Function at 0x14002f2e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140280d40]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword gs:[0x58]
mov rbx, rdx
mov r14d, 4
mov rbp, rcx
add r14, qword [rax]
mov eax, dword [r14]
cmp dword [0x14028c148], eax
jg 0x14002f4d3
mov eax, dword [r14]
cmp dword [0x14028c158], eax
jg 0x14002f521
mov eax, dword [r14]
xor r15d, r15d
cmp dword [0x14028c168], eax
mov edi, 0x8664
mov esi, 0x14c
jg 0x14002f56f
mov rax, qword [0x14028c160]
test rax, rax
je 0x14002f408
lea r8, [rbx + 2]
mov rdx, rbx
mov rcx, rbp
call rax
test eax, eax
je 0x14002f427
cmp word [rbx], r15w
je 0x14002f38a
mov byte [rbx + 4], 1
jmp 0x14002f45c
movzx esi, word [rbx + 2]
mov byte [rbx + 4], r15b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rbp, rax
je 0x14002f403
mov eax, dword [r14]
cmp dword [0x14028c138], eax
jg 0x14002f485
mov rax, qword [0x14028c140]
test rax, rax
je 0x14002f400
xorps xmm0, xmm0
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x30]
mov r9d, 0x40
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov rcx, rbp
movups xmmword [rsp + 0x40], xmm0
lea edx, [r9 - 0x1b]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call rax
test eax, eax
js 0x14002f400
movzx edi, word [rsp + 0x70]
test di, di
jne 0x14002f403
movzx edi, si
mov word [rbx], di
jmp 0x14002f45c
mov rax, qword [0x14028c150]
test rax, rax
je 0x14002f44a
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
mov rcx, rbp
call rax
test eax, eax
jne 0x14002f42b
xor al, al
jmp 0x14002f45e
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
sete al
mov byte [rbx + 4], al
movzx eax, word [0x14028c16c]
test ecx, ecx
jne 0x14002f445
mov esi, eax
mov word [rbx], si
jmp 0x14002f458
movzx eax, word [0x14028c16c]
mov word [rbx], ax
mov byte [rbx + 4], r15b
mov word [rbx + 2], ax
mov al, 1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140162ed0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14028c138]
call fcn.140162ce4
cmp dword [0x14028c138], 0xffffffff
jne 0x14002f3ac
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14028c138]
mov qword [0x14028c140], rax
call fcn.140162c78
jmp 0x14002f3ac
lea rcx, [0x14028c148]
call fcn.140162ce4
cmp dword [0x14028c148], 0xffffffff
jne 0x14002f32c
lea rcx, [0x1402532b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x140255c70]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14028c148]
mov qword [0x14028c150], rax
call fcn.140162c78
jmp 0x14002f32c
lea rcx, [0x14028c158]
call fcn.140162ce4
cmp dword [0x14028c158], 0xffffffff
jne 0x14002f33b
lea rcx, [0x1402532b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process2
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x14028c158]
mov qword [0x14028c160], rax
call fcn.140162c78
jmp 0x14002f33b
lea rcx, [0x14028c168]
call fcn.140162ce4
cmp dword [0x14028c168], 0xffffffff
jne 0x14002f357
xorps xmm0, xmm0
mov dword [rsp + 0x30], r15d
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14002f5cb
cmp dword [rsp + 0x30], r15d
je 0x14002f5cb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x14002f5d6
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x40]
test eax, eax
je 0x14002f607
cmp eax, 6
je 0x14002f600
cmp eax, 9
je 0x14002f5fb
cmp eax, 0xc
je 0x14002f5f4
movzx eax, r15w
jmp 0x14002f60a
mov eax, 0xaa64
jmp 0x14002f60a
movzx eax, di
jmp 0x14002f60a
mov eax, 0x200
jmp 0x14002f60a
movzx eax, si
lea rcx, [0x14028c168]
mov word [0x14028c16c], ax
call fcn.140162c78
jmp 0x14002f357