Function at 0x402f70
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0xa08
mov rax, qword [0x00408550]
mov qword [rsp + 0x9d0], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov dword [rsp + 0x4c], ecx
xor edi, edi
lea rcx, [r11 - 0x978]
mov qword [r11 - 0x18], r14
mov esi, r8d
mov dword [rsp + 0x50], r8d
mov r12d, edx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0xa0]
mov r14d, dword [rsp + 0x94]
mov rbx, qword [rsp + 0x98]
lea rcx, str.CBLCOREL
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x403044
lea rdx, str.GetCoreFilename
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x403044
mov ecx, dword [0x00408588]
lea rdx, [rsp + 0x40]
call rax
cmp eax, 0xffffffff
je 0x40344d
test eax, eax
je 0x403044
mov rcx, qword [rsp + 0x40]
mov edx, 0x8101
mov r8d, 0x180
call sub.msvcrt.dll__open
mov ebp, eax
jmp 0x40305d
lea rcx, [0x004081f0]
mov edx, 0x8101
mov r8d, 0x180
call sub.msvcrt.dll__open
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4030b5
lea rdx, [rsp + 0x7d0]
mov r8d, 0x200
mov ecx, 0xd1
call fcn.00401550
lea rdx, [rsp + 0x5d0]
mov r8d, 0x200
mov ecx, 0xd2
call fcn.00401550
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x7d0]
mov r9d, 0x10030
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40344d
xor r8d, r8d
mov ecx, ebp
mov qword [rsp + 0x9f8], r13
lea edx, [r8 + 0x40]
mov qword [rsp + 0x9e8], r15
call sub.msvcrt.dll__lseek
mov rax, qword [0x00408578]
mov r11, qword [str.MF_CORE]
mov qword [rsp + 0x5c8], rax
movsxd rax, dword [0x004085a0]
mov qword [rsp + 0x590], r11
mov rcx, rax
mov dword [rsp + 0x598], 1
mov dword [rsp + 0x59c], 3
shl rcx, 4
mov dword [rsp + 0x5a0], r12d
mov dword [rsp + 0x5a4], esi
mov dword [rsp + 0x5bc], eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rsi, qword [0x00408590]
xor r13d, r13d
test rsi, rsi
mov r15, rax
je 0x4031d1
mov edi, dword [rsp + 0x4c]
mov r12, rax
nop
mov ecx, dword [rsp + 0x5a8]
cmp dword [rsi + 0x10], edi
cmove ecx, r13d
mov dword [rsp + 0x5a8], ecx
mov ecx, ebp
call sub.msvcrt.dll__tell
lea rdx, [rsp + 0xc0]
mov dword [r12 + 8], eax
mov eax, dword [rsi + 0x10]
mov qword [r12], rax
mov dword [rsp + 0xf0], 0x10000b
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
lea rdx, [rsp + 0xc0]
mov r8d, 0x4d0
mov ecx, ebp
call sub.msvcrt.dll__write
mov rdx, qword [rsi + 8]
lea r8, [rsp + 0xc0]
mov ecx, ebp
call fcn.00404470
mov rsi, qword [rsi]
inc r13d
add r12, 0x10
test rsi, rsi
jne 0x403150
mov rdi, qword [rsp + 0x38]
mov ecx, ebp
call sub.msvcrt.dll__tell
movsxd r8, dword [0x004085a0]
mov rdx, r15
shl r8, 4
mov ecx, ebp
mov dword [rsp + 0x5b0], eax
call sub.msvcrt.dll__write
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
xor r11d, r11d
mov rcx, r14
mov dword [rsp + 0x5b4], r11d
mov dword [rsp + 0x5c0], r11d
mov dword [rsp + 0x5b8], r11d
call qword [sym.imp.msvcrt.dll_malloc]
lea esi, [r14 - 1]
mov ecx, ebp
mov r13, rax
mov qword [rsp + 0x38], rsi
call sub.msvcrt.dll__tell
mov r11d, eax
and r11, rsi
mov qword [rsp + 0x30], r11
je 0x403265
mov r8, r14
xor edx, edx
mov rcx, r13
sub r8, r11
mov qword [rsp + 0x30], r8
call sub.msvcrt.dll_memset
mov r8, qword [rsp + 0x30]
mov rdx, r13
mov ecx, ebp
call sub.msvcrt.dll__write
mov r15, qword [rsp + 0x38]
nop
nop
mov rcx, qword [0x00408570]
lea r8, [rsp + 0x60]
mov r9d, 0x30
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp dword [rsp + 0x80], 0x1000
jne 0x403345
inc dword [rsp + 0x5b8]
mov ecx, 0x18
call qword [sym.imp.msvcrt.dll_malloc]
test rdi, rdi
mov rsi, rax
jne 0x4032bb
mov rdi, rax
jmp 0x4032be
mov qword [r15], rax
mov r15, rax
xor eax, eax
mov ecx, ebp
mov qword [rsi], rax
mov dword [rsi + 0x10], eax
mov qword [rsi + 8], rbx
call sub.msvcrt.dll__tell
mov dword [rsi + 0x14], eax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
lea rax, [rcx + rdx]
cmp rbx, rax
jae 0x403337
nop
nop
mov rcx, qword [0x00408570]
lea rax, [rsp + 0x30]
mov r9, r14
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r8d, r14d
mov rdx, r13
mov ecx, ebp
call sub.msvcrt.dll__write
add dword [rsi + 0x10], r14d
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
add rbx, r14
lea rax, [rcx + rdx]
cmp rbx, rax
jb 0x4032f0
cmp rbx, qword [rsp + 0x58]
jae 0x40336c
mov rsi, qword [rsp + 0x38]
jmp 0x40334f
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
lea rax, [r14 + rcx]
lea rbx, [rax + rdx - 1]
mov rax, rsi
not rax
and rbx, rax
cmp rbx, qword [rsp + 0x58]
jb 0x403270
mov rcx, r13
call qword [sym.imp.msvcrt.dll_free]
mov ecx, ebp
call sub.msvcrt.dll__tell
mov r15, qword [rsp + 0x9e8]
mov r13, qword [rsp + 0x9f8]
mov dword [rsp + 0x5ac], eax
mov eax, dword [rsp + 0x5b8]
test eax, eax
je 0x4033f9
lea rcx, [rax + rax*2]
shl rcx, 3
mov qword [rsp + 0x30], rcx
call qword [sym.imp.msvcrt.dll_malloc]
test rdi, rdi
mov rbx, rax
je 0x4033e1
lea rdx, [rax + 0x10]
nop
mov rcx, qword [rdi + 8]
add rdx, 0x18
mov qword [rdx - 0x28], rcx
mov ecx, dword [rdi + 0x10]
mov qword [rdx - 0x20], rcx
mov ecx, dword [rdi + 0x14]
mov dword [rdx - 0x18], ecx
mov rdi, qword [rdi]
test rdi, rdi
jne 0x4033c0
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov ecx, ebp
call sub.msvcrt.dll__write
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
xor r8d, r8d
xor edx, edx
mov ecx, ebp
call sub.msvcrt.dll__lseek
lea rdx, [rsp + 0x590]
mov r8d, 0x40
mov ecx, ebp
call sub.msvcrt.dll__write
mov ecx, ebp
call sub.msvcrt.dll__close
cmp dword [0x00408b60], 0
jne 0x40344d
mov rax, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
test rax, rax
lea r9, str.cblcore
cmovne r9, rax
xor ecx, ecx
call fcn.00402cd0
mov r14, qword [rsp + 0x9f0]
mov r12, qword [rsp + 0xa00]
mov rdi, qword [rsp + 0xa28]
mov rsi, qword [rsp + 0xa20]
mov rbp, qword [rsp + 0xa18]
mov rbx, qword [rsp + 0xa10]
mov rcx, qword [rsp + 0x9d0]
call fcn.00405710
add rsp, 0xa08
ret