Function at 0x140004bb0
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
mov r13, rcx
mov edi, esi
mov r15d, esi
cmp rdx, 0x40
jae 0x140004bf8
mov ecx, recvfrom
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140004e97
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x140004c09
mov ecx, 0xc1
jmp 0x140004bed
movsxd rcx, dword [rcx + 0x3c]
lea rax, [rcx + 0x108]
cmp rdx, rax
jb 0x140004be8
lea r14, [rcx + r13]
cmp dword [r14], 0x4550
jne 0x140004c02
mov eax, 0x8664
cmp word [r14 + 4], ax
jne 0x140004c02
mov r10d, 1
test byte [r14 + 0x38], r10b
jne 0x140004c02
movzx eax, word [r14 + 6]
movzx ecx, word [r14 + 0x14]
mov r9d, dword [r14 + 0x38]
test eax, eax
je 0x140004c7c
lea rdx, [r14 + 0x24]
mov r8d, eax
add rdx, rcx
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x140004c68
mov eax, dword [rdx]
add rax, r9
jmp 0x140004c6c
mov eax, dword [rdx]
add eax, ecx
cmp rax, rdi
cmova rdi, rax
add rdx, 0x28
sub r8, r10
jne 0x140004c5a
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rbp - 0x2c]
mov eax, dword [r14 + 0x50]
lea rbx, [rdx - 1]
add rbx, rax
lea rcx, [rdx - 1]
add rcx, rdi
lea rax, [rdx - 1]
not rax
and rbx, rax
lea rax, [rdx - 1]
not rax
and rcx, rax
cmp rbx, rcx
jne 0x140004c02
mov rcx, qword [r14 + 0x30]
mov edi, 0x3000
mov r8d, edi
mov r9d, 4
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140004cff
lea r9d, [rax + 4]
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
jne 0x140004cff
mov ecx, recvfrom
jmp 0x140004bed
lea rcx, [r12 + rbx]
mov rax, r12
jmp 0x140004d4f
mov ecx, reloc.WS2_32.dll_recv
call fcn.14001a390
mov rdi, rax
test rax, rax
je 0x140004ecb
mov qword [rax], r15
mov r9d, 4
mov r8d, 0x3000
mov qword [rax + 8], r12
mov rdx, rbx
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x140004eb4
lea rcx, [rax + rbx]
movabs rdx, 0xffffffff00000000
and rcx, rdx
and rax, rdx
cmp rax, rcx
jb 0x140004d08
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140004ecb
mov rbx, qword [rbp + 0x48]
mov qword [rax + 8], r12
movzx eax, word [r14 + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rdi + 0x58], rsi
mov dword [rdi + 0x20], eax
lea rax, [0x140004b88]
mov qword [rdi + 0x28], rax
lea rax, [0x140004b90]
mov qword [rdi + 0x30], rax
lea rax, [0x140004b98]
mov qword [rdi + 0x38], rax
lea rax, [0x140004ba0]
mov qword [rdi + 0x40], rax
lea rax, [0x140004ba8]
mov qword [rdi + 0x48], rax
mov eax, dword [rbp - 0x2c]
mov dword [rdi + 0x68], eax
mov qword [rdi + 0x70], r15
mov edx, dword [r14 + 0x54]
cmp rbx, rdx
jae 0x140004ee1
mov ecx, recvfrom
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [rdi + 0x1c], esi
je 0x140004e16
mov rax, qword [rdi]
xor r8d, r8d
mov rcx, qword [rdi + 8]
xor edx, edx
mov r9d, dword [rax + 0x28]
add r9, rcx
call r9
mov rcx, qword [rdi + 0x50]
call fcn.140019e44
cmp qword [rdi + 0x10], rsi
je 0x140004e5a
mov r14d, esi
cmp dword [rdi + 0x18], esi
jle 0x140004e51
mov rbx, rsi
mov rax, qword [rdi + 0x10]
mov rcx, qword [rbx + rax]
test rcx, rcx
je 0x140004e44
mov rdx, qword [rdi + 0x58]
call qword [rdi + 0x48]
inc r14d
add rbx, 8
cmp r14d, dword [rdi + 0x18]
jl 0x140004e30
mov rcx, qword [rdi + 0x10]
call fcn.140019e44
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140004e72
mov r9, qword [rdi + 0x58]
xor edx, edx
mov r8d, 0x8000
call qword [rdi + 0x30]
mov r8, qword [rdi + 0x58]
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x70]
call fcn.140004a6c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
lea rdx, [0x140004b90]
xor r8d, r8d
call fcn.140004a6c
jmp 0x140004cf5
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, r15
jmp 0x140004eb7
mov r9d, 4
mov r8d, 0x1000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [r14 + 0x54]
mov rdx, r13
mov rcx, rax
mov qword [rbp + 0x68], rax
mov r15, rax
call fcn.140013e90
movsxd rdx, dword [r13 + 0x3c]
add rdx, r15
mov dword [rbp + 0x58], esi
mov qword [rdi], rdx
mov qword [rdx + 0x30], r12
mov rcx, qword [rdi]
mov r8, qword [rdi + 8]
mov qword [rbp + 0x50], r8
movzx edx, word [rcx + 0x14]
cmp si, word [rcx + 6]
jae 0x14000500f
lea r15, [rcx + 0x28]
add r15, rdx
mov edx, dword [r15]
test edx, edx
jne 0x140004f97
cmp dword [r14 + 0x38], esi
jle 0x140004ff4
mov ecx, dword [r15 - 4]
mov r9d, 4
movsxd rdx, dword [r14 + 0x38]
add rcx, r8
mov rax, qword [rdi + 0x58]
mov r8d, 0x1000
mov qword [rbp + 0x60], rdx
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test rax, rax
je 0x140004dfb
mov ecx, dword [r15 - 4]
xor edx, edx
add rcx, qword [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov dword [r15 - 8], ecx
call fcn.140015d40
jmp 0x140004ff0
mov eax, dword [r15 + 4]
add eax, edx
cmp rbx, rax
jb 0x140004df0
mov ecx, dword [r15 - 4]
mov r9d, 4
mov rax, qword [rdi + 0x58]
add rcx, r8
mov r8d, 0x1000
mov qword [rsp + 0x20], rax
call qword [rdi + 0x28]
test rax, rax
je 0x140004dfb
mov ebx, dword [r15 - 4]
add rbx, qword [rbp + 0x50]
mov edx, dword [r15 + 4]
mov rcx, rbx
mov r8d, dword [r15]
add rdx, r13
call fcn.140013e90
mov dword [r15 - 8], ebx
mov rbx, qword [rbp + 0x48]
mov r8, qword [rbp + 0x50]
mov edx, dword [rbp + 0x58]
add r15, 0x28
mov rax, qword [rdi]
inc edx
mov dword [rbp + 0x58], edx
movzx ecx, word [rax + 6]
cmp edx, ecx
jl 0x140004f3d
mov rax, qword [rdi]
mov r9, qword [rax + 0x30]
sub r9, qword [r14 + 0x30]
je 0x1400050b5
mov ecx, dword [rax + 0xb4]
mov r14, qword [rdi + 8]
test ecx, ecx
jne 0x140005036
mov eax, esi
lea r15d, [rcx + 1]
jmp 0x1400050b0
mov edx, dword [rax + 0xb0]
add rdx, r14
lea ebx, [rcx + rdx]
jmp 0x1400050a2
mov r8d, dword [rdx]
lea r10, [rdx + 8]
mov eax, dword [rdx + 4]
add r8, r14
sub rax, 8
mov r11d, esi
test rax, 0xfffffffffffffffe
jbe 0x14000509c
movzx eax, word [r10]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14000507f
cmp eax, 0xa
jne 0x140005083
add qword [rcx + r8], r9
jmp 0x140005083
add dword [rcx + r8], r9d
mov ecx, dword [rdx + 4]
inc r11d
sub rcx, 8
mov eax, r11d
shr rcx, 1
add r10, 2
cmp rax, rcx
jb 0x140005060
mov eax, dword [rdx + 4]
add rdx, rax
cmp rdx, rbx
jb 0x140005044
mov r15d, 1
mov eax, r15d
mov dword [rdi + 0x24], eax
jmp 0x1400050bf
mov r15d, 1
mov dword [rdi + 0x24], r15d
mov rax, qword [rdi]
mov r13, qword [rdi + 8]
mov dword [rbp + 0x48], r15d
cmp dword [rax + 0x94], esi
je 0x1400051e7
mov r14d, dword [rax + 0x90]
mov edx, reloc.WS2_32.dll_sendto
add r14, r13
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1400051e7
add r14, 0x10
mov ebx, r15d
cmp dword [r14 - 4], esi
je 0x1400051d9
mov ecx, dword [r14 - 4]
mov rdx, qword [rdi + 0x58]
add rcx, r13
call qword [rdi + 0x38]
mov r15, rax
test rax, rax
je 0x14000526b
mov ecx, dword [rdi + 0x18]
mov ebx, 1
add ecx, ebx
movsxd rdx, ecx
mov rcx, qword [rdi + 0x10]
shl rdx, 3
call fcn.14001a398
test rax, rax
je 0x140005257
movsxd rcx, dword [rdi + 0x18]
mov qword [rdi + 0x10], rax
mov qword [rax + rcx*8], r15
add dword [rdi + 0x18], ebx
mov eax, dword [r14 - 0x10]
test eax, eax
jne 0x14000515e
mov eax, dword [r14]
mov ecx, dword [r14]
mov ebx, eax
add rbx, r13
cmp qword [rbx], rsi
je 0x1400051b3
mov eax, ecx
sub rax, rbx
add rax, r13
mov qword [rbp + 0x58], rax
mov rax, qword [rbx]
mov rcx, r15
mov r8, qword [rdi + 0x58]
test rax, rax
jns 0x14000518b
movzx edx, ax
jmp 0x140005192
lea rdx, [r13 + 2]
add rdx, rax
call qword [rdi + 0x40]
mov rcx, qword [rbp + 0x58]
mov qword [rbx + rcx], rax
mov rax, rcx
cmp qword [rbx + rax], rsi
je 0x140005236
add rbx, 8
cmp qword [rbx], rsi
jne 0x140005177
mov ebx, dword [rbp + 0x48]
test ebx, ebx
je 0x140005240
add r14, 0x14
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [r14 - 0x10]
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1400050fd
test ebx, ebx
je 0x140004dfb
mov r15d, 1
mov r10, qword [rdi]
movabs rax, 0xffffffff00000000
mov r9d, dword [rdi + 0x68]
sub r9, r15
not r9
movzx ecx, word [r10 + 0x14]
mov rbx, qword [r10 + 0x30]
add rcx, r10
and rbx, rax
mov qword [rbp + 0x58], rbx
mov r11d, dword [rcx + 0x20]
mov eax, dword [rcx + 0x28]
or r11, rbx
and r9, r11
mov qword [rbp - 0x50], r11
mov qword [rbp - 0x48], r9
test eax, eax
jne 0x14000527f
test byte [rcx + 0x3c], 0x40
je 0x140005275
mov eax, dword [r10 + 0x20]
jmp 0x14000527f
mov ebx, esi
mov dword [rbp + 0x48], ebx
jmp 0x1400051b6
mov rdx, qword [rdi + 0x58]
mov rcx, r15
call qword [rdi + 0x48]
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400051d9
mov rdx, qword [rdi + 0x58]
mov rcx, r15
call qword [rdi + 0x48]
mov ecx, recvfrom
jmp 0x140004df5
mov ecx, 0x7e
jmp 0x140004df5
test byte [rcx + 0x3c], 0x80
je 0x14000527f
mov eax, dword [r10 + 0x24]
mov edx, dword [rcx + 0x3c]
mov r8d, eax
mov qword [rbp - 0x40], r8
mov dword [rbp - 0x38], edx
mov dword [rbp - 0x34], esi
mov dword [rbp + 0x48], r15d
cmp r15w, word [r10 + 6]
jae 0x140005362
lea r14, [rcx + 0x64]
mov r15d, dword [r14 - 0x1c]
mov eax, dword [r14 - 0x14]
or r15, rbx
mov ebx, dword [rdi + 0x68]
dec rbx
not rbx
and rbx, r15
test eax, eax
jne 0x1400052d7
test byte [r14], 0x40
je 0x1400052cb
mov rax, qword [rdi]
mov eax, dword [rax + 0x20]
jmp 0x1400052d7
test byte [r14], 0x80
je 0x1400052d7
mov rax, qword [rdi]
mov eax, dword [rax + 0x24]
mov r13d, eax
cmp r9, rbx
je 0x140005316
lea rax, [r8 + r11]
cmp rax, rbx
ja 0x140005316
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.140004ac8
test eax, eax
je 0x140004dfb
mov edx, dword [r14]
mov r11, r15
mov qword [rbp - 0x50], r15
mov r9, rbx
mov qword [rbp - 0x48], rbx
mov r8d, r13d
mov qword [rbp - 0x40], r13
jmp 0x140005336
mov ecx, dword [r14]
mov eax, ecx
and eax, edx
or edx, ecx
bt eax, 0x19
jb 0x140005329
btr edx, 0x19
mov r8, r13
sub r8, r11
add r8, r15
mov qword [rbp - 0x40], r8
mov r13d, dword [rbp + 0x48]
mov r15d, 1
mov rax, qword [rdi]
add r13d, r15d
mov rbx, qword [rbp + 0x58]
add r14, 0x28
mov dword [rbp - 0x38], edx
mov dword [rbp + 0x48], r13d
movzx ecx, word [rax + 6]
cmp r13d, ecx
jl 0x1400052a2
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x34], r15d
mov rcx, rdi
call fcn.140004ac8
test eax, eax
je 0x140004dfb
mov rax, qword [rdi]
mov r14, qword [rdi + 8]
cmp dword [rax + 0xd0], esi
je 0x1400053b2
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + r14 + 0x18]
test rbx, rbx
je 0x1400053b2
jmp 0x1400053aa
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x14000539b
mov rax, qword [rdi]
cmp dword [rax + 0x28], esi
je 0x1400053d1
cmp dword [rdi + 0x20], esi
je 0x1400053c5
mov dword [rdi + 0x1c], r15d
jmp 0x1400053d5
mov eax, dword [rax + 0x28]
add rax, r12
mov qword [rdi + 0x60], rax
jmp 0x1400053d5
mov qword [rdi + 0x60], rsi
mov rbx, qword [rdi]
mov r14, qword [rbp + 0x68]
sub rbx, r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.140017e84
add rbx, 0x84
je 0x140005409
call fcn.140017e58
movzx eax, al
mov byte [rsi + r14], al
add rsi, r15
cmp rsi, rbx
jb 0x1400053f5
mov rax, rdi
jmp 0x140004e99