Function at 0x1800ef7f0
Capabilities:
Get system information on windows

Disassembly:
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x180249a80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800ef83e
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
lea rcx, str.KERNELBASE.DLL
sub r15, 0xfff
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800ef9f2
lea rdx, str.VirtualAlloc
mov qword [rsp + 0x90], r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
je 0x1800efacf
cmp rax, 0x48
je 0x1800efacf
mov qword [rsp + 0xd8], rsi
mov rsi, qword [0x18024e8c0]
test rsi, rsi
je 0x1800ef8cd
nop dword [rax + rax]
cmp rsi, r14
jb 0x1800ef8c5
cmp rsi, r15
jae 0x1800ef8c5
cmp qword [rsi + 8], 0
jne 0x1800ef9df
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800ef8b0
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x98], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800ef962
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800ef959
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800ef959
cmp dword [rsp + 0x40], 0x10000
je 0x1800efa0f
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800ef959
sub rbx, rbp
cmp rbx, r14
jae 0x1800ef920
test rsi, rsi
jne 0x1800efa6e
cmp rdi, r15
ja 0x1800efaaf
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800efaaf
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800efaaf
cmp dword [rsp + 0x40], 0x10000
je 0x1800efa42
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800ef992
jmp 0x1800efaaf
mov rax, rsi
mov rsi, qword [rsp + 0xd8]
mov r13, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1801a9230
add rsp, 0xa0
pop r15
pop r14
pop rdi
ret
test rbx, rbx
je 0x1800ef959
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call r13
mov rsi, rax
test rax, rax
jne 0x1800efa6e
cmp rbx, r14
jae 0x1800ef900
jmp 0x1800ef962
test rdi, rdi
je 0x1800efaaf
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call r13
mov rsi, rax
test rax, rax
jne 0x1800efa6e
cmp rdi, r15
jbe 0x1800ef970
jmp 0x1800efaaf
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop word [rax + rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800efa80
mov rax, qword [0x18024e8c0]
mov qword [rsi], rax
mov qword [0x18024e8c0], rsi
mov r12, qword [rsp + 0x98]
mov rax, rsi
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
jmp 0x1800ef9e2
xor r9d, r9d
lea r8, [0x1801aec24]
lea rdx, str.VirtAlloc_byte
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x1800ef9ea