Function at 0x1400dcc30
Capabilities:
Get system information on windows

Disassembly:
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 4
mov edx, 0x80000000
lea rcx, str.demonphenomenologyShelved
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0xc0], rax
mov eax, 0x4d8
mov word [rsp + 0x40], ax
movsx eax, word [rsp + 0x40]
cmp eax, 0x3b9
jne 0x1400dce24
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.SHELL32.dll_DragQueryPoint]
mov dword [rsp + 0x90], eax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x78], rax
movabs rax, 0x7a9286e6a939cd
cmp qword [rsp + 0x78], rax
je 0x1400dcced
movabs rax, 0x7c476ff307290e
cmp qword [rsp + 0x78], rax
je 0x1400dce15
jmp 0x1400dce24
movsx eax, word [rsp + 0x40]
sub eax, 0x3d
mov word [rsp + 0x40], ax
movzx eax, byte [rsp + 0x150]
mov byte [rsp + 0x58], al
cmp byte [rsp + 0x58], 0x10
je 0x1400dce06
cmp byte [rsp + 0x58], 0x33
je 0x1400dcd1d
jmp 0x1400dce13
movabs rax, 0x70267038e98c3d
mov rcx, qword [section..data]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x140]
ja 0x1400dce04
movsx eax, word [rsp + 0x40]
and eax, 0x6fa
mov word [rsp + 0x40], ax
movabs rax, 0x79478c8130fc00
mov rcx, qword [section..data]
xor rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x140]
ja 0x1400dce04
mov dword [rsp + 0x20], 0xf2
lea r9, [rsp + 0xa0]
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.SHELL32.dll_SHGetNewLinkInfoW]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x148], 0xd180
mov edx, 0x40
mov rcx, qword [section..data]
call fcn.1400dbe30
movsx eax, word [rsp + 0x40]
shl eax, 1
mov word [rsp + 0x40], ax
mov dword [rsp + 0x28], 0xa6
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
mov r8d, 0x75
mov edx, 0x64
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_SHDefExtractIconW]
mov dword [rsp + 0x60], eax
jmp 0x1400dce13
movsx eax, word [rsp + 0x40]
sar eax, 7
mov word [rsp + 0x40], ax
jmp 0x1400dce24
movsx eax, word [rsp + 0x40]
or eax, 0x17d
mov word [rsp + 0x40], ax
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x4c], eax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x48], ax
mov rax, qword [section..data]
mov qword [rsp + 0x80], rax
movabs rax, 0x70365330a41cbc
cmp qword [rsp + 0x80], rax
je 0x1400dcf02
movabs rax, 0xee117ca8dcbde0
cmp qword [rsp + 0x80], rax
je 0x1400dce79
jmp 0x1400dcfda
movzx eax, byte [rsp + 0x150]
mov byte [rsp + 0x44], al
mov rax, qword [section..data]
mov qword [rsp + 0x88], rax
movabs rax, 0x7adefdf80ac33e
cmp qword [rsp + 0x88], rax
je 0x1400dceea
movabs rax, 0xee117ca8dcbde0
cmp qword [rsp + 0x88], rax
je 0x1400dcebe
jmp 0x1400dcefd
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [rsp + 0x54], 0x3c3d
mov eax, 0x950
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x68], rax
jmp 0x1400dcefd
lea rcx, [rsp + 0x54]
call qword [sym.imp.SHELL32.dll_ILCloneFirst]
mov qword [rsp + 0xd8], rax
jmp 0x1400dcfda
movzx eax, byte [rsp + 0x44]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 0x5c
je 0x1400dcfc6
cmp byte [rsp + 0x5c], 0x79
je 0x1400dcf22
jmp 0x1400dcfda
movsx eax, word [rsp + 0x48]
sub eax, 0x644
mov word [rsp + 0x40], ax
movsx eax, word [rsp + 0x48]
add eax, 0x6cb
movsx ecx, word [rsp + 0x40]
cmp eax, ecx
jge 0x1400dcf68
mov r8d, 0xf7
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_ExtractIconW]
mov qword [rsp + 0xe0], rax
movabs rax, 0x7525c8ebd2ee53
mov rcx, qword [section..data]
and rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x140]
jae 0x1400dcfc4
mov eax, dword [rsp + 0x148]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x148]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov rax, qword [section..data]
mov qword [rsp + 0x140], rax
jmp 0x1400dcfda
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x4c]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
movsx eax, word [rsp + 0x40]
add eax, 0x78f
movsx ecx, word [rsp + 0x48]
movsx eax, word [rsp + 0x40]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x473
je 0x1400dcffe
jmp 0x1400dd048
mov eax, dword [rsp + 0x54]
sar eax, 0x17
mov dword [rsp + 0x54], eax
mov edx, 0x83
lea rcx, [rsp + 0xb0]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.SHELL32.dll_SHBindToParent]
mov dword [rsp + 0x94], eax
jmp 0x1400dd05a
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov dword [rsp + 0x98], eax
mov eax, PathYetAnotherMakeUniqueName
add rsp, 0x138
ret