Function at 0x45aeb0
Capabilities:
Get system information on windows
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov esi, dword [esp + 0x68]
mov dword [esp + 0xc], 0x18
push 0x18
call sym._malloc
add esp, 4
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push 0x18
push ebx
push 0x12
call sym._NtQuerySystemInformation_16
cmp eax, 0xc0000004
jne 0x45af02
push dword [esp + 0xc]
push ebx
call sym._realloc
add esp, 8
mov ebx, eax
test eax, eax
jne 0x45af0a
mov eax, str.realloc_pstart__size__failed
jmp 0x45b16e
test eax, eax
js 0x45b15c
mov ecx, dword [0x5076e4]
mov eax, ecx
mul dword [ebx + 8]
mov esi, edx
mov dword [esp + 0x18], eax
mov eax, ecx
mul dword [ebx + 4]
mov edi, edx
mov ebp, eax
push ebx
call sym._free
add esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov eax, dword [0x5052b0]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push esi
mov ebx, dword [esp + 0x20]
push ebx
call dbg.ffParseSize
add esp, 0xc
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [0x5052b0]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
push edi
push ebp
call dbg.ffParseSize
add esp, 0xc
mov eax, ebp
or eax, edi
movd xmm0, esi
movd xmm1, ebx
punpckldq xmm1, xmm0
movdqa xmm0, xmmword [0x4f6340]
punpckldq xmm1, xmm0
movapd xmm2, xmmword [0x4f6350]
subpd xmm1, xmm2
movapd xmm4, xmm1
unpckhpd xmm4, xmm1
addsd xmm4, xmm1
mov ebx, edi
movd xmm1, edi
mov edi, ebp
movd xmm3, ebp
punpckldq xmm3, xmm1
punpckldq xmm3, xmm0
subpd xmm3, xmm2
movapd xmm0, xmm3
unpckhpd xmm0, xmm3
addsd xmm0, xmm3
divsd xmm4, xmm0
mulsd xmm4, qword [0x4f6360]
xorpd xmm0, xmm0
je 0x45afef
movapd xmm0, xmm4
mov ebp, dword [esp + 0x68]
lea esi, [ebp + 0x20]
cmp dword [ebp + 0x3c], 0
je 0x45b08b
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
sub esp, 0x14
movzx eax, word [ebp + 0x48]
mov word [esp + 0xc], ax
movsd qword [esp + 4], xmm0
lea edi, [esp + 0x14]
mov dword [esp], edi
mov dword [esp + 0x10], 0
call dbg.ffPercentAppendNum
add esp, 0x14
mov dword [esp + 0x2c], 7
lea eax, [esp + 0xc]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 7
lea eax, [esp + 0x20]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x40], edi
lea eax, [esp + 0x2c]
push eax
push 3
push 0
push esi
push 0
push 0x4f6368
call dbg.ffPrintFormat
add esp, 0x18
jmp 0x45b4de
movupd xmmword [esp + 0x44], xmm4
movsd qword [esp + 0x18], xmm0
push 0
push esi
push 0
push 0x4f6368
call dbg.ffPrintLogoAndKey
add esp, 0x10
or edi, ebx
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
movzx eax, byte [0x5063e6]
je 0x45b18e
test al, 2
je 0x45b29a
sub esp, 0x10
movzx eax, word [ebp + 0x48]
mov word [esp + 0xc], ax
movupd xmm0, xmmword [esp + 0x54]
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x10]
mov dword [esp], eax
call dbg.ffPercentAppendBar
add esp, 0x10
mov eax, dword [esp]
mov edi, dword [esp + 4]
test eax, eax
je 0x45b115
lea ecx, [edi + 1]
cmp eax, ecx
jne 0x45b218
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 2]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x45b130
test eax, eax
je 0x45b21e
push ebx
push dword [esp + 0xc]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [esp + 8], eax
mov edi, dword [esp + 4]
jmp 0x45b279
test ebx, ebx
je 0x45b169
push ebx
call sym._free
add esp, 4
mov eax, str.NtQuerySystemInformation_SystemPagefileInformation__size__failed
add esi, 0x20
push eax
push 0x4f636d
push 0
push esi
push 0
push 0x4f6368
call dbg.ffPrintError
add esp, 0x18
jmp 0x45b545
test al, 2
je 0x45b325
sub esp, 0x10
movzx eax, word [ebp + 0x48]
mov word [esp + 0xc], ax
lea eax, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dbg.ffPercentAppendBar
add esp, 0x10
mov eax, dword [esp]
mov edi, dword [esp + 4]
test eax, eax
je 0x45b1d3
lea ecx, [edi + 1]
cmp eax, ecx
jne 0x45b240
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 2]
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x45b1f0
test eax, eax
je 0x45b249
push ebx
push dword [esp + 0xc]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [esp + 8], eax
mov edi, dword [esp + 4]
jmp 0x45b304
mov esi, dword [esp + 8]
jmp 0x45b27f
push ebx
call sym._malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x45b272
lea eax, [edi + 1]
push eax
push dword [esp + 0xc]
push esi
call sym._memcpy
add esp, 0xc
jmp 0x45b275
mov esi, dword [esp + 8]
jmp 0x45b30a
push ebx
call sym._malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x45b2fd
lea eax, [edi + 1]
push eax
push dword [esp + 0xc]
push esi
call sym._memcpy
add esp, 0xc
jmp 0x45b300
mov byte [esi], 0
mov dword [esp + 8], esi
mov dword [esp], ebx
lea ecx, [edi + 1]
mov dword [esp + 4], ecx
mov byte [esi + edi], 0x20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov byte [ecx + eax], 0
movzx eax, byte [0x5063e6]
test al, 4
movsd xmm0, qword [esp + 0x18]
jne 0x45b2c9
mov eax, esp
push dword [esp + 0x28]
push dword [esp + 0x18]
push str._s____s
push eax
call dbg.ffStrbufAppendF
movsd xmm0, qword [esp + 0x28]
add esp, 0x10
movzx eax, byte [0x5063e6]
test al, 1
je 0x45b405
xor eax, eax
cmp dword [esp + 4], 0
setne al
sub esp, 0x14
movzx ecx, word [ebp + 0x48]
mov word [esp + 0xc], cx
mov dword [esp + 0x10], eax
movsd qword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
jmp 0x45b3a6
mov byte [esi], 0
mov dword [esp + 8], esi
mov dword [esp], ebx
lea ecx, [edi + 1]
mov dword [esp + 4], ecx
mov byte [esi + edi], 0x20
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov byte [ecx + eax], 0
movzx eax, byte [0x5063e6]
test al, 4
jne 0x45b375
mov eax, dword [esp]
mov edi, dword [esp + 4]
test eax, eax
je 0x45b33f
mov ecx, edi
not ecx
add ecx, eax
cmp ecx, 8
jae 0x45b3b0
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
lea edx, [edi + 9]
nop dword [eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x45b350
test eax, eax
je 0x45b3b6
push ebx
push dword [esp + 0xc]
call sym._realloc
add esp, 8
mov esi, eax
mov dword [esp + 8], eax
mov edi, dword [esp + 4]
jmp 0x45b3df
xor eax, eax
cmp dword [esp + 4], 0
setne al
sub esp, 0x14
movzx ecx, word [ebp + 0x48]
mov word [esp + 0xc], cx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dbg.ffPercentAppendNum
add esp, 0x14
jmp 0x45b405
mov esi, dword [esp + 8]
jmp 0x45b3e2
push ebx
call sym._malloc
add esp, 4
mov esi, eax
test edi, edi
je 0x45b3d8
lea eax, [edi + 1]
push eax
push dword [esp + 0xc]
push esi
call sym._memcpy
add esp, 0xc
jmp 0x45b3db
mov byte [esi], 0
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esi + edi + 4], 0x64656c62
mov dword [esi + edi], 0x61736944
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
lea edx, [eax + 8]
mov dword [esp + 4], edx
mov byte [ecx + eax + 8], 0
mov eax, dword [esp + 4]
test eax, eax
je 0x45b4b3
mov edi, dword [esp + 8]
cmp byte [eax + edi - 1], 0x20
jne 0x45b4b3
inc eax
nop word cs:[eax + eax]
mov ebx, eax
add eax, 0xfffffffe
mov dword [esp + 4], eax
cmp ebx, 2
je 0x45b4a4
lea eax, [ebx - 1]
cmp byte [edi + ebx - 3], 0x20
je 0x45b430
cmp dword [esp], 0
jne 0x45b4ae
lea ecx, [eax - 1]
mov dword [esp + 0x18], ecx
mov dword [esp + 4], 0
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp eax, ebp
ja 0x45b470
push ebp
call sym._malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov dword [esp + 8], eax
mov dword [esp], ebp
mov ebp, dword [esp + 0x18]
push ebp
push edi
push eax
call sym._memcpy
add esp, 0xc
mov dword [esp + 4], ebp
mov edi, esi
jmp 0x45b4ae
cmp dword [esp], 0
je 0x45b54d
mov byte [edi + ebx - 2], 0
push 1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
mov esi, eax
push eax
push dword [esp + 8]
push 1
push dword [esp + 0x14]
call sym._fwrite
add esp, 0x10
push esi
push 0xa
call sym._fputc
add esp, 8
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x45b4ff
mov dword [esp], 0
push dword [esp + 8]
call sym._free
add esp, 4
cmp dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
je 0x45b522
mov dword [esp + 0x20], 0
push dword [esp + 0x28]
call sym._free
add esp, 4
cmp dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
je 0x45b545
mov dword [esp + 0xc], 0
push dword [esp + 0x14]
call sym._free
add esp, 4
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
jmp 0x45b4b3