Function at 0x402428
Capabilities:
Get system information on windows
Write file on windows

Disassembly:
push rbp
mov eax, 0x10f0
call fcn.00405470
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1080], ecx
mov qword [rbp + 0x1088], rdx
mov qword [rbp + 0x1090], r8
mov dword [rbp + 0x1098], r9d
lea rax, [rbp + 0x1020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov rax, qword [rbp + 0x1088]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1060], rax
cmp qword [rbp + 0x1060], 0
jne 0x4024d0
mov rax, qword [rbp + 0x1088]
mov rdx, rax
lea rcx, str.____Error_opening_dump_filepath:__S_n
call fcn.00401560
mov ecx, dword [rbp + 0x1080]
call fcn.0040161d
mov qword [rbp + 0x1058], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1068], rax
jmp 0x4026d8
lea rcx, [rbp + 0xff0]
mov rdx, qword [rbp + 0x1068]
mov rax, qword [rbp + 0x1058]
mov r9d, 0x30
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call rax
test rax, rax
jne 0x402534
add qword [rbp + 0x1068], 0x1000
jmp 0x4026d8
mov eax, dword [rbp + 0x1010]
and eax, 0x1000
test eax, eax
je 0x402561
mov eax, dword [rbp + 0x1014]
and eax, 0x100
test eax, eax
jne 0x402561
mov eax, dword [rbp + 0x1018]
and eax, 0x1060000
test eax, eax
jne 0x402574
mov rax, qword [rbp + 0x1008]
add qword [rbp + 0x1068], rax
jmp 0x4026d8
mov rax, qword [rbp + 0x1068]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x1008]
mov dword [rbp - 0x38], eax
mov eax, dword [rbp + 0x1010]
mov dword [rbp - 0x34], eax
mov eax, dword [rbp + 0x1018]
mov dword [rbp - 0x30], eax
mov eax, dword [rbp + 0x1014]
mov dword [rbp - 0x2c], eax
cmp qword [rbp + 0x1090], 0
je 0x4025ed
cmp dword [rbp + 0x1098], 0
je 0x4025ed
mov rax, qword [rbp - 0x40]
cmp qword [rbp + 0x1090], rax
ja 0x4025dd
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp + 0x1098]
mov rdx, qword [rbp + 0x1090]
add rdx, rcx
cmp rax, rdx
jbe 0x4025ed
add qword [rbp + 0x1068], 0x1000
jmp 0x4026d8
lea rcx, [rbp + 0xfec]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1060]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x18
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rdx, qword [rbp + 0x1008]
mov rax, qword [rbp + 0x1068]
add rax, rdx
mov qword [rbp + 0x1050], rax
jmp 0x4026c4
lea r8, [rbp - 0x20]
mov rdx, qword [rbp + 0x1068]
mov rax, qword [rbp + 0x1058]
lea rcx, [rbp + 0xfe0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
je 0x40267d
mov rax, qword [rbp + 0xfe0]
cmp rax, 0x1000
je 0x402689
lea rcx, str.____Unable_to_read_a_full_page__
call fcn.00401560
lea rcx, [rbp + 0xfec]
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x1060]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
add qword [rbp + 0x1068], 0x1000
mov rax, qword [rbp + 0x1068]
cmp rax, qword [rbp + 0x1050]
jb 0x40263a
mov rax, qword [rbp + 0x1030]
cmp qword [rbp + 0x1068], rax
jb 0x4024f5
mov rax, qword [rbp + 0x1058]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1060]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x10f0
pop rbp
ret