Function at 0x140185f0c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x28]
sub rsp, 0x128
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0xa0]
mov rbx, rdx
mov r15, qword [rbp + 0xa8]
mov r13, rcx
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x50]
xor eax, eax
mov qword [rbp - 0x80], r8
xor edx, edx
mov qword [rbp - 0x78], r15
mov r12, r9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov edi, eax
lea r8d, [rax + 0x48]
mov qword [rsp + 0x58], rax
mov esi, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x38]
mov rcx, rbx
lea r8, [rbp - 0x68]
lea rdx, [rbp]
call fcn.140187b30
xor ebx, ebx
mov r14d, eax
test eax, eax
jns 0x140185fae
mov ecx, eax
call fcn.140082a8c
jmp 0x1401860de
cmp dword [rsp + 0x38], ebx
je 0x140185fcb
lea r8, [rbp - 0x68]
mov rcx, r15
lea rdx, [rbp]
call fcn.1401879a8
mov r14d, eax
test eax, eax
js 0x140185fa2
mov r15, qword [r13 + 0x18]
mov rax, qword [r15]
mov rbx, qword [rax + 0x178]
xor eax, eax
cmp dword [0x140452c58], 1
mov r14d, eax
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
cmove r14, qword [0x1404522f0]
call rax
mov rax, rbx
lea r8, [rsp + 0x30]
mov rdx, r14
mov rcx, r15
call rax
xor ecx, ecx
mov r14d, eax
test eax, eax
js 0x140185fa2
mov eax, dword [rbp + 0x98]
test al, 0x40
je 0x14018623d
cmp dword [0x140452c58], 1
jne 0x140186039
mov r9, qword [0x1404523d0]
mov r8, qword [0x1404523c8]
jmp 0x14018603f
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
jns 0x14018605c
mov ecx, r14d
jmp 0x140185fa4
cmp dword [rbp + 0x90], 4
jne 0x14018620f
lea rdx, [0x1403d7304]
jmp 0x14018628b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
jne 0x14018608d
mov rdi, r12
jmp 0x140186092
test rdi, rdi
jne 0x14018609f
mov ecx, 0x8007000e
mov r14d, ecx
jmp 0x140185fa4
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov r14, qword [rax + 0xd8]
mov rax, qword [0x1403cf6d0]
mov rcx, r14
call rax
mov rax, r14
mov rdx, rdi
mov rcx, rbx
call rax
mov r14d, eax
test eax, eax
js 0x140185fa2
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x30]
call fcn.14016f740
mov ecx, r14d
call fcn.140082b34
mov r15d, 3
lea rax, [0x14004a1dc]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], r15
mov ebx, 0xb9
mov qword [rsp + 0x78], rax
lea r13d, [r15 + 0x1d]
xor r12d, r12d
mov r8d, r13d
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
lea rax, [0x14002ee5c]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8d, r13d
mov ecx, ebx
call sub.ntdll.dll_NtQuerySystemInformation
test rsi, rsi
je 0x14018617c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rsi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
test rdi, rdi
je 0x14018618a
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1401861b8
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov ebx, 0xb9
lea rax, [0x140028cdc]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], r12
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov r8, r13
mov rcx, rbx
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, r14d
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140389660
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r12d, r12d
mov r8, r12
cmp dword [0x140452c58], 1
mov r9d, 1
cmove r8, qword [0x1404523c0]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140187418
jmp 0x1401860c5
test al, al
jns 0x1401862b4
cmp dword [0x140452c58], 1
jne 0x14018625a
mov r9, qword [0x1404523d8]
mov r8, qword [0x1404523c8]
jmp 0x140186260
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
xor ebx, ebx
mov r14d, eax
test eax, eax
js 0x140185fa2
cmp dword [rbp + 0x90], 4
jne 0x1401862ac
lea rdx, [0x1403d9810]
mov r8d, dword [r12]
lea rcx, [rsp + 0x40]
call fcn.140081d18
xor r12d, r12d
mov r14d, eax
test eax, eax
jns 0x140186075
jmp 0x140185fa2
mov r8, rbx
jmp 0x140186215
bt eax, 8
jae 0x140186314
cmp dword [0x140452c58], 1
jne 0x1401862d3
mov r9, qword [0x1404523e0]
mov r8, qword [0x1404523c8]
jmp 0x1401862d9
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
xor ebx, ebx
mov r14d, eax
test eax, eax
js 0x140185fa2
cmp dword [rbp + 0x90], 8
jne 0x1401862ac
mov r8, qword [r12]
lea rdx, str._I64u
lea rcx, [rsp + 0x40]
call fcn.140081d18
jmp 0x140186299
bt eax, 9
jae 0x140186394
mov r15d, 1
cmp dword [0x140452c58], r15d
jne 0x140186339
mov r9, qword [0x1404523e8]
mov r8, qword [0x1404523c8]
jmp 0x14018633f
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
xor ebx, ebx
mov r14d, eax
test eax, eax
js 0x140185fa2
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x140186382
mov eax, edx
and eax, r15d
test al, al
jne 0x140186382
shr rdx, 1
lea r8, [rsp + 0x40]
mov rcx, r12
call fcn.14008262c
jmp 0x140186299
cmp dword [0x140452c58], r15d
mov r8, rbx
mov r9d, r15d
jmp 0x140186222
bt eax, 0xa
jae 0x140186595
cmp dword [0x140452c58], 1
jne 0x1401863b7
mov r9, qword [0x1404523f0]
mov r8, qword [0x1404523c8]
jmp 0x1401863bd
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
js 0x140186054
mov r9, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov r8d, dword [rbp + 0x90]
mov rdx, r12
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.1401883b8
xor r12d, r12d
mov r14d, eax
test eax, eax
js 0x140185fa2
cmp dword [rsp + 0x4c], r12d
je 0x1401860d0
cmp dword [rsp + 0x38], r12d
je 0x1401860d0
mov rcx, qword [rbp - 0x80]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140186423
cmp rax, 0x26
jne 0x140186457
cmp word [rcx], 0x7b
jne 0x14018645d
cmp word [rcx + 0x4a], 0x7d
jne 0x14018645d
add rcx, 2
lea rdx, [rbp - 0x50]
call fcn.140078228
mov ebx, eax
test eax, eax
jns 0x140186469
mov ecx, eax
jmp 0x140186464
cmp rax, 0x24
je 0x140186444
mov ecx, 0x80070057
mov ebx, ecx
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
test ebx, ebx
js 0x1401860d0
movups xmm0, xmmword [rbp - 0x68]
lea r8, [rsp + 0x38]
lea rdx, [0x1403ebf54]
lea rcx, [rsp + 0x48]
movdqu xmmword [rbp - 0x40], xmm0
call fcn.1400c8318
test al, al
je 0x1401864f3
movsxd rax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
add rax, rax
mov r14, qword [rcx + rax*8 + 8]
test r14, r14
jne 0x1401864bb
mov r14d, r12d
mov qword [rbp - 0x20], r12
jmp 0x1401864e2
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140082b34
lea r8, [rbp - 0x20]
mov edx, ebx
mov rcx, r14
call fcn.140082808
mov r14d, eax
test eax, eax
jns 0x1401864e2
mov ecx, eax
call fcn.140082a8c
mov ecx, r14d
call fcn.140082b34
test r14d, r14d
js 0x140186054
lea r8, [rsp + 0x38]
lea rdx, str.pid2
lea rcx, [rsp + 0x48]
call fcn.1400c8318
test al, al
je 0x140186583
movsxd r15, dword [rsp + 0x38]
mov rax, qword [rsp + 0x50]
add r15, r15
mov r14, qword [rax + r15*8 + 8]
test r14, r14
jne 0x14018652d
mov r14d, r12d
mov qword [rbp - 0x18], r12
jmp 0x140186554
mov ebx, dword [r14 - 4]
xor ecx, ecx
call fcn.140082b34
lea r8, [rbp - 0x18]
mov edx, ebx
mov rcx, r14
call fcn.140082808
mov r14d, eax
test eax, eax
jns 0x140186554
mov ecx, eax
call fcn.140082a8c
mov ecx, r14d
call fcn.140082b34
test r14d, r14d
js 0x140186054
mov rax, qword [rsp + 0x50]
lea rdx, [rbp - 0x10]
mov rcx, qword [rax + r15*8 + 8]
call fcn.140073bc4
mov r14d, eax
test eax, eax
js 0x140185fa2
mov rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x50]
call fcn.1401875c4
jmp 0x1401860c5
bt eax, 0xb
jae 0x140186605
cmp dword [0x140452c58], 1
jne 0x1401865b4
mov r9, qword [0x1404523f8]
mov r8, qword [0x1404523c8]
jmp 0x1401865ba
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
mov r14d, eax
test eax, eax
js 0x140186054
cmp dword [rbp + 0x90], 0x10
jne 0x14018620f
lea rdx, [rsp + 0x58]
mov rcx, r12
call fcn.140072318
mov rsi, qword [rsp + 0x58]
xor r12d, r12d
test eax, eax
js 0x140186212
mov rcx, rsi
jmp 0x14018607a
bt eax, 0xc
jae 0x14018664b
cmp dword [0x140452c58], 1
jne 0x140186664
mov r9, qword [0x140452400]
jmp 0x14018665b
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rdi, qword [rax + 0xd8]
mov rax, qword [0x1403cf6d0]
mov rcx, rdi
call rax
mov rax, rdi
mov rdx, r15
mov rcx, rbx
call rax
mov rdi, r15
jmp 0x1401860c5
cmp dword [0x140452c58], 1
jne 0x140186664
mov r9, qword [0x140452408]
mov r8, qword [0x1404523c8]
jmp 0x14018666a
mov r9, rcx
mov r8, rcx
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140169600
xor r15d, r15d
mov r14d, eax
test eax, eax
js 0x140185fa2
cmp dword [0x140452c58], 1
mov r8d, r15d
mov ebx, dword [rbp + 0x90]
mov r9d, ebx
cmove r8, qword [0x140452410]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [r13 + 0x18]
call fcn.140187418
mov r14d, eax
test eax, eax
js 0x140185fa2
test ebx, ebx
je 0x1401860d0
lea r9, [rsp + 0x40]
mov edx, ebx
mov rcx, r12
call fcn.140071278
xor r12d, r12d
mov r14d, eax
test eax, eax
js 0x140185fa2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r15, rax
test rax, rax
je 0x140186092
mov rdi, rax
test rax, rax
jne 0x14018661d
jmp 0x140186092