Function at 0x4017b2
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov qword [rbp + 0x10], rcx
call sub.kernel32.dll_GetProcessHeap
movabs rcx, 0x100
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapAlloc
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0
je 0x4017f5
jmp 0x401804
movabs rax, 0
jmp 0x401b07
movabs rax, 0
mov qword [rbp - 0x40], rax
movabs rax, 0x30
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
movabs rax, 0
mov r9, rax
movabs rax, 0x38
mov r8, rax
lea rax, [rbp - 0x40]
mov r11, rax
mov eax, 0xb6
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.ntdll.dll_NtQuerySystemInformation
call fcn.00401589
mov eax, 0
mov byte [rbp - 0x45], al
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x44]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, 0
mov byte [rbp - 0x4a], al
movabs rax, 4
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x49]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
lea rax, str.1111
mov r11, rax
lea rax, [0x004040aa]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
mov ecx, 0
cmp ecx, eax
jne 0x401957
mov eax, 0
mov dword [rbp - 0x50], eax
mov eax, dword [rbp - 0x50]
cmp eax, 4
jge 0x401952
jmp 0x401923
mov eax, dword [rbp - 0x50]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x50], eax
jmp 0x401904
mov eax, dword [rbp - 0x50]
movsxd rax, eax
lea rcx, [rbp - 0x45]
add rcx, rax
mov qword [rbp - 0x58], rcx
call sub.msvcrt.dll_rand
mov ecx, 0x1a
cdq
idiv ecx
add edx, 0x61
shl edx, 0x18
sar edx, 0x18
mov rax, qword [rbp - 0x58]
mov byte [rax], dl
jmp 0x401915
jmp 0x401980
movabs rax, 5
mov r8, rax
lea rax, str.DEAD
mov r11, rax
lea rax, [rbp - 0x45]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
lea rax, str.2222
mov r11, rax
lea rax, [0x004040b9]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
mov ecx, 0
cmp ecx, eax
jne 0x401a07
mov eax, 0
mov dword [rbp - 0x5c], eax
mov eax, dword [rbp - 0x5c]
cmp eax, 4
jge 0x401a02
jmp 0x4019d3
mov eax, dword [rbp - 0x5c]
mov rcx, rax
add eax, 1
mov dword [rbp - 0x5c], eax
jmp 0x4019b4
mov eax, dword [rbp - 0x5c]
movsxd rax, eax
lea rcx, [rbp - 0x4a]
add rcx, rax
mov qword [rbp - 0x68], rcx
call sub.msvcrt.dll_rand
mov ecx, 0x1a
cdq
idiv ecx
add edx, 0x61
shl edx, 0x18
sar edx, 0x18
mov rax, qword [rbp - 0x68]
mov byte [rax], dl
jmp 0x4019c5
jmp 0x401a30
movabs rax, 5
mov r8, rax
lea rax, str.BEEF
mov r11, rax
lea rax, [rbp - 0x4a]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r8, rcx
mov ecx, 0
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapSize
mov rcx, qword [rbp - 0x38]
shr rcx, 0x14
mov rdx, qword [rbp - 0x40]
shr rdx, 0x14
mov qword [rbp - 0x70], rax
lea rax, [0x00404d08]
mov qword [rsp + 0x48], rax
mov eax, dword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rcx
lea rax, [0x00404022]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x4a]
mov qword [rsp + 0x20], rax
lea rax, [rbp - 0x45]
mov r9, rax
lea rax, str._v5__hs__hs__hs__06llx_06llx__06x__ls.bin
mov r8, rax
mov rax, qword [rbp - 0x70]
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0040136c
call sub.kernel32.dll_GetProcessHeap
mov rcx, qword [rbp - 8]
mov r10, rcx
mov qword [rbp - 0x78], rax
mov rcx, r10
call sub.msvcrt.dll_wcslen
add rax, 1
shl rax, 1
mov r9, rax
mov rax, qword [rbp - 8]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 0x78]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_HeapReAlloc
leave
ret