Function at 0x140176e0c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc8
xor r13d, r13d
lea rax, [r8 + 0x10]
mov r12, rcx
mov esi, r13d
mov r14d, r13d
mov qword [rbp - 0x69], r13
mov r15d, r13d
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x59], r13
mov qword [rbp + 0xf], rax
mov dword [rbp + 0x7f], r13d
cmp dword [r8 + 4], r13d
jle 0x1401772ad
mov ecx, r13d
mov qword [rbp - 0x41], rcx
mov rdi, qword [r8 + 8]
add rdi, rcx
mov qword [rbp - 0x49], rdi
test rsi, rsi
je 0x140176e9a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov qword [rbp - 0x69], r13
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.14006a0b8
mov r15d, eax
test eax, eax
js 0x140177a8b
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x140176ed3
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403b8660]
mov rcx, rbx
call rdi
mov qword [rbp - 0x59], r13
mov rsi, qword [r12 + 0x18]
mov rdi, r13
cmp dword [0x140438c18], 1
cmove rdi, qword [0x1404383c8]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403b8660]
lea r8, [rbp - 0x59]
mov rdx, rdi
mov rcx, rsi
call rbx
mov r15d, eax
test eax, eax
js 0x140177a8b
mov rax, qword [rbp - 0x59]
mov rbx, r13
mov qword [rbp - 0x29], rax
mov rsi, r13
lea rax, [0x1403d332c]
mov qword [rbp - 0x39], r13
mov qword [rbp - 0x61], rbx
mov rdi, r13
or r12, 0xffffffffffffffff
inc r12
cmp word [rax + r12*2], r13w
jne 0x140176f38
mov r13d, r12d
cmp r12, r13
je 0x140176f56
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x140176f5d
xor ecx, ecx
call fcn.14007ab44
mov rax, r12
sub rax, r13
neg rax
sbb r15d, r15d
and r15d, 0x80070216
mov ecx, r15d
call fcn.14007ab44
cmp r12, r13
je 0x140176f8d
mov ecx, r15d
call fcn.14007ab24
xor r13d, r13d
jmp 0x140177143
lea r12, [0x1403d332c]
mov r8d, 0x7fffffff
mov rcx, r12
lea rdx, [rbp - 0x51]
call fcn.14007a728
xor r13d, r13d
mov r15d, eax
test eax, eax
jns 0x140176fb9
mov ecx, eax
call fcn.14007ab24
jmp 0x140176fda
mov edx, dword [rbp - 0x51]
lea r8, [rbp - 0x61]
mov rcx, r12
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x140176fd6
mov ecx, eax
call fcn.14007ab24
mov rbx, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
jns 0x140176ff4
mov ecx, r15d
call fcn.14007ab24
jmp 0x140177143
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test rax, rax
jne 0x140177013
mov r12d, 0x8007000e
mov r15d, r12d
mov ecx, r12d
jmp 0x140176fea
test rbx, rbx
je 0x14017703b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov rbx, r13
mov qword [rbp - 0x61], rbx
mov rax, qword [rbp - 0x69]
test rax, rax
jne 0x1401770a5
mov r8d, 0x7fffffff
lea rdx, [rbp - 0x4d]
lea rcx, [0x1403c1978]
call fcn.14007a728
mov r15d, eax
test eax, eax
jns 0x14017706a
mov ecx, eax
call fcn.14007ab24
jmp 0x14017708f
mov edx, dword [rbp - 0x4d]
lea r8, [rbp - 0x61]
lea rcx, [0x1403c1978]
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x14017708b
mov ecx, eax
call fcn.14007ab24
mov rbx, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x140176fe7
mov rcx, rbx
jmp 0x1401770f9
or r12, 0xffffffffffffffff
inc r12
cmp word [rax + r12*2], r13w
jne 0x1401770a9
mov r13d, r12d
cmp r12, r13
je 0x1401770c7
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x1401770ce
xor ecx, ecx
call fcn.14007ab44
mov rax, r12
sub rax, r13
neg rax
sbb r15d, r15d
and r15d, 0x80070216
mov ecx, r15d
call fcn.14007ab44
cmp r12, r13
jne 0x140176f7d
mov rcx, qword [rbp - 0x69]
xor r13d, r13d
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x140177116
mov eax, 0x8007000e
mov r15d, eax
mov ecx, eax
jmp 0x140176fea
mov rcx, qword [rbp + 0x67]
mov r9, rax
mov r12, qword [rbp - 0x29]
mov r8, rsi
mov rdx, r12
mov rcx, qword [rcx + 0x18]
call fcn.14015fd2c
mov r15d, eax
test eax, eax
js 0x14017710f
lea rdx, [rbp - 0x39]
mov rcx, r12
call fcn.140077a84
mov ecx, r15d
call fcn.14007ab44
test rdi, rdi
je 0x140177159
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x140177167
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x140177188
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
xor r9d, r9d
mov qword [rbp - 0x21], 3
lea rax, [0x14001cb78]
mov qword [rbp - 0x11], r13
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x39]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 9], rax
call sub.ntdll.dll_NtQuerySystemInformation
test r15d, r15d
js 0x1401773ae
mov rdi, qword [rbp - 0x49]
mov ebx, r13d
mov r12, qword [rbp + 0x67]
cmp dword [rdi + 0x14], r13d
jle 0x140177255
test r14, r14
je 0x1401771fb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [r14 - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov qword [rbp - 0x31], r13
movsxd rcx, ebx
lea rdx, [rbp - 0x31]
shl rcx, 4
add rcx, qword [rdi + 0x18]
call fcn.14006a0b8
mov r15d, eax
test eax, eax
js 0x140177a8b
mov r14, qword [rbp - 0x31]
lea r9, str.skuId
mov rdx, qword [rbp - 0x59]
xor r8d, r8d
mov qword [rsp + 0x30], r13
mov rcx, r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
call fcn.140178bac
mov r15d, eax
test eax, eax
js 0x140177a8b
inc ebx
cmp ebx, dword [rdi + 0x14]
jl 0x1401771d6
mov r13, qword [rbp + 0x6f]
mov rax, qword [r13]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call qword [0x1403b8660]
mov rdx, qword [rbp - 0x59]
xor r8d, r8d
mov rcx, r13
call rbx
xor r13d, r13d
mov r15d, eax
test eax, eax
js 0x140177a8b
mov edx, dword [rbp + 0x7f]
mov rcx, qword [rbp - 0x41]
inc edx
mov r8, qword [rbp + 0x77]
add rcx, 0x20
mov rsi, qword [rbp - 0x69]
mov dword [rbp + 0x7f], edx
mov qword [rbp - 0x41], rcx
cmp edx, dword [r8 + 4]
jl 0x140176e6a
mov dword [rbp + 0x7f], r13d
cmp dword [r8 + 0x24], r13d
jle 0x140177a92
mov rax, r13
mov qword [rbp - 0x29], rax
mov rcx, qword [r8 + 0x28]
lea rax, [rax + rax*8]
lea rdi, [rcx + rax*8]
mov qword [rbp + 7], rdi
test rsi, rsi
je 0x1401772f7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov qword [rbp - 0x69], r13
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.14006a0b8
mov r15d, eax
test eax, eax
js 0x140177a8b
mov rbx, qword [rbp - 0x59]
test rbx, rbx
je 0x140177330
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1403b8660]
mov rcx, rbx
call rdi
mov qword [rbp - 0x59], r13
mov rsi, qword [r12 + 0x18]
mov rdi, r13
cmp dword [0x140438c18], 1
cmove rdi, qword [0x1404383d0]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403b8660]
lea r8, [rbp - 0x59]
mov rdx, rdi
mov rcx, rsi
call rbx
mov r15d, eax
test eax, eax
js 0x140177a8b
mov r13, qword [rbp - 0x59]
lea rcx, str.pkeyId
xor eax, eax
mov qword [rbp - 0x49], rax
mov ebx, eax
mov qword [rbp - 0x61], rax
mov esi, eax
mov edi, eax
or r14, 0xffffffffffffffff
inc r14
cmp word [rcx + r14*2], ax
jne 0x140177390
mov r12d, r14d
cmp r14, r12
je 0x1401773b6
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x1401773bd
mov ecx, r15d
jmp 0x140177a8d
xor ecx, ecx
call fcn.14007ab44
mov rax, r14
sub rax, r12
neg rax
sbb r15d, r15d
and r15d, 0x80070216
mov ecx, r15d
call fcn.14007ab44
cmp r14, r12
je 0x1401773ee
mov ecx, r15d
call fcn.14007ab24
mov r14, qword [rbp + 0x67]
jmp 0x14017759c
lea r14, str.pkeyId
mov r8d, 0x7fffffff
mov rcx, r14
lea rdx, [rbp - 0x4d]
call fcn.14007a728
xor r12d, r12d
mov r15d, eax
test eax, eax
jns 0x14017741a
mov ecx, eax
call fcn.14007ab24
jmp 0x14017743b
mov edx, dword [rbp - 0x4d]
lea r8, [rbp - 0x61]
mov rcx, r14
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x140177437
mov ecx, eax
call fcn.14007ab24
mov rbx, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x1401773dd
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rsi, rax
test rax, rax
jne 0x14017746a
mov r12d, 0x8007000e
mov r15d, r12d
mov ecx, r12d
jmp 0x1401773e0
test rbx, rbx
je 0x140177492
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov rbx, r12
mov qword [rbp - 0x61], rbx
mov rax, qword [rbp - 0x69]
test rax, rax
jne 0x1401774fc
mov r8d, 0x7fffffff
lea rdx, [rbp - 0x51]
lea rcx, [0x1403c1978]
call fcn.14007a728
mov r15d, eax
test eax, eax
jns 0x1401774c1
mov ecx, eax
call fcn.14007ab24
jmp 0x1401774e6
mov edx, dword [rbp - 0x51]
lea r8, [rbp - 0x61]
lea rcx, [0x1403c1978]
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x1401774e2
mov ecx, eax
call fcn.14007ab24
mov rbx, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x1401773dd
mov rcx, rbx
jmp 0x14017754d
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], r12w
jne 0x140177500
mov r12d, r14d
cmp r14, r12
je 0x14017751e
mov ecx, 0x80070216
call fcn.14007ab24
jmp 0x140177525
xor ecx, ecx
call fcn.14007ab44
mov rax, r14
sub rax, r12
neg rax
sbb r15d, r15d
and r15d, 0x80070216
mov ecx, r15d
call fcn.14007ab44
cmp r14, r12
jne 0x1401773dd
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x14017756a
mov eax, 0x8007000e
mov r15d, eax
mov ecx, eax
jmp 0x1401773e0
mov r14, qword [rbp + 0x67]
mov r9, rax
mov r8, rsi
mov rdx, r13
mov rcx, qword [r14 + 0x18]
call fcn.14015fd2c
mov r15d, eax
test eax, eax
jns 0x140177590
mov ecx, eax
call fcn.14007ab24
jmp 0x14017759c
lea rdx, [rbp - 0x49]
mov rcx, r13
call fcn.140077a84
mov ecx, r15d
call fcn.14007ab44
xor r13d, r13d
test rdi, rdi
je 0x1401775b5
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rsi, rsi
je 0x1401775c3
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x1401775e4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
xor r9d, r9d
mov qword [rbp - 0x21], 3
lea rax, [0x14001cb78]
mov qword [rbp - 0x11], r13
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x49]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 9], rax
call sub.ntdll.dll_NtQuerySystemInformation
test r15d, r15d
js 0x1401773ae
mov r13, qword [rbp + 7]
mov rax, qword [0x1403be410]
cmp rax, qword [r13 + 0x10]
jne 0x1401776e4
mov rcx, qword [0x1403be418]
cmp rcx, qword [r13 + 0x18]
jne 0x1401776e4
lea rdx, [r13 + 0x20]
cmp rax, qword [rdx]
jne 0x14017765a
cmp rcx, qword [rdx + 8]
je 0x14017797f
mov rbx, qword [rbp + 0xf]
lea r8, [rbp - 1]
mov rcx, rbx
call fcn.1401784ec
xor edi, edi
test al, al
je 0x14017797f
lea rcx, [rbp - 0x69]
call fcn.14007a0c8
movsxd rcx, dword [rbp - 1]
lea rdx, [rbp - 0x69]
shl rcx, 5
add rcx, 0x10
add rcx, qword [rbx + 8]
call fcn.14006a0b8
mov r15d, eax
test eax, eax
js 0x1401776d5
mov rsi, qword [rbp - 0x69]
lea r9, str.skuId
mov rdx, qword [rbp - 0x59]
lea r8d, [rdi + 1]
mov qword [rsp + 0x30], rdi
mov rcx, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
call fcn.140178bac
xor r14d, r14d
mov r15d, eax
test eax, eax
jns 0x140177986
mov ecx, eax
call fcn.14007ab24
xor r13d, r13d
jmp 0x140177a92
mov rax, qword [rbp - 0x69]
xor r14d, r14d
test rax, rax
je 0x140177713
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov qword [rbp - 0x69], r14
lea rdx, [rbp - 0x69]
lea rcx, [r13 + 0x10]
call fcn.14006a0b8
mov r15d, eax
test eax, eax
js 0x1401776d5
mov r12, qword [rbp - 0x59]
lea rax, str.skuId
mov qword [rbp - 0x49], r14
mov rsi, r14
mov qword [rbp - 0x61], r14
mov rdi, r14
mov rbx, r14
or r14, 0xffffffffffffffff
xor r15d, r15d
inc r14
cmp word [rax + r14*2], r15w
jne 0x14017774a
mov eax, r14d
cmp r14, rax
je 0x14017776d
mov eax, 0x80070216
mov ecx, eax
mov r15d, eax
call fcn.14007ab24
jmp 0x140177778
xor ecx, ecx
call fcn.14007ab44
mov dword [rbp - 0x39], r14d
mov ecx, r15d
call fcn.14007ab44
xor r14d, r14d
test r15d, r15d
jns 0x140177795
mov ecx, r15d
call fcn.14007ab24
jmp 0x14017790d
mov r8d, 0x7fffffff
lea rdx, [rbp + 3]
lea rcx, str.skuId
call fcn.14007a728
mov r15d, eax
test eax, eax
jns 0x1401777bb
mov ecx, eax
call fcn.14007ab24
jmp 0x1401777e0
mov edx, dword [rbp + 3]
lea r8, [rbp - 0x61]
lea rcx, str.skuId
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x1401777dc
mov ecx, eax
call fcn.14007ab24
mov rsi, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x140177788
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x14017780f
mov r12d, 0x8007000e
mov r15d, r12d
mov ecx, r12d
jmp 0x14017778b
test rsi, rsi
je 0x140177837
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ab44
mov rsi, r14
mov qword [rbp - 0x61], r14
cmp qword [rbp - 0x69], r14
jne 0x1401778b9
mov r8d, 0x7fffffff
lea rdx, [rbp - 0x41]
lea rcx, [0x1403c1978]
call fcn.14007a728
mov r15d, eax
test eax, eax
jns 0x140177863
mov ecx, eax
call fcn.14007ab24
jmp 0x140177888
mov edx, dword [rbp - 0x41]
lea r8, [rbp - 0x61]
lea rcx, [0x1403c1978]
call fcn.14007a880
mov r15d, eax
test eax, eax
jns 0x140177884
mov ecx, eax
call fcn.14007ab24
mov rsi, qword [rbp - 0x61]
mov ecx, r15d
call fcn.14007ab44
test r15d, r15d
js 0x140177788
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
jne 0x1401778e4
mov eax, 0x8007000e
mov r15d, eax
mov ecx, eax
jmp 0x14017778b
mov rsi, qword [rbp - 0x69]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rsi + rcx*2], r14w
jne 0x1401778c1
lea rdx, [rbp - 0x39]
call fcn.14007a6d4
mov r15d, eax
test eax, eax
jns 0x140177899
mov ecx, eax
call fcn.14007ab24
jmp 0x140177911
mov rcx, qword [rbp + 0x67]
mov r9, rax
mov r8, rdi
mov rdx, r12
mov rcx, qword [rcx + 0x18]
call fcn.14015fd2c
mov r15d, eax
test eax, eax
js 0x1401778b2
lea rdx, [rbp - 0x49]
mov rcx, r12
call fcn.140077a84
mov rsi, qword [rbp - 0x69]
mov ecx, r15d
call fcn.14007ab44
test rbx, rbx
je 0x140177927
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rdi, rdi
je 0x140177935
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rbp - 0x61]
call fcn.14007aa5c
xor r9d, r9d
mov qword [rbp - 0x21], 3
lea rax, [0x14001cb78]
mov qword [rbp - 0x11], r14
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x49]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 9], rax
call sub.ntdll.dll_NtQuerySystemInformation
test r15d, r15d
jns 0x140177986
mov ecx, r15d
jmp 0x1401776d7
mov rsi, qword [rbp - 0x69]
xor r14d, r14d
mov rax, qword [r13 + 0x30]
mov r12, qword [rbp + 0x67]
test rax, rax
je 0x1401779c6
mov rdx, qword [rbp - 0x59]
lea r9, [0x1403d3174]
mov qword [rsp + 0x30], r14
mov r8d, 1
mov qword [rsp + 0x28], r14
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140178bac
mov r15d, eax
test eax, eax
js 0x1401776d5
mov rax, qword [r13 + 0x38]
test rax, rax
je 0x140177a02
mov rdx, qword [rbp - 0x59]
lea r9, str.pid2
mov qword [rsp + 0x30], r14
mov r8d, 1
mov qword [rsp + 0x28], r14
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140178bac
mov r15d, eax
test eax, eax
js 0x1401776d5
mov rax, qword [r13 + 0x40]
xor r13d, r13d
test rax, rax
je 0x140177a3b
mov rdx, qword [rbp - 0x59]
lea r9, [0x1403d32ec]
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
mov qword [rsp + 0x28], r13
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140178bac
mov r15d, eax
test eax, eax
js 0x140177a8b
mov r13, qword [rbp + 0x6f]
mov rax, qword [r13]
mov rbx, qword [rax + 0xa8]
mov rcx, rbx
call qword [0x1403b8660]
mov rdx, qword [rbp - 0x59]
xor r8d, r8d
mov rcx, r13
call rbx
xor r13d, r13d
mov r15d, eax
test eax, eax
js 0x140177a8b
mov edx, dword [rbp + 0x7f]
mov rax, qword [rbp - 0x29]
inc edx
mov r8, qword [rbp + 0x77]
inc rax
mov dword [rbp + 0x7f], edx
mov qword [rbp - 0x29], rax
cmp edx, dword [r8 + 0x24]
jge 0x140177a92
jmp 0x1401772c2
mov ecx, eax
call fcn.14007ab24
mov ecx, r15d
call fcn.14007ab44
xor r9d, r9d
mov qword [rbp - 0x21], 3
lea rax, [0x14001cb78]
mov qword [rbp - 0x11], r13
mov qword [rbp - 0x19], rax
lea rdx, [rbp - 0x21]
lea rax, [rbp - 0x59]
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
mov qword [rbp - 9], rax
call sub.ntdll.dll_NtQuerySystemInformation
lea rcx, [rbp - 0x31]
call fcn.14007aa5c
lea rcx, [rbp - 0x69]
call fcn.14007aa5c
mov eax, r15d
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret