Function at 0x140175f3c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140425b28]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa0]
mov r12, r8
mov r15, qword [rbp + 0xa8]
mov rbx, rdx
mov qword [rbp - 0x70], rax
mov r13, rcx
xor eax, eax
mov qword [rsp + 0x48], r9
xor edx, edx
mov qword [rbp - 0x78], r15
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov edi, eax
lea r8d, [rax + 0x48]
mov qword [rsp + 0x60], rax
mov esi, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8, [rbp - 0x68]
lea rdx, [rbp]
call fcn.140176f68
mov r14d, eax
test eax, eax
jns 0x140175fdd
mov ecx, eax
call fcn.1400790f8
jmp 0x14017610d
cmp dword [rsp + 0x38], esi
je 0x140175ffa
lea r8, [rbp - 0x68]
mov rcx, r15
lea rdx, [rbp]
call fcn.140178930
mov r14d, eax
test eax, eax
js 0x140175fd1
mov r15, qword [r13 + 0x18]
xor r14d, r14d
cmp dword [0x14042fef8], 1
cmove r14, qword [0x14042f5a0]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
mov rcx, rbx
call qword [0x1403af620]
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r15
call rbx
xor ebx, ebx
mov r14d, eax
test eax, eax
js 0x140175fd1
mov eax, dword [rbp + 0x98]
test al, 0x40
je 0x140176265
xor r12d, r12d
cmp dword [0x14042fef8], 1
jne 0x140176063
mov r9, qword [0x14042f680]
mov r8, qword [0x14042f678]
jmp 0x140176069
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [rbp + 0x90], 4
jne 0x14017623a
lea rdx, [0x1403b56a4]
mov rcx, qword [rsp + 0x48]
mov r8d, dword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140078210
mov r14d, eax
test eax, eax
js 0x140175fd1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x1401760d3
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140175fd3
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov r14, qword [rax + 0xd8]
mov rcx, r14
call qword [0x1403af620]
mov rdx, rdi
mov rcx, rbx
call r14
mov r14d, eax
test eax, eax
js 0x140175fd1
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.14007613c
mov ecx, r14d
call fcn.140079118
mov r15d, 3
lea rax, [0x140033df8]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x68], r15
mov ebx, 0xb9
mov qword [rbp - 0x80], rax
lea r13d, [r15 + 0x1d]
xor r12d, r12d
mov r8d, r13d
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x140019438]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8d, r13d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x1401761a9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
test rdi, rdi
je 0x1401761b7
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401761e5
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140079118
mov ebx, 0xb9
lea rax, [0x140011f38]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x78], r12
xor r9d, r9d
mov qword [rbp - 0x80], rax
mov r8, r13
mov rcx, rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140368700
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp dword [0x14042fef8], 1
mov r9d, 1
mov rdx, qword [rsp + 0x30]
mov r8, r12
cmove r8, qword [0x14042f670]
mov rcx, qword [r13 + 0x18]
call fcn.1401783b8
jmp 0x1401760f4
test al, al
jns 0x1401762b9
xor r12d, r12d
cmp dword [0x14042fef8], 1
jne 0x140176285
mov r9, qword [0x14042f688]
mov r8, qword [0x14042f678]
jmp 0x14017628b
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [rbp + 0x90], 4
jne 0x14017623a
lea rdx, [0x1403b7d20]
jmp 0x140176096
bt eax, 8
jae 0x140176325
xor r12d, r12d
cmp dword [0x14042fef8], 1
jne 0x1401762db
mov r9, qword [0x14042f690]
mov r8, qword [0x14042f678]
jmp 0x1401762e1
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [rbp + 0x90], 8
jne 0x14017623a
mov rcx, qword [rsp + 0x48]
lea rdx, str._I64u
mov r8, qword [rcx]
lea rcx, [rsp + 0x40]
call fcn.140078210
jmp 0x1401760a8
bt eax, 9
jae 0x1401763a1
mov ebx, 1
xor r12d, r12d
cmp dword [0x14042fef8], ebx
jne 0x14017634b
mov r9, qword [0x14042f698]
mov r8, qword [0x14042f678]
jmp 0x140176351
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x140176393
mov eax, edx
and eax, ebx
test al, al
jne 0x140176393
mov rcx, qword [rsp + 0x48]
lea r8, [rsp + 0x40]
shr rdx, 1
call fcn.140078c04
jmp 0x1401760a8
cmp dword [0x14042fef8], ebx
mov r9d, ebx
jmp 0x140176247
bt eax, 0xa
jae 0x1401765b0
cmp dword [0x14042fef8], 1
jne 0x1401763c4
mov r9, qword [0x14042f6a0]
mov r8, qword [0x14042f678]
jmp 0x1401763ca
mov r9, rbx
mov r8, rbx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov r8d, dword [rbp + 0x90]
mov rcx, r13
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.1401777f0
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [rsp + 0x54], ebx
je 0x1401760ff
cmp dword [rsp + 0x38], ebx
je 0x1401760ff
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], bx
jne 0x140176429
cmp rax, 0x26
jne 0x14017646a
cmp word [r12], 0x7b
jne 0x140176475
cmp word [r12 + 0x4a], 0x7d
jne 0x140176475
lea rcx, [r12 + 2]
lea rdx, [rbp - 0x50]
call fcn.14006e5fc
xor r12d, r12d
mov ebx, eax
test eax, eax
jns 0x140176484
mov ecx, eax
call fcn.1400790f8
jmp 0x140176484
cmp rax, 0x24
jne 0x140176475
mov rcx, r12
jmp 0x14017644f
mov ecx, 0x80070057
mov ebx, ecx
call fcn.1400790f8
xor r12d, r12d
mov ecx, ebx
call fcn.140079118
test ebx, ebx
js 0x1401760ff
movups xmm0, xmmword [rbp - 0x68]
lea r8, [rsp + 0x38]
lea rdx, [0x1403ca104]
lea rcx, [rsp + 0x50]
movdqu xmmword [rbp - 0x40], xmm0
call fcn.1400b867c
test al, al
je 0x140176512
movsxd rax, dword [rsp + 0x38]
shl rax, 4
add rax, qword [rsp + 0x58]
mov r14, qword [rax + 8]
test r14, r14
jne 0x1401764d6
mov r14d, r12d
mov qword [rbp - 0x20], r12
jmp 0x1401764fd
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140079118
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, r14
call fcn.140078e54
mov r14d, eax
test eax, eax
jns 0x1401764fd
mov ecx, eax
call fcn.1400790f8
mov ecx, r14d
call fcn.140079118
test r14d, r14d
jns 0x140176512
mov ecx, r14d
jmp 0x140175fd3
lea r8, [rsp + 0x38]
lea rdx, str.pid2
lea rcx, [rsp + 0x50]
call fcn.1400b867c
test al, al
je 0x14017659e
movsxd r15, dword [rsp + 0x38]
mov rax, qword [rsp + 0x58]
add r15, r15
mov r14, qword [rax + r15*8 + 8]
test r14, r14
jne 0x14017654c
mov r14d, r12d
mov qword [rbp - 0x18], r12
jmp 0x140176573
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140079118
lea r8, [rbp - 0x18]
mov edx, ebx
mov rcx, r14
call fcn.140078e54
mov r14d, eax
test eax, eax
jns 0x140176573
mov ecx, eax
call fcn.1400790f8
mov ecx, r14d
call fcn.140079118
test r14d, r14d
js 0x14017650a
mov rax, qword [rsp + 0x58]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax + r15*8 + 8]
call fcn.140069ff8
mov r14d, eax
test eax, eax
js 0x140175fd1
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call fcn.14017854c
jmp 0x1401760f4
xor r12d, r12d
bt eax, 0xb
jae 0x140176622
cmp dword [0x14042fef8], 1
jne 0x1401765d2
mov r9, qword [0x14042f6a8]
mov r8, qword [0x14042f678]
jmp 0x1401765d8
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [rbp + 0x90], 0x10
jne 0x14017623a
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.1400687d0
mov rsi, qword [rsp + 0x60]
test eax, eax
js 0x14017623a
mov rcx, rsi
jmp 0x1401760b8
bt eax, 0xc
jae 0x140176658
cmp dword [0x14042fef8], 1
jne 0x140176671
mov r9, qword [0x14042f6b0]
jmp 0x140176668
test ebx, ebx
je 0x1401760ff
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov edx, ebx
call fcn.140067bfc
jmp 0x1401760a8
cmp dword [0x14042fef8], 1
jne 0x140176671
mov r9, qword [0x14042f6b8]
mov r8, qword [0x14042f678]
jmp 0x140176677
mov r9, r12
mov r8, r12
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.14015acfc
mov r14d, eax
test eax, eax
js 0x140175fd1
cmp dword [0x14042fef8], 1
mov r8, r12
mov ebx, dword [rbp + 0x90]
mov r9d, ebx
cmove r8, qword [0x14042f6c0]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.1401783b8
mov r14d, eax
test eax, eax
jns 0x14017663a
jmp 0x140175fd1