Function at 0x140017600
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov qword [rcx + 4], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x868], r15
mov qword [rcx + 0x860], r15
mov dword [rcx], r15d
mov dword [rcx + 0x28], r15d
mov dword [rcx + 0x234], r15d
mov dword [rcx + 0x440], r15d
mov qword [rcx + 0xc], r15
mov dword [rcx + 0x14], r15d
mov qword [rcx + 0x858], r15
mov dword [rcx + 0x878], r15d
mov qword [rcx + 0x870], 0xffffffffffffffff
add rcx, 0x2c
xor edx, edx
mov r8d, 0x208
call fcn.14005fd20
lea rcx, [rdi + 0x238]
xor edx, edx
mov r8d, 0x208
call fcn.14005fd20
lea rcx, [rdi + 0x444]
xor edx, edx
mov r8d, 0x208
call fcn.14005fd20
xor edx, edx
mov r8d, 0x208
lea rcx, [rdi + 0x64c]
call fcn.14005fd20
lea rcx, [rdi + 0x87c]
xor edx, edx
mov r8d, 0x2698
call fcn.14005fd20
lea rbx, [rdi + 0x2f18]
mov qword [rsp + 0x20], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x30]
call fcn.14003ef04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rdi + 0x2f28]
call fcn.14003d260
nop
lea rcx, [rdi + 0x2f90]
call fcn.1400370d0
nop
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017eed
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x30d8], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017ef8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x30f8], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f03
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3100], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f0e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x31b0], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f19
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x31e0], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f24
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x31e8], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f2f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x31f0], rax
mov qword [rdi + 0x3210], r15
mov qword [rdi + 0x3218], r15
mov qword [rdi + 0x3220], r15
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f3a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3248], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f45
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3250], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f50
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3258], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f5b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3260], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f66
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3268], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f71
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3270], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f7c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3278], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017f87
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3280], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140017ee2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi + 0x3288], rax
lea rbx, [rdi + 0x3380]
mov qword [rsp + 0x20], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x30]
call fcn.14003ef04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 0x3390], r15
mov qword [rdi + 0x3398], r15
mov qword [rdi + 0x33a0], r15
lea rbx, [rdi + 0x33a8]
mov qword [rsp + 0x20], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x50]
call fcn.14003ef04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 0x33b8], r15
mov qword [rdi + 0x33c0], r15
mov qword [rdi + 0x33c8], r15
mov qword [rdi + 0x33d0], r15
mov qword [rdi + 0x33d8], r15
mov qword [rdi + 0x33e0], r15
mov qword [rdi + 0x33e8], r15
mov qword [rdi + 0x33f0], r15
mov qword [rdi + 0x33f8], r15
mov qword [rdi + 0x3400], r15
mov qword [rdi + 0x3408], r15
mov qword [rdi + 0x3410], r15
mov qword [rdi + 0x3418], r15
mov qword [rdi + 0x3420], r15
mov qword [rdi + 0x3428], r15
mov qword [rdi + 0x3430], r15
mov qword [rdi + 0x3438], r15
mov qword [rdi + 0x3440], r15
lea rcx, [rdi + 0x3448]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
lea edx, [r15 + 2]
call fcn.14003e3cc
nop
mov qword [rdi + 0x3498], r15
mov qword [rdi + 0x34a0], r15
mov qword [rdi + 0x34a8], r15
mov qword [rdi + 0x34b0], r15
mov qword [rdi + 0x34b8], r15
mov qword [rdi + 0x34c0], r15
mov qword [rdi + 0x34c8], r15
mov qword [rdi + 0x34d0], r15
mov qword [rdi + 0x34d8], r15
mov qword [rdi + 0x34e0], r15
mov qword [rdi + 0x34e8], r15
mov qword [rdi + 0x34f0], r15
mov qword [rdi + 0x34f8], r15
mov qword [rdi + 0x3500], r15
mov qword [rdi + 0x3508], r15
mov qword [rdi + 0x3510], r15
mov qword [rdi + 0x3518], r15
mov qword [rdi + 0x3520], r15
mov qword [rdi + 0x3528], r15
mov qword [rdi + 0x3530], r15
mov qword [rdi + 0x3538], r15
mov qword [rdi + 0x3540], r15
mov qword [rdi + 0x3548], r15
mov qword [rdi + 0x3550], r15
mov qword [rdi + 0x3558], r15
mov qword [rdi + 0x3560], r15
mov qword [rdi + 0x3568], r15
mov qword [rdi + 0x3570], r15
mov qword [rdi + 0x3578], r15
mov qword [rdi + 0x3580], r15
mov qword [rdi + 0x3588], r15
mov qword [rdi + 0x3590], r15
mov qword [rdi + 0x3598], r15
mov qword [rdi + 0x35a0], r15
mov qword [rdi + 0x35a8], r15
mov qword [rdi + 0x35b0], r15
mov qword [rdi + 0x35b8], r15
mov qword [rdi + 0x35c0], r15
mov qword [rdi + 0x35c8], r15
mov qword [rdi + 0x35d0], r15
mov qword [rdi + 0x35d8], r15
mov qword [rdi + 0x35e0], r15
mov qword [rdi + 0x35e8], r15
mov qword [rdi + 0x35f0], r15
mov qword [rdi + 0x35f8], r15
mov qword [rdi + 0x3600], r15
mov qword [rdi + 0x3608], r15
mov qword [rdi + 0x3610], r15
mov qword [rdi + 0x3618], r15
mov qword [rdi + 0x3620], r15
mov qword [rdi + 0x3628], r15
mov qword [rdi + 0x3630], r15
mov qword [rdi + 0x3638], r15
mov qword [rdi + 0x3640], r15
mov qword [rdi + 0x3648], r15
mov qword [rdi + 0x3650], r15
mov qword [rdi + 0x3658], r15
mov qword [rdi + 0x3660], r15
mov qword [rdi + 0x3668], r15
mov qword [rdi + 0x3670], r15
mov qword [rdi + 0x3678], r15
mov qword [rdi + 0x3680], r15
mov qword [rdi + 0x3688], r15
mov qword [rdi + 0x3690], r15
mov qword [rdi + 0x3698], r15
mov qword [rdi + 0x36a0], r15
lea rbx, [rdi + 0x36a8]
mov qword [rsp + 0x20], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x30]
call fcn.14003ef04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi + 0x36e8], r15
mov qword [rdi + 0x36f0], r15
mov qword [rdi + 0x36f8], r15
lea rbx, [rdi + 0x3700]
mov qword [rsp + 0x20], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
lea ecx, [r15 + 0x40]
call fcn.14003ef04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rcx, [rdi + 0x3718]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
lea edx, [r15 + 2]
call fcn.14003e3cc
nop
lea rcx, [rdi + 0x3768]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
lea edx, [r15 + 2]
call fcn.14003e3cc
nop
lea rcx, [rdi + 0x37b8]
mov dword [rcx], r15d
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], r15
lea edx, [r15 + 2]
call fcn.14003e3cc
nop
mov qword [rdi + 0x3808], r15
mov qword [rdi + 0x3810], r15
mov qword [rdi + 0x3818], r15
lea rcx, [rdi + 0x30a8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [rdi + 0x30f8]
call fcn.140002ef0
mov qword [rdi + 0x30f0], r15
lea r9, [r15 - 1]
lea r8, str.ProcessLasso
mov edx, 0x104
lea rcx, [rdi + 0x64c]
call fcn.14004badc
lea rax, str.processlasso.exe
mov qword [rdi + 0x858], rax
mov rax, qword [0x1400862e0]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x14], r15d
lea rcx, [rdi + 0x32e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x36c0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x3080]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x3290]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x32b8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x3308]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x3330]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rdi + 0x3358]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [rdi + 0x3130], r15b
mov byte [rdi + 0x3166], r15b
mov byte [rdi + 0x3181], r15b
mov byte [rdi + 0x3188], r15b
mov rcx, rdi
call fcn.140018780
mov qword [rdi + 0x3128], r15
mov qword [rdi + 0x3110], r15
mov qword [rdi + 0x3118], r15
mov qword [rdi + 0x3120], r15
mov dword [rdi + 0x3108], 3
lea r9, str.Lasso777
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x3110], rax
lea r9, str.Lasso888_2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x3118], rax
lea r9, str.49da4c63_c475_4b6c_83f3_c78a9fe813c2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x3120], rax
lea rdx, [rdi + 0x3258]
mov rcx, rdi
call fcn.140026fd0
nop
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3