Function at 0x3000f5c0
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
movabs rax, 0x208
call sub.KERNEL32.dll___chkstk
sub rsp, rax
mov rbp, r8
xor ebx, ebx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
xor r15d, r15d
xor eax, eax
mov dword [rsp + 0x48], eax
mov word [rcx], ax
mov rcx, rbp
call fcn.30009730
cmp dword [0x30089c68], eax
jne 0x3000ffb9
mov edx, 0x106
mov ecx, 0x18
call fcn.30021110
mov rbx, rax
test rbx, rbx
je 0x3000f660
mov word [rbx], r15w
mov word [rbx + 2], r15w
mov word [rbx + 4], 0x10
mov qword [rbx + 0x10], 0
jmp 0x3000f662
xor ebx, ebx
test rbx, rbx
je 0x3000ffb9
mov r9d, 2
mov r8d, 0x14
mov edx, r8d
mov rcx, rbx
call fcn.3002d190
test eax, eax
je 0x3000ffb9
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor r10d, r10d
mov rcx, qword [0x30085a90]
mov eax, dword [rcx + 0x3c]
or r10, rax
mov eax, dword [rcx + 0x40]
shl rax, 0x20
or r10, rax
mov qword [rsp + 0x50], r10
cmp dword [rsp + 0x268], 0
je 0x3000f6fa
cmp dword [0x30089a4c], 0
jne 0x3000ffb9
movabs rsi, 0x80000000
movabs rax, 0xbfffffff
mov qword [rsp + 0xd0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r10, rax
mov qword [rsp + 0x50], r10
jmp 0x3000f702
mov rsi, qword [rsp + 0xc8]
cmp rsi, qword [rsp + 0xd0]
jae 0x3000f816
jmp 0x3000f717
mov r10, qword [rsp + 0x50]
lea rdi, [rsp + 0x90]
xor eax, eax
movabs rcx, 0x30
rep stosb byte [rdi], al
movabs r9, 0x30
lea r8, [rsp + 0x90]
mov rdx, rsi
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov qword [rsp + 0x30], rax
cmp rax, 0x30
je 0x3000f778
lea rdi, [rsp + 0x90]
xor eax, eax
movabs rcx, 0x30
rep stosb byte [rdi], al
mov rsi, qword [rsp + 0xd0]
jmp 0x3000f7ef
cmp dword [rsp + 0xb0], 0x1000
jne 0x3000f7ef
mov eax, dword [rsp + 0xb4]
cmp eax, 4
je 0x3000f796
cmp eax, 0x40
jne 0x3000f7ef
cmp dword [rsp + 0xb8], 0x20000
jne 0x3000f7ef
movabs rax, 0xffffffff
cmp qword [rsp + 0xa8], rax
jae 0x3000f7ef
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
mov ecx, dword [rsp + 0xc4]
mov rax, qword [rsp + 0xa8]
cmp rcx, rax
cmova rax, rcx
add rsi, rax
cmp rsi, qword [rsp + 0xd0]
jb 0x3000f712
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
xor r8d, r8d
mov edx, 4
mov rcx, qword [0x30086160]
call sub.dbghelp.dll_MiniDumpReadDumpStream
mov r8, qword [rsp + 0x58]
test r8, r8
je 0x3000ffb9
xor r12d, r12d
cmp dword [r8], r12d
jbe 0x3000f9e2
movsxd rax, r12d
imul rax, rax, 0x6c
lea r13, [rax + r8 + 4]
xor r14d, r14d
cmp word [rbx], r14w
jbe 0x3000f9d5
movsxd r11, r14d
shl r11, 4
mov rsi, r11
add rsi, qword [rbx + 0x10]
xor r10d, r10d
mov eax, dword [rsi]
or r10, rax
mov eax, dword [rsi + 4]
shl rax, 0x20
or r10, rax
xor r9d, r9d
mov eax, dword [r13]
or r9, rax
mov eax, dword [r13 + 4]
shl rax, 0x20
or r9, rax
cmp r9, r10
jb 0x3000f8d1
add r11, qword [rbx + 0x10]
mov edx, dword [r11 + 8]
xor ecx, ecx
mov eax, dword [r11]
or rcx, rax
mov eax, dword [r11 + 4]
shl rax, 0x20
or rcx, rax
add rdx, rcx
cmp r9, rdx
jb 0x3000f8e1
cmp r9, r10
ja 0x3000ffff
mov eax, dword [r13 + 8]
add rax, r9
cmp r10, rax
jae 0x3000ffff
lea rdi, [rsp + 0x70]
movabs rcx, 4
rep movsd dword [rdi], dword [rsi]
mov r8d, 1
mov edx, r14d
mov rcx, rbx
call fcn.3002dae4
xor ecx, ecx
mov eax, dword [r13]
or rcx, rax
mov eax, dword [r13 + 4]
shl rax, 0x20
or rcx, rax
mov rsi, qword [rsp + 0x70]
cmp rsi, rcx
jae 0x3000f959
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x38], rsi
mov eax, dword [r13]
sub eax, esi
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
cmp eax, 0xffffffff
je 0x3000ffb9
mov edx, dword [rsp + 0x78]
add rdx, rsi
mov qword [rsp + 0x68], rdx
mov r8d, dword [r13 + 8]
xor ecx, ecx
mov eax, dword [r13]
or rcx, rax
mov eax, dword [r13 + 4]
shl rax, 0x20
or rcx, rax
add r8, rcx
mov qword [rsp + 0x88], r8
cmp rdx, r8
jbe 0x3000f9c4
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x38], r8
mov eax, edx
sub eax, r8d
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
cmp eax, 0xffffffff
je 0x3000ffb9
mov r8, qword [rsp + 0x58]
movzx eax, word [rbx]
cmp r14d, eax
jl 0x3000f86b
add r12d, 1
cmp r12d, dword [r8]
jb 0x3000f852
cmp dword [rsp + 0x268], 0
jne 0x3000fc2c
xor r13d, r13d
cmp dword [r8], r13d
jbe 0x3000fc2c
movsxd rax, r13d
imul rax, rax, 0x6c
lea r14, [rax + r8 + 4]
mov qword [rsp + 0x30], 0
xor edx, edx
mov eax, dword [r14]
or rdx, rax
mov eax, dword [r14 + 4]
shl rax, 0x20
or rdx, rax
add rdx, 0x3c
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movabs r9, 4
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3000fc0d
cmp qword [rsp + 0x30], 4
jne 0x3000fc0d
mov qword [rsp + 0x30], 0
mov r12d, dword [rsp + 0x80]
xor ecx, ecx
mov eax, dword [r14]
or rcx, rax
mov eax, dword [r14 + 4]
shl rax, 0x20
or rcx, rax
add r12, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movabs r9, 0x108
lea r8, [rsp + 0xf0]
mov rdx, r12
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3000fc0d
cmp qword [rsp + 0x30], 0x108
jne 0x3000fc0d
cmp dword [rsp + 0xf0], 0x4550
jne 0x3000fc0d
movzx eax, word [rsp + 0xf6]
test ax, ax
jbe 0x3000fc0d
movzx eax, ax
lea esi, [rax + rax*4]
shl esi, 3
mov eax, dword [rsp + 0x48]
cmp eax, esi
jae 0x3000fb29
test r15, r15
je 0x3000fb0b
mov rcx, r15
call fcn.30021150
mov dword [rsp + 0x48], esi
mov edx, 0x106
mov ecx, esi
call fcn.30021110
mov r15, rax
test r15, r15
je 0x3000fc2c
mov eax, esi
mov qword [rsp + 0x30], 0
mov ecx, eax
mov rdi, r15
xor eax, eax
rep stosb byte [rdi], al
movzx rax, word [rsp + 0x104]
lea rdx, [r12 + rax + 0x18]
mov edi, esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, r15
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3000fc0d
cmp qword [rsp + 0x30], rdi
jne 0x3000fc0d
xor r12d, r12d
movzx edx, word [rsp + 0xf6]
test dx, dx
jbe 0x3000fc0d
lea rsi, [r15 + 0x24]
mov ecx, dword [rsi]
mov eax, ecx
and eax, 0x80000000
je 0x3000fbfd
mov eax, ecx
and eax, 0x40000000
je 0x3000fbfd
mov eax, ecx
and al, 0x80
jne 0x3000fbb0
and cl, 0x40
je 0x3000fbfd
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov edx, dword [rsi - 0x18]
xor ecx, ecx
mov eax, dword [r14]
or rcx, rax
mov eax, dword [r14 + 4]
shl rax, 0x20
or rcx, rax
add rdx, rcx
mov qword [rsp + 0x38], rdx
mov eax, dword [rsi - 0x1c]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
mov dx, word [rsp + 0xf6]
add rsi, 0x28
add r12d, 1
movzx eax, dx
cmp r12d, eax
jl 0x3000fb91
add r13d, 1
mov r8, qword [rsp + 0x58]
cmp r13d, dword [r8]
jb 0x3000f9fc
test r15, r15
je 0x3000fc2c
mov rcx, r15
call fcn.30021150
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 5
mov rcx, qword [0x30086160]
call sub.dbghelp.dll_MiniDumpReadDumpStream
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x3000ffb9
xor r13d, r13d
cmp dword [r8], r13d
jbe 0x3000fdfc
movsxd rax, r13d
shl rax, 4
lea r12, [rax + r8 + 4]
xor r14d, r14d
cmp word [rbx], r14w
jbe 0x3000fdef
movsxd r10, r14d
shl r10, 4
mov rsi, r10
add rsi, qword [rbx + 0x10]
xor r9d, r9d
mov eax, dword [r12]
or r9, rax
mov eax, dword [r12 + 4]
shl rax, 0x20
or r9, rax
xor ecx, ecx
mov eax, dword [rsi]
or rcx, rax
mov eax, dword [rsi + 4]
shl rax, 0x20
or rcx, rax
cmp rcx, r9
jb 0x3000fcd1
mov eax, dword [r12 + 8]
add rax, r9
cmp rcx, rax
jb 0x3000fcf8
cmp rcx, r9
ja 0x30010008
add r10, qword [rbx + 0x10]
mov edx, dword [r10 + 8]
xor ecx, ecx
mov eax, dword [r10]
or rcx, rax
mov eax, dword [r10 + 4]
shl rax, 0x20
or rcx, rax
add rdx, rcx
cmp r9, rdx
jae 0x30010008
lea rdi, [rsp + 0x70]
movabs rcx, 4
rep movsd dword [rdi], dword [rsi]
mov r8d, 1
mov edx, r14d
mov rcx, rbx
call fcn.3002dae4
xor ecx, ecx
mov eax, dword [r12]
or rcx, rax
mov eax, dword [r12 + 4]
shl rax, 0x20
or rcx, rax
mov rsi, qword [rsp + 0x70]
cmp rsi, rcx
jae 0x3000fd71
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x38], rsi
mov eax, dword [r12]
sub eax, esi
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
cmp eax, 0xffffffff
je 0x3000ffb9
mov edx, dword [rsp + 0x78]
add rdx, rsi
mov qword [rsp + 0x68], rdx
mov r8d, dword [r12 + 8]
xor ecx, ecx
mov eax, dword [r12]
or rcx, rax
mov eax, dword [r12 + 4]
shl rax, 0x20
or rcx, rax
add r8, rcx
mov qword [rsp + 0x88], r8
cmp rdx, r8
jbe 0x3000fdde
lea rdi, [rsp + 0x38]
xor eax, eax
movabs rcx, 0x10
rep stosb byte [rdi], al
mov qword [rsp + 0x38], r8
mov eax, edx
sub eax, r8d
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.3002d7e8
cmp eax, 0xffffffff
je 0x3000ffb9
mov r8, qword [rsp + 0x60]
movzx eax, word [rbx]
cmp r14d, eax
jl 0x3000fc81
add r13d, 1
cmp r13d, dword [r8]
jb 0x3000fc68
mov ax, word [rbx]
test ax, ax
jbe 0x3000ffb9
movzx eax, ax
mov r12d, eax
shl r12d, 4
add r12d, 4
xor ecx, ecx
test eax, eax
jle 0x3000fe3f
mov rdx, qword [rbx + 0x10]
movsxd rax, ecx
shl rax, 4
mov dword [rdx + rax + 0xc], r12d
mov rdx, qword [rbx + 0x10]
add r12d, dword [rdx + rax + 8]
add ecx, 1
movzx eax, word [rbx]
cmp ecx, eax
jl 0x3000fe20
call fcn.3000f3b0
test eax, eax
je 0x3000ffb9
mov eax, dword [rsp + 0x258]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x250]
mov r9, rax
lea r8, str..tmp
lea rdx, [0x30088770]
mov rcx, rbp
call fcn.3000d728
test eax, eax
je 0x3000ffb9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbp + 8], rax
test rax, rax
je 0x3000ffb9
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov qword [rbp + 0x10], r13
test r13, r13
je 0x3000ffb9
mov dword [rbp + 0x18], r12d
movzx ecx, word [rbx]
mov dword [r13], ecx
add r13, 4
xor edx, edx
cmp word [rbx], dx
jbe 0x3000ff3a
mov r8d, r12d
mov eax, dword [rbx + 4]
and eax, 0xffff
mov ecx, eax
mov rax, qword [rbp + 0x10]
sub rax, r13
add rax, r8
cmp rax, rcx
jl 0x3000ffb9
movsxd rsi, edx
shl rsi, 4
add rsi, qword [rbx + 0x10]
mov rdi, r13
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rbx + 4]
and eax, 0xffff
mov ecx, eax
add r13, rcx
add edx, 1
movzx eax, word [rbx]
cmp edx, eax
jl 0x3000ff00
xor esi, esi
cmp word [rbx], si
jbe 0x30010036
mov r12d, r12d
mov r14, qword [rsp + 0x50]
mov qword [rsp + 0x30], 0
movsxd rdi, esi
shl rdi, 4
mov rcx, qword [rbp + 0x10]
sub rcx, r13
add rcx, r12
mov rax, qword [rbx + 0x10]
mov eax, dword [rdi + rax + 8]
cmp rcx, rax
jl 0x3000ffb9
mov rcx, rdi
add rcx, qword [rbx + 0x10]
mov r9d, dword [rcx + 8]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, r13
xor edx, edx
mov eax, dword [rcx]
or rdx, rax
mov eax, dword [rcx + 4]
shl rax, 0x20
or rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30010011
mov rax, qword [rbx + 0x10]
mov eax, dword [rdi + rax + 8]
cmp qword [rsp + 0x30], rax
je 0x3001001d
mov rcx, rbp
call fcn.300098a4
mov rcx, qword [rsp + 0x250]
cmp word [rcx], 0
je 0x3000ffd4
call fcn.30009908
mov rcx, rbp
call fcn.30009730
mov rax, qword [rsp + 0x250]
mov word [rax], 0
test rbx, rbx
je 0x3000fffb
mov edx, 1
mov rcx, rbx
call fcn.3000d95c
xor eax, eax
jmp 0x30010048
add r14d, 1
jmp 0x3000f9c9
add r14d, 1
jmp 0x3000fde3
mov rax, qword [rbp + 0x10]
mov dword [rdi + rax + 0xc], 0
mov rax, qword [rbx + 0x10]
mov eax, dword [rdi + rax + 8]
add r13, rax
add esi, 1
movzx eax, word [rbx]
cmp esi, eax
jl 0x3000ff4d
mov edx, 1
mov rcx, rbx
call fcn.3000d95c
mov eax, 1
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret