Function at 0x1400591dc
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
xor esi, esi
mov rdi, rdx
mov r14, rcx
mov dword [rbp - 0x61], esi
lea rdx, [0x140419910]
mov qword [rbp - 0x41], rsi
lea rcx, [0x1403fb8d0]
mov r12d, esi
mov r13, r9
mov rbx, r8
call fcn.1400e6a48
xor edx, edx
lea r8d, [rsi + 0x20]
lea rcx, [rbp - 0x39]
call sub.msvcrt.dll_memset
xorps xmm0, xmm0
mov qword [rbp - 0x21], rsi
xor edx, edx
lea r8d, [rsi + 0x30]
lea rcx, [rbp - 0x39]
movdqu xmmword [rbp - 0x31], xmm0
call sub.msvcrt.dll_memset
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], rsi
mov qword [rbp - 0x69], rsi
test rdi, rdi
jne 0x140059273
mov ecx, 0x80070057
mov esi, ecx
jmp 0x1400594d8
test rbx, rbx
je 0x140059267
test r13, r13
jne 0x1400592a1
mov ecx, 0x80070057
mov esi, ecx
call fcn.140078308
lea rdx, [0x140420ecc]
lea rcx, [0x1403fc5e8]
call fcn.1400e70c4
jmp 0x1400594dd
mov rbx, qword [0x140421ad0]
mov edi, 1
lea r12, [rbx + 8]
test r12, r12
je 0x1400592c3
mov edx, edi
mov rcx, r12
call fcn.140070fcc
mov dword [rbp - 0x61], edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
je 0x1400594cd
xor eax, eax
mov qword [rbp - 0x51], r15
mov qword [r15], rax
lea rdx, [0x14041ce24]
lea rcx, [0x140406904]
mov qword [r15 + 8], rax
call fcn.1400e63b8
mov rcx, r15
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x140059336
mov ecx, eax
call qword [sym.imp.RPCRT4.dll_I_RpcMapWin32Status]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
jmp 0x1400594d6
lea rax, [0x14001b4a0]
mov dword [rbp - 0x45], 0x10000
mov qword [rbp - 1], rax
lea rdx, [rbp - 9]
lea rax, [rbp - 0x49]
mov qword [rbp - 0x19], r14
mov qword [rbp + 7], rax
xor r9d, r9d
lea rax, [rbp - 0x39]
mov qword [rbp - 0x11], rbx
mov qword [rbp + 0xf], rax
mov ecx, 0xb9
lea rax, [rbp - 0x41]
mov qword [rbp - 9], 3
lea r8d, [r9 + 0x28]
mov qword [rbp + 0x17], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov esi, dword [rbp - 0x49]
test esi, esi
js 0x1400594d6
mov rbx, qword [rbp - 0x41]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xa8]
mov rcx, rdi
call qword [0x1403a2250]
mov rdx, qword [rbp + 0x6f]
lea r8, [rbp - 0x69]
mov rcx, rbx
call rdi
mov esi, eax
test eax, eax
jns 0x1400593c1
mov ecx, eax
jmp 0x1400594d8
mov edx, 1
lea r9, [rbp - 0x45]
lea rcx, [rbp - 0x59]
lea r8d, [rdx + 3]
call fcn.14005365c
mov esi, eax
test eax, eax
js 0x1400593ba
mov edx, 2
lea rcx, [rbp - 0x59]
mov r9, r15
lea r8d, [rdx + 0xe]
call fcn.14005365c
mov esi, eax
test eax, eax
js 0x1400593ba
lea rdx, [0x14041b7e8]
lea rcx, [0x1403fd298]
call fcn.1400e6d84
mov rcx, qword [rbp - 0x69]
lea rdx, [rbp + 0x6f]
mov r8d, 0x7fffffff
call fcn.1400753fc
mov esi, eax
test eax, eax
js 0x1400593ba
mov r9, qword [rbp - 0x69]
lea rcx, [rbp - 0x59]
mov r8d, dword [rbp + 0x6f]
mov edx, 3
call fcn.14005365c
mov esi, eax
test eax, eax
js 0x1400593ba
mov r8, qword [rbp + 0x77]
lea rcx, [rbp - 0x59]
mov rdx, r13
call fcn.1400535bc
mov esi, eax
test eax, eax
js 0x1400593ba
mov rbx, qword [r14 + 0x30]
test rbx, rbx
je 0x140059480
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [r14 + 0x30], 0
and qword [rbp - 0x51], 0
mov rbx, qword [r14 + 0x38]
mov qword [r14 + 0x30], r15
test rbx, rbx
je 0x1400594ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [r14 + 0x38], 0
mov rbx, qword [rbp - 0x69]
lea rdx, [0x140419e64]
and qword [rbp - 0x69], 0
lea rcx, [0x140403ca8]
call fcn.1400e6704
mov qword [r14 + 0x38], rbx
jmp 0x1400594dd
mov qword [rbp - 0x51], rsi
mov esi, 0x8007000e
mov ecx, esi
call fcn.140078308
mov ecx, esi
call fcn.140078324
lea rcx, [rbp - 0x69]
call fcn.1400595fc
lea rcx, [rbp - 0x51]
call fcn.140059558
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x140059514
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403a2250]
mov rcx, rbx
call rdi
lea rcx, [rbp - 0x39]
call fcn.1400570b0
lea rcx, [rbp - 0x41]
call fcn.14005700c
test r12, r12
je 0x140059539
cmp dword [rbp - 0x61], 0
je 0x140059539
mov rcx, r12
call fcn.140070e60
mov eax, esi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret