Function at 0x1400018e0
Capabilities:
Get system information on windows

Disassembly:
push rbx
push r13
sub rsp, 0xc8
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
jne 0x140001953
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_open_process._Error_code:
call fcn.140005890
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140005a60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x140001b9c
lea rcx, [rsp + 0x68]
mov qword [rsp + 0xb0], r15
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r15, qword [rsp + 0x70]
xor bl, bl
mov qword [rsp + 0xa0], 0
mov dword [rsp + 0x98], 0
mov byte [rsp + 0x30], bl
cmp r15, qword [rsp + 0x78]
jae 0x140001b88
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xb8], r14
nop dword [rax + rax]
mov r9d, 0x30
lea r8, [rsp + 0x38]
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test dword [rsp + 0x58], 0x1000
je 0x140001b4b
mov eax, dword [rsp + 0x5c]
test al, 4
je 0x140001b4b
bt eax, 8
jb 0x140001b4b
mov rdx, qword [rsp + 0x50]
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9, qword [rsp + 0x50]
mov rdx, r15
mov r12, rax
mov rcx, r13
lea rax, [rsp + 0xa0]
mov r8, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140001b3a
mov r14, qword [rsp + 0xa0]
xor esi, esi
mov rbx, qword [0x14000b778]
mov rbp, qword [0x14000b780]
mov rcx, rbx
sub rcx, rbp
lea rax, [r14 + 1]
add rax, rcx
je 0x140001b3a
xor edi, edi
nop dword [rax]
mov r8, rbp
lea rcx, [rdi + r12]
sub r8, rbx
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140001b21
mov r8, qword [0x14000b768]
lea rax, [rsp + 0x98]
sub r8, qword [0x14000b760]
lea rbx, [rdi + r15]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9, qword [0x14000b768]
xor edi, edi
mov r8, qword [0x14000b760]
mov rdx, rbx
sub r9, r8
mov qword [rsp + 0x20], rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r8, qword [0x14000b768]
mov rdx, rbx
sub r8, qword [0x14000b760]
mov rcx, r13
mov r9d, dword [rsp + 0x98]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r14, qword [rsp + 0xa0]
mov rbp, qword [0x14000b780]
mov rbx, qword [0x14000b778]
mov byte [rsp + 0x30], 1
inc esi
mov rax, rbx
sub rax, rbp
mov edi, esi
inc rax
add rax, r14
cmp rdi, rax
jb 0x140001a70
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
add r15, qword [rsp + 0x50]
cmp r15, qword [rsp + 0x78]
jb 0x1400019c0
mov r14, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
movzx ebx, byte [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0xb0]
movzx eax, bl
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140006070
add rsp, 0xc8
pop r13
pop rbx
ret