Function at 0x1401bf7b8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x100
mov rsi, qword [rdx + 0x18]
xor r13d, r13d
mov r15, rcx
mov qword [rbp - 0x59], r13
mov qword [rbp + 0x7f], r13
mov edi, r13d
mov qword [rbp - 0x71], r13
mov r14, rdx
mov qword [rbp - 0x19], r13
lea r12d, [r13 + 1]
cmp dword [0x140452f70], r12d
mov qword [rbp - 0x41], r13
cmove rdi, qword [0x1404524f0]
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x61], r13
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x51], r13
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov qword [rbp + 7], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], r13
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x79]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x1404524f8]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x21]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452500]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x61]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452518]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x31]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452508]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x49]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452510]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x29]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452520]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x51]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rsi, qword [r14 + 0x18]
mov edi, r13d
cmp dword [0x140452f70], r12d
cmove rdi, qword [0x140452528]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x39]
mov rdx, rdi
mov rcx, rsi
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rax, qword [r15]
mov rbx, qword [rax + 0x20]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x19]
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rax, qword [r15]
mov rbx, qword [rax + 0x28]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x19]
lea r8, [rbp - 0x41]
mov rax, rbx
mov rcx, r15
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x41]
mov r12d, r13d
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x6f]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov r15d, r13d
cmp dword [rbp + 0x6f], r13d
jbe 0x1401bfd64
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x1401bfb10
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x59], r13
mov rbx, qword [rbp - 0x41]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x20]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea r8, [rbp - 0x59]
mov edx, r15d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x59]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp - 0x69]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1401bfb95
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp + 0x7f], r13
mov rbx, qword [rbp - 0x59]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea rdx, [rbp + 0x7f]
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x71]
test rbx, rbx
je 0x1401bfbe3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x71], r13
mov rbx, qword [rbp + 0x7f]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
lea r9, [rbp + 0x77]
lea r8, [rbp - 0x71]
mov rcx, rbx
lea rdx, str.metaInfoType
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
cmp dword [rbp + 0x77], 1
jne 0x1401bfd22
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeSku
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401bfc68
mov rax, qword [rbp + 0x7f]
lea rcx, [rbp - 0x11]
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x61]
mov rdx, qword [rbp - 0x21]
mov qword [rsp + 0x28], rcx
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.1401c1b68
jmp 0x1401bfd4d
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeLicense
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401bfca2
mov r9, qword [rbp + 0x7f]
lea rax, [rbp - 0x11]
mov r8, qword [rbp - 0x69]
mov rcx, r14
mov rdx, qword [rbp - 0x31]
mov qword [rsp + 0x20], rax
call fcn.1401c1410
jmp 0x1401bfd4d
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeFile
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401bfcdd
inc r12d
cmp dword [r14 + 8], r13d
jne 0x1401bfd57
mov r9, qword [rbp + 0x7f]
mov rcx, r14
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x49]
call fcn.1401c1220
jmp 0x1401bfd4d
mov rdx, qword [rbp - 0x71]
lea rcx, str.metaInfoTypeStoreToken
mov rdx, qword [rdx]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x1401bfd0b
mov r9, qword [rbp + 0x7f]
mov rcx, r14
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x29]
call fcn.1401c1070
jmp 0x1401bfd4d
mov rax, qword [rbp - 0x71]
lea rdx, [rbp - 0x11]
mov qword [rsp + 0x30], rdx
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
jmp 0x1401bfd30
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], r13
mov rax, qword [rbp + 0x7f]
mov rcx, r14
mov r9, qword [rbp - 0x69]
mov r8, qword [rbp - 0x61]
mov rdx, qword [rbp - 0x51]
mov qword [rsp + 0x20], rax
call fcn.1401c0b28
mov esi, eax
test eax, eax
js 0x1401bff3c
inc r15d
cmp r15d, dword [rbp + 0x6f]
jb 0x1401bfae8
cmp dword [r14 + 8], r13d
je 0x1401bfd96
cmp dword [0x140452f70], 1
mov r8, r13
mov rdx, qword [rbp - 0x49]
mov r9d, r12d
cmove r8, qword [0x140452530]
mov rcx, qword [r14 + 0x18]
call fcn.140187418
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rdx, qword [rbp - 0x39]
lea r8, [rbp - 0x11]
mov rcx, r14
call fcn.140182358
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x21]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x61]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x49]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x29]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x31]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x51]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rbx, qword [rbp - 0x79]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rdx, qword [rbp - 0x39]
mov rax, rdi
xor r8d, r8d
mov rcx, rbx
call rax
mov esi, eax
test eax, eax
js 0x1401bff3c
mov rdi, qword [r14 + 0x20]
mov rax, qword [rdi]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rdx, qword [rbp - 0x79]
mov rax, rbx
xor r8d, r8d
mov rcx, rdi
call rax
mov esi, eax
test eax, eax
jns 0x1401bff43
mov ecx, eax
call fcn.140082a8c
mov ecx, esi
call fcn.140082b34
mov r15d, 3
mov qword [rsp + 0x50], r13
lea rax, [0x140046ddc]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
lea rax, [rbp - 0x11]
mov edi, 0xb9
lea r14d, [r15 + 0x1d]
mov qword [rsp + 0x58], rax
mov r8d, r14d
xor r9d, r9d
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x39]
mov qword [rsp + 0x40], r15
lea rbx, [0x140028cdc]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x48], rbx
mov r8d, r14d
mov qword [rsp + 0x50], r13
lea rdx, [rsp + 0x40]
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x51]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x31]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x49]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x61]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x21]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
lea rdx, [rsp + 0x40]
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [rbp - 0x79]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x58], rax
mov r8d, r14d
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x50], r13
mov ecx, edi
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rbp - 0x41]
test rbx, rbx
je 0x1401c0109
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x41], r13
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x1401c0131
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp - 0x19], r13
mov rbx, qword [rbp - 0x71]
test rbx, rbx
je 0x1401c0152
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x71], r13
mov rbx, qword [rbp + 0x7f]
test rbx, rbx
je 0x1401c017a
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov qword [rbp + 0x7f], r13
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x1401c019e
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x140]
mov eax, esi
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret