Function at 0x180002da0
Capabilities:
Get system information on windows

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x238]
mov rax, qword [0x180020398]
xor rax, rbp
mov qword [rbp + 0x1e8], rax
lea rcx, [0x1800220b6]
call fcn.180004040
mov qword [rbp + 0xc8], 0
mov edx, 0x30
lea rcx, [rbp + 8]
call fcn.180003b60
mov edx, 0x30
lea rcx, [rbp + 0x58]
call fcn.180003b60
cmp dword [rbp + 0x210], 0
je 0x180003033
call fcn.180003900
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xc8], rax
mov rax, qword [0x180020628]
cmp qword [0x180020620], rax
je 0x180002e5d
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [0x180020628]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
jmp 0x180002e5d
mov rax, qword [rbp + 0x18]
cmp qword [rbp + 0xc8], rax
jae 0x180002f5b
mov r8d, 0x30
lea rdx, [rbp + 0x58]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rax, qword [0x180020620]
cmp qword [rbp + 0x60], rax
je 0x180002ec5
mov eax, dword [rbp + 0x80]
and eax, 0x20000
test eax, eax
je 0x180002ec3
cmp dword [rbp + 0x7c], 0x40
jne 0x180002ec3
cmp qword [rbp + 0x70], 0x32000
jbe 0x180002ec3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x180002f3e
mov eax, dword [0x180020640]
imul rax, rax, 0x18
lea rcx, [0x180020660]
mov rdx, qword [rbp + 0x58]
mov qword [rcx + rax], rdx
mov eax, dword [0x180020640]
imul rax, rax, 0x18
lea rcx, [0x180020660]
mov rdx, qword [rbp + 0x70]
mov qword [rcx + rax + 8], rdx
mov eax, dword [0x180020640]
imul rax, rax, 0x18
lea rcx, [0x180020660]
mov edx, dword [rbp + 0x7c]
mov dword [rcx + rax + 0x10], edx
mov eax, dword [0x180020640]
inc eax
mov dword [0x180020640], eax
mov rdx, qword [rbp + 0x58]
lea rcx, str.BaseAddr____p_n
call fcn.180003c60
mov rdx, qword [rbp + 0x70]
lea rcx, str.RegionSize______d_n
call fcn.180003c60
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0xc8]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xc8], rax
jmp 0x180002e5d
mov qword [rbp + 0xe8], 0
jmp 0x180002f79
mov rax, qword [rbp + 0xe8]
inc rax
mov qword [rbp + 0xe8], rax
mov eax, dword [0x180020640]
cmp qword [rbp + 0xe8], rax
jae 0x18000302e
imul rax, qword [rbp + 0xe8], 0x18
lea rcx, [0x180020660]
imul rdx, qword [rbp + 0xe8], 0x18
mov qword [rbp + 0x1d8], rdx
lea r8, [0x180020660]
mov qword [rbp + 0x1e0], r8
lea r9, [rbp + 0xa4]
mov r8d, 4
mov rdx, qword [rcx + rax + 8]
mov rcx, qword [rbp + 0x1e0]
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
imul rax, qword [rbp + 0xe8], 0x18
lea rcx, [0x180020660]
mov rax, qword [rcx + rax]
mov qword [0x180020608], rax
imul rax, qword [rbp + 0xe8], 0x18
lea rcx, [0x180020660]
mov eax, dword [rcx + rax + 8]
mov dword [0x180020600], eax
lea rdx, [0x180020610]
lea rcx, [0x180020600]
call qword [0x180020770]
jmp 0x180002f68
jmp 0x18000311e
mov qword [rbp + 0x108], 0
jmp 0x180003051
mov rax, qword [rbp + 0x108]
inc rax
mov qword [rbp + 0x108], rax
mov eax, dword [0x180020640]
cmp qword [rbp + 0x108], rax
jae 0x180003114
imul rax, qword [rbp + 0x108], 0x18
lea rcx, [0x180020660]
mov rax, qword [rcx + rax]
mov qword [0x180020608], rax
imul rax, qword [rbp + 0x108], 0x18
lea rcx, [0x180020660]
mov eax, dword [rcx + rax + 8]
mov dword [0x180020600], eax
lea rdx, [0x180020610]
lea rcx, [0x180020600]
call qword [0x180020770]
imul rax, qword [rbp + 0x108], 0x18
lea rcx, [0x180020660]
imul rdx, qword [rbp + 0x108], 0x18
lea r8, [0x180020660]
mov qword [rbp + 0x1d8], r8
imul r9, qword [rbp + 0x108], 0x18
mov qword [rbp + 0x1e0], r9
lea r10, [0x180020660]
lea r9, [rbp + 0xa4]
mov r8d, dword [rcx + rax + 0x10]
mov rax, qword [rbp + 0x1d8]
mov rdx, qword [rax + rdx + 8]
mov rax, qword [rbp + 0x1e0]
mov rcx, qword [r10 + rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180003040
mov dword [0x180020640], 0
lea rcx, [rbp - 0x20]
lea rdx, [0x180008538]
call fcn.180003e10
mov rcx, qword [rbp + 0x1e8]
xor rcx, rbp
call fcn.180004280
lea rsp, [rbp + 0x1f8]
pop rdi
pop rbp
ret