Function at 0x1004024b0
Capabilities:
Check os version
Enumerate process modules
Get file version info
Get memory capacity
Get system information on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3110]
mov eax, 0x3210
call fcn.100407760
sub rsp, rax
mov rax, qword [0x10040c020]
xor rax, rsp
mov qword [rbp + 0x3100], rax
mov rdi, qword [0x10040c978]
xor esi, esi
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x44]
lea r8d, [rsi + 2]
mov rcx, rdi
mov word [rsp + 0x44], 0xfeff
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x22f2]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0x22f0], si
call sub.MSVCR100.dll_memset
lea rcx, [rbp + 0x20f2]
xor edx, edx
mov r8d, 0xfe
mov word [rbp + 0x20f0], si
call sub.MSVCR100.dll_memset
lea rcx, [rbp + 0x21f2]
xor edx, edx
mov r8d, 0xfe
mov word [rbp + 0x21f0], si
call sub.MSVCR100.dll_memset
lea rax, [rbp + 0x20f0]
mov ebx, 0x80
lea r9, str.yyyy_MM_dd
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
test eax, eax
je 0x100402628
lea rax, [rbp + 0x21f0]
lea r9, str.HH:mm:ss
xor r8d, r8d
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
je 0x100402628
lea rax, [rbp + 0x21f0]
lea r9, [rbp + 0x20f0]
lea r8, str._SSIS_Textual_Dump_taken_at__s__s_r_n
lea rcx, [rbp + 0x22f0]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r11 + rax*2], si
jne 0x100402600
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r8, str._PID__d_r_n
lea rcx, [rbp + 0x22f0]
mov r9d, eax
mov edx, 0x400
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [r11 + rax*2], si
jne 0x100402654
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rbp + 0x20f0]
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1004026e8
lea r9, [rbp + 0x20f0]
lea r8, str._Image_Name___s__r_n
lea rcx, [rbp + 0x22f0]
mov edx, 0x400
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r11 + rax*2], si
jne 0x1004026c0
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x1fd0]
xor edx, edx
mov r8d, 0x11c
call sub.MSVCR100.dll_memset
lea rcx, [rbp + 0x1fd0]
mov dword [rbp + 0x1fd0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100402789
mov r9d, dword [rbp + 0x1fd4]
lea rax, [rbp + 0x1fe4]
lea r8, str._OS_major_d_minor_d_build_d__s_r_n
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x1fdc]
lea rcx, [rbp + 0x22f0]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp + 0x1fd8]
mov edx, 0x400
mov dword [rsp + 0x20], eax
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [r11 + rax*2], si
jne 0x100402761
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r11d, word [rsp + 0x60]
lea rcx, [rbp + 0x20f0]
lea rax, [rbp + 0x20f0]
test r11d, r11d
je 0x100402863
cmp r11d, 6
je 0x100402833
cmp r11d, 9
je 0x1004027fe
lea rdx, str.unknown_
sub rdx, rax
nop word [rax + rax]
lea rax, [rbx + 0x7fffff7e]
test rax, rax
je 0x100402893
movzx eax, word [rdx + rcx]
test ax, ax
je 0x100402893
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x1004027d0
jmp 0x100402898
lea rdx, str.amd64
sub rdx, rax
nop dword [rax + rax]
lea rax, [rbx + 0x7fffff7e]
test rax, rax
je 0x100402893
movzx eax, word [rdx + rcx]
test ax, ax
je 0x100402893
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x100402810
jmp 0x100402898
lea rdx, str.ia64
sub rdx, rax
nop dword [rax]
lea rax, [rbx + 0x7fffff7e]
test rax, rax
je 0x100402893
movzx eax, word [rdx + rcx]
test ax, ax
je 0x100402893
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x100402840
jmp 0x100402898
lea rdx, [0x1004089f0]
sub rdx, rax
nop dword [rax]
lea rax, [rbx + 0x7fffff7e]
test rax, rax
je 0x100402893
movzx eax, word [rdx + rcx]
test ax, ax
je 0x100402893
mov word [rcx], ax
add rcx, 2
dec rbx
jne 0x100402870
jmp 0x100402898
test rbx, rbx
jne 0x10040289c
sub rcx, 2
mov word [rcx], si
mov dword [rsp + 0x4c], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x4c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x4c], esi
mov r9d, dword [rbp - 0x80]
lea rax, str.under_WOW64
lea rdx, str.processors
lea rcx, [0x100408800]
cmovne rcx, rax
cmp r9d, 1
lea rax, str.processor
cmova rax, rdx
mov qword [rsp + 0x30], rcx
lea r8, str._Running_on__d__s__s__s_r_n
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20f0]
lea rcx, [rbp + 0x22f0]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [r11 + rax*2], si
jne 0x100402920
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbp + 0x1f90]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov r11, qword [rbp + 0x1fa8]
mov rdx, qword [rbp + 0x1fb0]
mov rcx, qword [rbp + 0x1f98]
mov rax, qword [rbp + 0x1fa0]
mov r9d, dword [rbp + 0x1f94]
shr rdx, 0x14
shr rcx, 0x14
shr r11, 0x14
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
shr rax, 0x14
lea rcx, [rbp + 0x22f0]
lea r8, str._Memory:__d___in_use._Physical:__ldM__ldM__Paging:__dM__dM__avail_total__r_n
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.1004021e0
lea r11, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [r11 + rax*2], si
jne 0x1004029c0
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x48], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x48]
lea rdx, [rbp - 0x70]
mov rcx, rax
mov r8d, 0x400
call qword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x100402b50
mov eax, dword [rsp + 0x48]
mov ecx, 0x2000
mov rbx, rsi
cmp eax, ecx
cmova eax, ecx
mov dword [rsp + 0x48], eax
test rax, 0xfffffffffffffff8
jbe 0x100402b50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp + rbx*8 - 0x70]
lea r8, [rbp + 0x2af0]
mov rcx, rax
mov r9d, 0x104
call qword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x100402b3c
lea r9, [rbp + 0x2d00]
lea rcx, [rbp + 0x2af0]
xor edx, edx
mov r8d, 0x400
mov qword [rsp + 0x50], rsi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x100402aeb
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
lea rdx, [0x100408b28]
lea rcx, [rbp + 0x2d00]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x100402aeb
mov rcx, qword [rsp + 0x50]
lea r9, [rbp + 0x2af0]
movzx edx, word [rcx + 0x14]
movzx r8d, word [rcx + 0x16]
movzx eax, word [rcx + 0x10]
movzx ecx, word [rcx + 0x12]
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8, str._Loaded_Module:__s___ld._ld._ld._ld__r_n
lea rcx, [rbp + 0x22f0]
mov edx, 0x400
call fcn.1004021e0
jmp 0x100402b0a
lea r9, [rbp + 0x2af0]
lea r8, str._Loaded_Module:__s__unknown_version__r_n
lea rcx, [rbp + 0x22f0]
mov edx, 0x400
call fcn.1004021e0
lea rcx, [rbp + 0x22f0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x100402b15
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
lea rdx, [rbp + 0x22f0]
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x48]
inc rbx
shr rax, 3
cmp rbx, rax
jb 0x100402a33
mov rcx, qword [rbp + 0x3100]
xor rcx, rsp
call fcn.100405cd0
lea r11, [rsp + 0x3210]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret