rcx
mov qword [rbp - 0x68], r8
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x58], rdx
xor edx, edx
lea r8d, [rsi + 0x48]
mov qword [rbp - 0x70], r9
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x60], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
call sub.msvcrt.dll_memset
mov rax, qword gs:[0x58]
lea r14, [0x1403af0a0]
mov edx, 4
lea r15d, [rsi + 1]
xorps xmm0, xmm0
mov qword [rbp - 0x10], rsi
movdqa xmmword [rbp - 0x20], xmm0
lea rbx, str.msft:sl_EUL_ACTIVATED_PUBLIC
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140423480], eax
jg 0x1401ab6c8
mov rax, qword [rdi]
mov rbx, qword [rax + 0x28]
mov rcx, rbx
call qword [0x1403a2250]
lea r9, [rsp + 0x50]
mov rdx, r14
lea r8, [rsp + 0x48]
mov rcx, rdi
call rbx
mov ebx, eax
test eax, eax
js 0x1401ab5d0
cmp dword [rsp + 0x50], r15d
mov r12d, r15d
mov eax, 2
mov r15d, esi
cmove r12d, eax
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x1401ab38b
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
mov qword [rsp + 0x40], rsi
xor edi, edi
test r15d, r15d
jne 0x1401ab3a6
cmp dword [0x140423530], 1
mov r14d, esi
cmove rdi, qword [0x1404229f0]
jmp 0x1401ab3bb
mov r14d, 1
cmp dword [0x140423530], r14d
cmove rdi, qword [0x1404229f8]
mov rsi, qword [r13 + 0x18]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403a2250]
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call rbx
xor esi, esi
mov ebx, eax
test eax, eax
js 0x1401ab5d0
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14015d054
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov r8, qword [rbp - 0x78]
lea r9, [0x140423490]
mov rdx, qword [rbp - 0x70]
mov qword [rsp + 0x30], rcx
mov rcx, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call fcn.1401abe84
mov ebx, eax
test eax, eax
js 0x1401ab5d0
test r14d, r14d
je 0x1401ab593
mov r9, qword [rsp + 0x48]
mov rcx, r13
mov r8, qword [rsp + 0x40]
mov rdx, qword [r13 + 0x10]
mov r9, qword [r9]
call fcn.1401abd34
mov ebx, eax
test eax, eax
js 0x1401ab5d0
mov rsi, qword [rbp - 0x68]
mov rax, qword [rsi]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call qword [0x1403a2250]
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rsi
call rbx
xor esi, esi
mov ebx, eax
test eax, eax
js 0x1401ab5d0
mov rax, qword [rsp + 0x48]
or r14, 0xffffffffffffffff
mov rcx, qword [rax]
mov rax, r14
inc rax
cmp word [rcx + rax*2], si
jne 0x1401ab49f
cmp rax, 0x26
jne 0x1401ab55f
cmp word [rcx], 0x7b
je 0x1401ab4c8
mov edi, 0x80070057
mov ecx, edi
mov ebx, edi
call fcn.140078308
jmp 0x1401ab4ee
cmp word [rcx + 0x4a], 0x7d
jne 0x1401ab4b8
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.14006dc40
mov ebx, eax
test eax, eax
jns 0x1401ab4e9
mov ecx, eax
call fcn.140078308
mov edi, 0x80070057
mov ecx, ebx
call fcn.140078324
test ebx, ebx
js 0x1401ab5cc
lea r8, [rsp + 0x54]
lea rdx, str.msft:sl_EUL_ACTIVATED_PUBLIC
lea rcx, [rsp + 0x58]
call fcn.1400b5fdc
test al, al
je 0x1401ab584
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x60]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
mov rax, r14
inc rax
cmp word [rcx + rax*2], si
jne 0x1401ab52c
cmp rax, 0x26
jne 0x1401ab56e
cmp word [rcx], 0x7b
jne 0x1401ab574
cmp word [rcx + 0x4a], 0x7d
jne 0x1401ab574
add rcx, 2
lea rdx, [rbp - 0x30]
call fcn.14006dc40
mov edx, eax
test eax, eax
jns 0x1401ab57d
mov ecx, eax
jmp 0x1401ab578
cmp rax, 0x24
jne 0x1401ab4b8
jmp 0x1401ab4d3
cmp rax, 0x24
je 0x1401ab54c
mov edx, edi
mov ecx, edi
call fcn.140078308
mov ecx, edx
call fcn.140078324
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x50]
call fcn.140175278
jmp 0x1401ab5b9
mov rsi, qword [rbp - 0x58]
mov rax, qword [rsi]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call qword [0x1403a2250]
mov rdx, qword [rsp + 0x40]
xor r8d, r8d
mov rcx, rsi
call rbx
xor esi, esi
mov ebx, eax
test eax, eax
js 0x1401ab5d0
inc r15d
cmp r15d, r12d
jge 0x1401ab5d7
jmp 0x1401ab367
mov ecx, ebx
jmp 0x1401ab5d2
mov ecx, eax
call fcn.140078308
mov ecx, ebx
call fcn.140078324
mov r13d, 3
mov qword [rsp + 0x78], rsi
lea rax, [0x1400058e0]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp - 0x50]
mov r15d, 0xb9
lea r14d, [r13 + 0x1d]
mov qword [rbp - 0x80], rax
mov r8d, r14d
xor r9d, r9d
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14003a920]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rsi
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8d, r14d
mov ecx, r15d
call sub.ntdll.dll_NtQuerySystemInformation
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x1401ab674
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x48], rsi
lea rax, [0x140033aa0]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rsi
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8, r14
mov rcx, r15
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14035a4e0
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x140423480]
call fcn.14035aa48
cmp dword [0x140423480], 0xffffffff
jne 0x1401ab327
xor eax, eax
mov qword [0x140423498], rsi
mov qword [0x1404234a0], rax
lea rcx, [0x140423480]
or dword [0x1404234a4], 0xffffffff
lea rax, str.metaInfoType
mov qword [0x140423490], rax
xor eax, eax
mov qword [0x1404234b8], rax
mov qword [0x1404234d0], rax
mov dword [0x1404234b8], esi
mov dword [0x1404234bc], r15d
mov dword [0x1404234d0], r15d
mov dword [0x1404234d4], 0x18
mov dword [0x1404234a0], esi
mov qword [0x1404234a8], r14
mov qword [0x1404234b0], rsi
mov qword [0x1404234c0], rbx
mov qword [0x1404234c8], rsi
call fcn.14035a9e8
jmp 0x1401ab327