Function at 0x1800e3cc0
Capabilities:
Get system information on windows

Disassembly:
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x18023c800]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800e3d0e
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
lea rcx, str.KERNELBASE.DLL
sub r15, 0xfff
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800e3ec2
lea rdx, str.VirtualAlloc
mov qword [rsp + 0x90], r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x1800e3f9f
cmp rax, 0x48
je 0x1800e3f9f
mov qword [rsp + 0xd8], rsi
mov rsi, qword [0x180240f10]
test rsi, rsi
je 0x1800e3d9d
nop dword [rax + rax]
cmp rsi, r14
jb 0x1800e3d95
cmp rsi, r15
jae 0x1800e3d95
cmp qword [rsi + 8], 0
jne 0x1800e3eaf
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800e3d80
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x98], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800e3e32
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800e3e29
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e3e29
cmp dword [rsp + 0x40], 0x10000
je 0x1800e3edf
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800e3e29
sub rbx, rbp
cmp rbx, r14
jae 0x1800e3df0
test rsi, rsi
jne 0x1800e3f3e
cmp rdi, r15
ja 0x1800e3f7f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800e3f7f
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800e3f7f
cmp dword [rsp + 0x40], 0x10000
je 0x1800e3f12
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800e3e62
jmp 0x1800e3f7f
mov rax, rsi
mov rsi, qword [rsp + 0xd8]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18019d700
add rsp, 0xa0
pop r15
pop r14
pop rdi
ret
test rbx, rbx
je 0x1800e3e29
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call r13
mov rsi, rax
test rax, rax
jne 0x1800e3f3e
cmp rbx, r14
jae 0x1800e3dd0
jmp 0x1800e3e32
test rdi, rdi
je 0x1800e3f7f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call r13
mov rsi, rax
test rax, rax
jne 0x1800e3f3e
cmp rdi, r15
jbe 0x1800e3e40
jmp 0x1800e3f7f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop word [rax + rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800e3f50
mov rax, qword [0x180240f10]
mov qword [rsi], rax
mov qword [0x180240f10], rsi
mov r12, qword [rsp + 0x98]
mov rax, rsi
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
jmp 0x1800e3eb2
xor r9d, r9d
lea r8, [0x1801a2c24]
lea rdx, str.VirtAlloc_byte
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x1800e3eba