Function at 0x41d870
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
test rcx, rcx
je 0x41e07a
lea rsi, [rcx - 0x10]
mov rdx, qword [0x004430c8]
cmp rsi, rdx
jb 0x41e0a2
mov rcx, qword [rcx - 8]
mov eax, ecx
and eax, 3
cmp rax, 1
je 0x41e0a2
mov r14, rcx
and r14, 0xfffffffffffffff8
lea r9, [rsi + r14]
test cl, 1
jne 0x41db7b
mov rcx, qword [rsi]
test rax, rax
je 0x41d968
sub rsi, rcx
cmp rsi, rdx
jb 0x41e0a2
add r14, rcx
cmp qword [0x004430d0], rsi
je 0x41d9f5
cmp rcx, 0xff
ja 0x41da1c
mov rbx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
movabs rax, 0x3fffffff8
and rax, rcx
lea rdi, [0x004430b0]
lea rax, [rdi + rax*2 + 0x48]
cmp rbx, rax
je 0x41d931
cmp rdx, rbx
ja 0x41e0a2
cmp qword [rbx + 0x18], rsi
jne 0x41e0a2
cmp r8, rbx
je 0x41da60
cmp r8, rax
je 0x41d952
cmp rdx, r8
ja 0x41e0a2
cmp qword [r8 + 0x10], rsi
jne 0x41e0a2
mov qword [rbx + 0x18], r8
mov qword [r8 + 0x10], rbx
cmp rsi, r9
jb 0x41db84
jmp 0x41e0a2
add r14, rcx
add r14, 0x20
je 0x41d9e9
sub rsi, rcx
lea rdi, [rbp - 0x30]
mov rbx, r14
nop dword [rax + rax]
mov r8d, 0x30
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32_VirtualQuery
cmp qword [rbp - 0x18], rbx
ja 0x41e07a
test rax, rax
je 0x41e07a
cmp qword [rbp - 0x30], rsi
jne 0x41e07a
cmp qword [rbp - 0x28], rsi
jne 0x41e07a
cmp dword [rbp - 0x10], 0x1000
jne 0x41e07a
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call sub.KERNEL32_VirtualFree
test eax, eax
je 0x41e07a
mov rax, qword [rbp - 0x18]
add rsi, rax
sub rbx, rax
jne 0x41d980
sub qword [0x00443408], r14
jmp 0x41e07a
mov rax, qword [r9 + 8]
mov ecx, eax
and ecx, 3
cmp rcx, 3
jne 0x41db7b
mov qword [0x004430b8], r14
and rax, 0xfffffffffffffffe
mov qword [r9 + 8], rax
jmp 0x41dd61
mov rbx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x30]
cmp rbx, rsi
je 0x41da7f
mov rax, qword [rsi + 0x10]
cmp rdx, rax
ja 0x41e0a2
cmp qword [rax + 0x18], rsi
jne 0x41e0a2
cmp qword [rbx + 0x10], rsi
jne 0x41e0a2
mov qword [rax + 0x18], rbx
mov qword [rbx + 0x10], rax
test r8, r8
jne 0x41dad9
jmp 0x41db7b
shr rcx, 3
mov eax, 0xfffffffe
rol eax, cl
and dword [0x004430b0], eax
cmp rsi, r9
jb 0x41db84
jmp 0x41e0a2
mov rdi, qword [rsi + 0x28]
test rdi, rdi
je 0x41da8e
lea rcx, [rsi + 0x28]
jmp 0x41daa0
lea rcx, [rsi + 0x20]
mov rdi, qword [rcx]
test rdi, rdi
je 0x41e085
nop
mov rbx, rdi
mov rax, rcx
lea rcx, [rbx + 0x28]
mov rdi, qword [rbx + 0x28]
test rdi, rdi
jne 0x41daa0
lea rcx, [rbx + 0x20]
mov rdi, qword [rbx + 0x20]
test rdi, rdi
jne 0x41daa0
cmp rdx, rax
ja 0x41e0a2
mov qword [rax], 0
test r8, r8
je 0x41db7b
mov ecx, dword [rsi + 0x38]
lea rax, [0x004430b0]
cmp qword [rax + rcx*8 + 0x258], rsi
je 0x41db0f
cmp qword [0x004430c8], r8
ja 0x41e0a2
xor eax, eax
cmp qword [r8 + 0x20], rsi
setne al
mov qword [r8 + rax*8 + 0x20], rbx
test rbx, rbx
jne 0x41db1c
jmp 0x41db7b
mov qword [rax + rcx*8 + 0x258], rbx
test rbx, rbx
je 0x41db6e
mov rcx, qword [0x004430c8]
cmp rcx, rbx
ja 0x41e0a2
mov qword [rbx + 0x30], r8
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x41db4a
cmp rcx, rax
ja 0x41e0a2
mov qword [rbx + 0x20], rax
mov qword [rax + 0x30], rbx
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x41db7b
cmp rcx, rax
ja 0x41e0a2
mov qword [rbx + 0x28], rax
mov qword [rax + 0x30], rbx
cmp rsi, r9
jb 0x41db84
jmp 0x41e0a2
mov eax, 0xfffffffe
rol eax, cl
and dword [0x004430b4], eax
cmp rsi, r9
jae 0x41e0a2
mov rdx, qword [r9 + 8]
test dl, 1
je 0x41e0a2
test dl, 2
jne 0x41dc30
cmp qword [0x004430d8], r9
je 0x41dd0d
cmp qword [0x004430d0], r9
je 0x41dd4c
cmp rdx, 0xff
ja 0x41dde4
mov rcx, qword [r9 + 0x10]
mov rbx, qword [r9 + 0x18]
movabs rax, 0x3fffffff8
and rax, rdx
lea rdi, [0x004430b0]
lea rax, [rdi + rax*2 + 0x48]
cmp rcx, rax
je 0x41dbfe
cmp qword [0x004430c8], rcx
ja 0x41e0a2
cmp qword [rcx + 0x18], r9
jne 0x41e0a2
cmp rbx, rcx
je 0x41df3d
cmp rbx, rax
je 0x41dc23
cmp qword [0x004430c8], rbx
ja 0x41e0a2
cmp qword [rbx + 0x10], r9
jne 0x41e0a2
mov qword [rcx + 0x18], rbx
mov qword [rbx + 0x10], rcx
jmp 0x41e050
and rdx, 0xfffffffffffffffe
mov qword [r9 + 8], rdx
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
cmp r14, 0xff
ja 0x41dc9c
mov rcx, r14
shr rcx, 3
movabs rax, 0x3fffffff8
and rax, r14
lea rdx, [0x004430b0]
lea rax, [rdx + rax*2 + 0x48]
mov edx, dword [0x004430b0]
mov ebx, 1
shl ebx, cl
bt edx, ecx
jae 0x41dd75
mov rcx, qword [rax + 0x10]
cmp qword [0x004430c8], rcx
jbe 0x41dd80
jmp 0x41e0a2
mov rdx, r14
shr rdx, 8
je 0x41dd95
mov ecx, 0x1f
cmp r14, 0xffffff
ja 0x41dd97
lea eax, [rdx + 0xfff00]
shr eax, 0x10
and eax, 8
mov ecx, eax
shl edx, cl
lea ecx, [rdx + 0x7f000]
shr ecx, 0x10
and ecx, 4
or eax, ecx
shl edx, cl
lea ecx, [rdx + 0x3c000]
shr ecx, 0x10
and ecx, 2
or eax, ecx
mov ebx, 0xe
sub ebx, eax
shl edx, cl
shr edx, 0xf
lea eax, [rbx + rdx]
lea ecx, [rbx + rdx + 7]
mov rdx, r14
shr rdx, cl
and edx, 1
lea ecx, [rdx + rax*2]
jmp 0x41dd97
add r14, qword [0x004430c0]
mov qword [0x004430c0], r14
mov qword [0x004430d8], rsi
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
cmp rsi, qword [0x004430d0]
je 0x41decc
cmp r14, qword [0x004430e0]
ja 0x41deef
jmp 0x41e07a
add r14, qword [0x004430b8]
mov qword [0x004430b8], r14
mov qword [0x004430d0], rsi
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
jmp 0x41e07a
or edx, ebx
mov dword [0x004430b0], edx
mov rcx, rax
mov qword [rax + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
jmp 0x41e07a
xor ecx, ecx
mov eax, ecx
lea rdx, [0x004430b0]
lea rax, [rdx + rax*8 + 0x258]
mov dword [rsi + 0x38], ecx
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
mov edx, dword [0x004430b4]
mov ebx, 1
shl ebx, cl
bt edx, ecx
jae 0x41ddd0
mov rdx, qword [rax]
cmp ecx, 0x1f
jne 0x41de30
xor eax, eax
jmp 0x41de3d
or edx, ebx
mov dword [0x004430b4], edx
mov qword [rax], rsi
mov qword [rsi + 0x30], rax
jmp 0x41df19
mov rbx, qword [r9 + 0x18]
mov r8, qword [r9 + 0x30]
cmp rbx, r9
je 0x41df56
mov rax, qword [r9 + 0x10]
cmp qword [0x004430c8], rax
ja 0x41e0a2
cmp qword [rax + 0x18], r9
jne 0x41e0a2
cmp qword [rbx + 0x10], r9
jne 0x41e0a2
mov qword [rax + 0x18], rbx
mov qword [rbx + 0x10], rax
test r8, r8
jne 0x41dfbd
jmp 0x41e050
shr ecx, 1
add ecx, 6
mov eax, 0x3f
sub rax, rcx
mov rcx, qword [rdx + 8]
and rcx, 0xfffffffffffffff8
cmp rcx, r14
jne 0x41de4f
mov rax, rdx
jmp 0x41de88
mov rbx, r14
mov ecx, eax
shl rbx, cl
nop word [rax + rax]
mov rcx, rbx
shr rcx, 0x3f
mov rax, qword [rdx + rcx*8 + 0x20]
test rax, rax
je 0x41df00
add rbx, rbx
mov rcx, qword [rax + 8]
and rcx, 0xfffffffffffffff8
cmp rcx, r14
mov rdx, rax
jne 0x41de60
mov rdx, qword [0x004430c8]
cmp rdx, rax
ja 0x41e0a2
mov rcx, qword [rax + 0x10]
cmp rdx, rcx
ja 0x41e0a2
mov qword [rcx + 0x18], rsi
mov qword [rax + 0x10], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 0
dec qword [0x004430e8]
jne 0x41e07a
jmp 0x41df2e
mov qword [0x004430d0], 0
mov qword [0x004430b8], 0
cmp r14, qword [0x004430e0]
jbe 0x41e07a
xor ecx, ecx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0041e0b0
lea rax, [rdx + rcx*8 + 0x20]
cmp qword [0x004430c8], rax
ja 0x41e0a2
mov qword [rax], rsi
mov qword [rsi + 0x30], rdx
mov qword [rsi + 0x18], rsi
mov qword [rsi + 0x10], rsi
dec qword [0x004430e8]
jne 0x41e07a
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0041e350
mov rcx, rdx
shr rcx, 3
mov eax, 0xfffffffe
rol eax, cl
and dword [0x004430b0], eax
jmp 0x41e050
mov rdi, qword [r9 + 0x28]
test rdi, rdi
je 0x41df65
lea rcx, [r9 + 0x28]
jmp 0x41df80
lea rcx, [r9 + 0x20]
mov rdi, qword [rcx]
test rdi, rdi
je 0x41e095
nop word cs:[rax + rax]
mov rbx, rdi
mov rax, rcx
lea rcx, [rbx + 0x28]
mov rdi, qword [rbx + 0x28]
test rdi, rdi
jne 0x41df80
lea rcx, [rbx + 0x20]
mov rdi, qword [rbx + 0x20]
test rdi, rdi
jne 0x41df80
cmp qword [0x004430c8], rax
ja 0x41e0a2
mov qword [rax], 0
test r8, r8
je 0x41e050
mov ecx, dword [r9 + 0x38]
lea rax, [0x004430b0]
cmp qword [rax + rcx*8 + 0x258], r9
je 0x41dff4
cmp qword [0x004430c8], r8
ja 0x41e0a2
xor eax, eax
cmp qword [r8 + 0x20], r9
setne al
mov qword [r8 + rax*8 + 0x20], rbx
test rbx, rbx
jne 0x41e001
jmp 0x41e050
mov qword [rax + rcx*8 + 0x258], rbx
test rbx, rbx
je 0x41e043
mov rcx, qword [0x004430c8]
cmp rcx, rbx
ja 0x41e0a2
mov qword [rbx + 0x30], r8
mov rax, qword [r9 + 0x20]
test rax, rax
je 0x41e02b
cmp rcx, rax
ja 0x41e0a2
mov qword [rbx + 0x20], rax
mov qword [rax + 0x30], rbx
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x41e050
cmp rcx, rax
ja 0x41e0a2
mov qword [rbx + 0x28], rax
mov qword [rax + 0x30], rbx
jmp 0x41e050
mov eax, 0xfffffffe
rol eax, cl
and dword [0x004430b4], eax
and rdx, 0xfffffffffffffff8
add r14, rdx
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
cmp rsi, qword [0x004430d0]
jne 0x41dc47
mov qword [0x004430b8], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
xor ebx, ebx
test r8, r8
jne 0x41dad9
jmp 0x41db7b
xor ebx, ebx
test r8, r8
jne 0x41dfbd
jmp 0x41e050
call fcn.0042e760
ud2