Function at 0x140005d24
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1405eaab8]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rbx, r8
mov r12, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x30], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov dword [rsp + 0x30], 1
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000623e
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x60]
mov qword [rsp + 0x38], r14
mov r13, qword [rbp - 0x58]
mov qword [rsp + 0x50], r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rdi
mov qword [rbp], rdi
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140005dd6
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.14000d684
nop
lea rdi, [rbp - 0x18]
mov r8, qword [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdi, r8
lea rcx, [rbp - 0x18]
cmovae rcx, r8
mov rsi, qword [rbp - 8]
add rsi, rcx
lea rbx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rbx, r8
cmp rbx, rsi
je 0x140005e2c
sub rdi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jne 0x140005e18
cmp r14, r13
jae 0x1400061e7
movabs rdi, 0x7fffffffffffffff
mov r9d, 0x30
lea r8, [rsp + 0x68]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400061e7
cmp dword [rbp - 0x78], 0x1000
jne 0x1400061d5
cmp dword [rbp - 0x74], 1
je 0x1400061d5
cmp dword [rbp - 0x74], 0x100
je 0x1400061d5
mov rsi, qword [rbp - 0x80]
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
xor ebx, ebx
mov qword [rbp + 0x18], rbx
test rsi, rsi
je 0x140005edd
cmp rsi, rdi
ja 0x14000626e
mov rcx, rsi
cmp rsi, 0x1000
jb 0x140005eb6
call fcn.14000eb34
jmp 0x140005ebb
call fcn.1401dc230
mov rdi, rax
mov qword [rbp + 8], rax
lea rbx, [rax + rsi]
mov qword [rbp + 0x18], rbx
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1401dd2b6
mov qword [rbp + 0x10], rbx
jmp 0x140005ee5
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbp + 8]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rdi
mov rdx, qword [rsp + 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140006193
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
and qword [rbp - 0x28], 0
and qword [rbp - 0x20], 0
cmp rdi, rbx
jne 0x140005f35
xor ecx, ecx
mov qword [rbp - 0x28], rcx
lea esi, [rcx + 0xf]
mov qword [rbp - 0x20], rsi
mov byte [rbp - 0x38], cl
jmp 0x140005feb
sub rbx, rdi
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140006268
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
cmp rbx, 0x10
jae 0x140005f73
mov qword [rbp - 0x28], rbx
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x38]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x38], 0
jmp 0x140005fe3
mov rsi, rbx
or rsi, 0xf
cmp rsi, rax
jbe 0x140005f84
mov rsi, rax
jmp 0x140005f90
mov eax, socket
cmp rsi, rax
cmovb rsi, rax
mov rcx, rsi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140005fb5
call fcn.14000eb34
mov r14, rax
jmp 0x140005fc4
test rcx, rcx
je 0x140005fc1
call fcn.1401dc230
jmp 0x140005fb0
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rcx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
lea r15, [rbp - 0x38]
cmp rsi, 0x10
setae al
mov r14, qword [rbp - 0x38]
cmovae r15, r14
lea rdx, [rbp - 0x38]
test al, al
je 0x14000600f
mov rbx, r14
lea r13, [rcx + r14]
jmp 0x140006017
lea r13, [rcx + rdx]
lea rbx, [rbp - 0x38]
cmp rbx, r13
je 0x140006040
sub r15, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + r15], al
inc rbx
cmp rbx, r13
jne 0x14000601f
mov rsi, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rax, qword [rbp - 0x18]
mov qword [rsp + 0x58], rax
lea r15, [rbp - 0x38]
cmp rsi, 0x10
cmovae r15, r14
mov r13, qword [rbp - 8]
cmp r13, rcx
ja 0x14000614d
sub rcx, r13
test r13, r13
jne 0x14000607c
xor ebx, ebx
or r15, 0xffffffffffffffff
jmp 0x1400060dc
inc rcx
add rcx, r15
mov qword [rsp + 0x40], rcx
movsx eax, byte [rax]
mov dword [rsp + 0x34], eax
mov r8, rcx
sub r8, r15
mov edx, eax
mov rcx, r15
jmp 0x1400060c1
mov r8, r13
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400060d0
inc rbx
mov r8, qword [rsp + 0x40]
sub r8, rbx
mov edx, dword [rsp + 0x34]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
mov rbx, rax
jne 0x14000609b
jmp 0x14000614d
sub rbx, r15
or r15, 0xffffffffffffffff
cmp rbx, r15
je 0x14000614d
mov rcx, qword [rsp + 0x68]
add rcx, rbx
mov qword [rsp + 0x40], rcx
mov rdx, qword [r12 + 8]
cmp rdx, qword [r12 + 0x10]
je 0x140006100
mov qword [rdx], rcx
add qword [r12 + 8], 8
jmp 0x14000610d
lea r8, [rsp + 0x40]
mov rcx, r12
call fcn.14000e05c
lea r9, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae r9, qword [rbp - 0x18]
lea rcx, [rbp - 0x38]
mov r14, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x20]
cmp rsi, 0x10
cmovae rcx, r14
lea r8, [rbx + 1]
mov rax, qword [rbp - 8]
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp - 0x28]
call fcn.14000d3c0
mov rbx, rax
cmp rax, r15
jne 0x1400060dc
cmp rsi, 0x10
jb 0x140006184
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000617c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000622a
mov rcx, r14
call fcn.1401dc738
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x38]
test rdi, rdi
je 0x1400061cb
mov rcx, qword [rbp + 0x18]
sub rcx, rdi
mov rax, rdi
cmp rcx, 0x1000
jb 0x1400061c0
add rcx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006231
mov rdx, rcx
mov rcx, rdi
call fcn.1401dc738
movabs rdi, 0x7fffffffffffffff
add r14, qword [rbp - 0x80]
mov qword [rsp + 0x38], r14
cmp r14, r13
jb 0x140005e3f
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14000623e
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006238
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1401dc738
nop
mov rax, r12
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401dc200
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001674
nop
call fcn.14000dce4
int3