Function at 0x14018297c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x140448b38]
xor rax, rsp
mov qword [rbp + 7], rax
and qword [rbp - 0x49], 0
xor edi, edi
and qword [rbp - 0x51], rdi
mov r13, r9
and qword [rbp - 0x69], rdi
mov rsi, r8
and dword [rbp - 0x11], edi
mov r12, rdx
lea eax, [rdi + 3]
mov qword [rbp - 0x29], rdx
mov dword [rbp - 5], eax
lea r8d, [rdi + 0x30]
mov qword [rbp - 0x41], rax
lea rdx, [rbp - 0x41]
lea rax, [0x14004405c]
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x39], rax
mov r15, rcx
lea rax, [rbp - 0x61]
mov dword [rbp - 0xd], 1
mov qword [rbp - 0x31], rax
xor r9d, r9d
lea rax, [rbp - 0x49]
mov dword [rbp - 9], 2
mov qword [rbp - 0x21], rax
mov ecx, 0xb9
lea rax, [rbp - 0x5d]
mov dword [rbp - 1], 4
mov qword [rbp - 0x19], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x61]
test ebx, ebx
jns 0x140182a2e
mov ecx, ebx
jmp 0x140182b13
mov edx, dword [rbp - 0x5d]
lea r8, [rbp - 0x59]
mov rcx, qword [rbp - 0x49]
call fcn.14008262c
mov ebx, eax
test eax, eax
jns 0x140182a54
mov ecx, eax
call fcn.140082a8c
mov rdi, qword [rbp - 0x59]
jmp 0x140182b18
mov rdi, qword [rbp - 0x59]
lea r9, [rbp - 0x51]
mov r8, rdi
mov rdx, rsi
mov rcx, r15
call fcn.140183cfc
mov ebx, eax
test eax, eax
js 0x140182b11
mov r14, qword [r15 + 0x18]
xor esi, esi
cmp dword [0x140452c58], 1
cmove rsi, qword [0x1404522d0]
mov rax, qword [r14]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403cf6d0]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x69]
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
js 0x140182b11
xor esi, esi
lea r14, [rbp - 0x11]
mov r9, qword [rbp - 0x69]
mov rdx, r12
mov r8d, dword [r14]
mov rcx, r15
mov qword [rsp + 0x20], r13
call fcn.140184134
mov ebx, eax
test eax, eax
js 0x140182b11
inc esi
add r14, 4
cmp esi, 5
jb 0x140182aba
mov rbx, qword [rbp - 0x51]
mov rax, qword [rbx]
mov rsi, qword [rax + 0xa8]
mov rax, qword [0x1403cf6d0]
mov rcx, rsi
call rax
mov rdx, qword [rbp - 0x69]
mov rax, rsi
xor r8d, r8d
mov rcx, rbx
call rax
mov ebx, eax
test eax, eax
jns 0x140182b18
mov ecx, eax
call fcn.140082a8c
mov ecx, ebx
call fcn.140082b34
and qword [rbp - 0x31], 0
lea rax, [rbp - 0x69]
mov r14d, 3
mov qword [rbp - 0x29], rax
mov r12d, 0xb9
mov qword [rbp - 0x41], r14
lea rsi, [0x140028cdc]
xor r9d, r9d
lea rdx, [rbp - 0x41]
mov qword [rbp - 0x39], rsi
lea r15d, [r14 + 0x2d]
mov ecx, r12d
mov r8d, r15d
call sub.ntdll.dll_NtQuerySystemInformation
and qword [rbp - 0x31], 0
lea rax, [rbp - 0x51]
xor r9d, r9d
mov qword [rbp - 0x29], rax
mov r8d, r15d
mov qword [rbp - 0x41], r14
lea rdx, [rbp - 0x41]
mov qword [rbp - 0x39], rsi
mov ecx, r12d
call sub.ntdll.dll_NtQuerySystemInformation
test rdi, rdi
je 0x140182ba5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rdi - 4]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.140082b34
mov rdi, qword [rbp - 0x49]
test rdi, rdi
je 0x140182bc2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140389660
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret