Function at 0x18000a580
Capabilities:
Access the windows event log
Enumerate services
Get disk information
Get disk size
Get memory capacity
Get system information on windows
List tcp connections and listeners

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbfe0]
mov eax, 0xc0e0
call fcn.1800197c0
sub rsp, rax
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0xbfb0], rax
mov qword [rsp + 0x68], rcx
lea rcx, str.Null_pointer:__p_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a5e2
xor edx, edx
lea rcx, str.Null_pointer:__p_n
call fcn.180001120
lea rcx, str.Unsigned_short_integer:__hu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a604
mov edx, 0xffff
lea rcx, str.Unsigned_short_integer:__hu_n
call fcn.180001120
lea rcx, str.Null_pointer:__p_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a623
xor edx, edx
lea rcx, str.Null_pointer:__p_n
call fcn.180001120
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a679
movzx ecx, word [rsp + 0x52]
movzx eax, word [rsp + 0x54]
movzx r10d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x4e]
movzx r8d, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, str.Current_Time_2:__d__d__d__d:_d:_d_n
mov dword [rsp + 0x20], r10d
call fcn.180001120
lea rcx, str.Octal_integer:__o_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a69b
mov edx, 0x53
lea rcx, str.Octal_integer:__o_n
call fcn.180001120
lea rcx, str.Boolean_value:_true_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a6b8
lea rcx, str.Boolean_value:_true_n
call fcn.180001120
mov dword [rsp + 0x48], 0x77003a
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x4c], 0x660074
xor r12d, r12d
mov dword [rsp + 0x50], 0x620062
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x54], 0x71
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x18000a6f0
lea rcx, str.Hello__World__n
lea r15, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a721
lea rcx, str.Hello__World__n
call fcn.180001120
mov edi, 1
mov r14d, r12d
lea esi, [rdi + 8]
nop dword [rax]
lea ebx, [rdi + r14]
lea r14d, [rdi]
mov edi, ebx
lea rcx, [0x18004c408]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a758
mov edx, ebx
lea rcx, [0x18004c408]
call fcn.180001120
sub rsi, 1
jne 0x18000a730
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a77b
lea rcx, [0x18004bd68]
call fcn.180001120
lea rcx, str.ASCII_value_of__c:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a7a0
mov edx, 0x41
lea rcx, str.ASCII_value_of__c:__d_n
mov r8d, edx
call fcn.180001120
lea rcx, str.Array_length:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a7c2
mov edx, 5
lea rcx, str.Array_length:__d_n
call fcn.180001120
lea rcx, str.Difference_between__d_and__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a7ec
mov edx, 0xa
lea rcx, str.Difference_between__d_and__d_is__d_n
lea r9d, [rdx - 7]
lea r8d, [rdx - 3]
call fcn.180001120
lea rdx, str.System
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rdi, rax
test rax, rax
je 0x18000a97d
mov ecx, 0x10000
call fcn.180020ffc
mov rbx, rax
test rax, rax
je 0x18000a966
xor r8d, r8d
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x10000
lea edx, [r8 + 5]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x18000a953
nop
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a870
mov edx, dword [rbx + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a891
movzx edx, word [rbx + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a8b2
movzx edx, word [rbx + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a8db
lea rcx, [rbx + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a8fe
mov edx, dword [rbx + 0x24]
lea rcx, str.Source_Name:__s_n
add rdx, rbx
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a921
mov edx, dword [rbx + 0x34]
lea rcx, str.Event_String:__s_n
add rdx, rbx
call fcn.180001120
xor r8d, r8d
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov dword [rsp + 0x20], 0x10000
lea edx, [r8 + 5]
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x18000a850
mov rcx, rbx
call fcn.180020c30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18000a989
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x18000a989
lea rcx, str.Error_opening_event_log
call fcn.18001db60
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x18000a9c8
lea rcx, str.Physical_Memory_Total:__llu_MB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a9d4
mov rdx, qword [rsp + 0x78]
lea rcx, str.Physical_Memory_Total:__llu_MB_n
shr rdx, 0x14
call fcn.180001120
jmp 0x18000a9d4
lea rcx, str.Error_getting_physical_memory
call fcn.18001db60
lea rcx, str.The_value_of_pi_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000a9fe
movsd xmm1, qword [0x18004d240]
lea rcx, str.The_value_of_pi_is:__lf_n
movq rdx, xmm1
call fcn.180001120
lea rcx, str.Octal_integer:__o_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aa20
mov edx, 0x53
lea rcx, str.Octal_integer:__o_n
call fcn.180001120
lea rdx, [r15 + 0x18]
mov ecx, 1
call fcn.18001d968
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov bl, 0x41
nop dword [rax + rax]
test dil, 1
je 0x18000aaf1
lea r9, [rsp + 0x58]
mov byte [rsp + 0x40], bl
lea r8, [rsp + 0x60]
mov word [rsp + 0x41], 0x5c3a
xor edx, edx
mov byte [rsp + 0x43], r12b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x18000aae5
lea rcx, str.Disk_Drive__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aa97
lea rdx, [rsp + 0x40]
lea rcx, str.Disk_Drive__s_n
call fcn.180001120
lea rcx, str.__Total_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aabd
mov rdx, qword [rsp + 0x60]
lea rcx, str.__Total_Space:__llu_GB_n
shr rdx, 0x1e
call fcn.180001120
lea rcx, str.__Free_Space:__llu_GB_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aaf1
mov rdx, qword [rsp + 0x58]
lea rcx, str.__Free_Space:__llu_GB_n
shr rdx, 0x1e
call fcn.180001120
jmp 0x18000aaf1
lea rcx, str.Error_getting_disk_drive_information
call fcn.18001db60
shr edi, 1
inc bl
cmp bl, 0x5a
jle 0x18000aa40
lea rcx, str.Pi:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ab28
movsd xmm1, qword [0x18004d240]
lea rcx, str.Pi:__lf_n
movq rdx, xmm1
call fcn.180001120
lea rcx, str.Array_max:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ab4a
mov edx, 5
lea rcx, str.Array_max:__d_n
call fcn.180001120
test r14, r14
jne 0x18000ab56
xor eax, eax
jmp 0x18000b3f6
movaps xmmword [rsp + 0xc0d0], xmm6
lea rcx, str.Quotient_of__d_and__d_is:__d_n
movaps xmmword [rsp + 0xc0c0], xmm8
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ab91
mov edx, 0x64
lea rcx, str.Quotient_of__d_and__d_is:__d_n
lea r9d, [rdx - 0x4b]
lea r8d, [rdx - 0x60]
call fcn.180001120
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d210]
test eax, eax
jns 0x18000abc6
movaps xmm0, xmm6
call fcn.180039fa0
movaps xmm1, xmm0
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
movq rdx, xmm0
call fcn.180001120
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000abe8
mov edx, 0x37
lea rcx, str.The_10th_Fibonacci_number_is:__d_n
call fcn.180001120
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm8, qword [0x18004d228]
test eax, eax
jns 0x18000ac32
movaps xmm1, xmm8
movaps xmm0, xmm6
call fcn.180023360
mulsd xmm0, qword [0x18004d250]
lea rcx, str.The_volume_of_the_sphere_with_radius__lf_is:__lf_n
movaps xmm1, xmm6
movq rdx, xmm6
movaps xmm2, xmm0
movq r8, xmm0
call fcn.180001120
lea rcx, str.The_volume_of_the_cube_with_side__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ac5f
movaps xmm2, xmm6
lea rcx, str.The_volume_of_the_cube_with_side__lf_is:__lf_n
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
mov ebx, r12d
lea rcx, str._d:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ac84
mov r8d, ebx
lea rcx, str._d:__c_n
mov edx, ebx
call fcn.180001120
inc ebx
cmp ebx, 0x80
jl 0x18000ac62
lea rcx, str.Factorial_of__d:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000acb4
mov edx, 5
lea rcx, str.Factorial_of__d:__d_n
lea r8d, [rdx + 0x73]
call fcn.180001120
lea rcx, str.String:_This_is_a_string_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000acd1
lea rcx, str.String:_This_is_a_string_n
call fcn.180001120
lea rcx, str.Sum:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000acf3
mov edx, 8
lea rcx, str.Sum:__d_n
call fcn.180001120
lea rcx, str.Hello__World__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ad10
lea rcx, str.Hello__World__n
call fcn.180001120
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ad4a
movsd xmm3, qword [0x18004d238]
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
lea rcx, str.Array_length:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ad6c
mov edx, 5
lea rcx, str.Array_length:__d_n
call fcn.180001120
lea rcx, [r14 + 0x14]
mov r8, r15
lea rdx, [rsp + 0x48]
call fcn.18001a740
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.180014bf0
movzx ecx, word [rsp + 0x70]
test ecx, ecx
je 0x18000ae11
sub ecx, 5
je 0x18000adf7
sub ecx, 1
je 0x18000addd
cmp ecx, 3
je 0x18000adc3
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae2e
lea rcx, str.Unknown_n
jmp 0x18000ae29
lea rcx, str.x64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae2e
lea rcx, str.x64_n
jmp 0x18000ae29
lea rcx, str.IA64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae2e
lea rcx, str.IA64_n
jmp 0x18000ae29
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae2e
lea rcx, str.ARM_n
jmp 0x18000ae29
lea rcx, str.x86_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae2e
lea rcx, str.x86_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae4e
mov edx, dword [rbp - 0x70]
lea rcx, str.Number_of_Processors:__d_n
call fcn.180001120
lea rcx, str.Processor_Type:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae6e
mov edx, dword [rbp - 0x6c]
lea rcx, str.Processor_Type:__d_n
call fcn.180001120
lea rcx, str.Processor_Level:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000ae8f
movzx edx, word [rbp - 0x64]
lea rcx, str.Processor_Level:__d_n
call fcn.180001120
lea rcx, str.Processor_Revision:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aeb0
movzx edx, word [rbp - 0x62]
lea rcx, str.Processor_Revision:__d_n
call fcn.180001120
xor edx, edx
mov dword [rsp + 0x58], r12d
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x18000aede
lea rcx, str.Error_opening_service_control_manager
call fcn.18001db60
jmp 0x18000b009
lea rax, [rsp + 0x58]
mov edx, 0x30
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x50]
lea rax, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r8d, [rdx - 0x2d]
mov dword [rsp + 0x20], 0xc000
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x18000af37
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x18000af37
lea rcx, str.Error_enumerating_services
call fcn.18001db60
mov edi, r12d
cmp dword [rsp + 0x40], r12d
jbe 0x18000b000
nop word [rax + rax]
lea rcx, str.Service_Name:__s_n
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000af7b
lea rdx, [rbx + rbx*2]
add rdx, rdx
lea rcx, str.Service_Name:__s_n
mov rdx, qword [rbp + rdx*8 - 0x50]
call fcn.180001120
lea rcx, str.Display_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000afa4
lea rdx, [rbx + rbx*2]
add rdx, rdx
lea rcx, str.Display_Name:__s_n
mov rdx, qword [rbp + rdx*8 - 0x48]
call fcn.180001120
lea rcx, str.Service_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000afcc
lea rax, [rbx + rbx*2]
add rax, rax
lea rcx, str.Service_Type:__lu_n
mov edx, dword [rbp + rax*8 - 0x40]
call fcn.180001120
lea rcx, str.Service_State:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000aff4
lea rax, [rbx + rbx*2]
add rax, rax
lea rcx, str.Service_State:__lu_n
mov edx, dword [rbp + rax*8 - 0x3c]
call fcn.180001120
inc edi
cmp edi, dword [rsp + 0x40]
jb 0x18000af50
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Octal_integer:__o_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b02b
mov edx, 0x53
lea rcx, str.Octal_integer:__o_n
call fcn.180001120
lea rcx, str.Array_max:__d_n
mov dword [r14 + 0x10], 8
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b055
mov edx, 5
lea rcx, str.Array_max:__d_n
call fcn.180001120
lea rcx, str._c_is_a_digit._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b077
mov edx, 0x35
lea rcx, str._c_is_a_digit._n
call fcn.180001120
lea rcx, str.The_value_of_pi_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b0a1
movsd xmm1, qword [0x18004d240]
lea rcx, str.The_value_of_pi_is:__lf_n
movq rdx, xmm1
call fcn.180001120
mov rcx, qword [rsp + 0x68]
lea r9d, [r15 + 0x18]
mov r8, r14
mov edx, 3
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
setne r15b
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b0eb
movaps xmm0, xmm6
call fcn.180039fa0
movaps xmm1, xmm0
lea rcx, str.The_value_of_Eulers_number_e_is:__lf_n
movq rdx, xmm0
call fcn.180001120
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b13d
xorps xmm0, xmm0
ucomisd xmm0, xmm8
ja 0x18000b110
xorps xmm0, xmm0
sqrtsd xmm0, xmm8
jmp 0x18000b119
movaps xmm0, xmm8
call fcn.18003ae3c
mulsd xmm0, qword [0x18004d200]
lea rcx, str.The_height_of_the_equilateral_triangle_with_side__lf_is:__lf_n
movaps xmm1, xmm6
movq rdx, xmm6
movaps xmm2, xmm0
movq r8, xmm0
call fcn.180001120
lea r9, [rsp + 0x68]
xor ecx, ecx
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
movaps xmm8, xmmword [rsp + 0xc0c0]
test eax, eax
je 0x18000b192
lea rcx, str.Disk_Usage:__d_MB_Total___d_MB_Free_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b1af
mov r8, qword [rsp + 0x68]
lea rcx, str.Disk_Usage:__d_MB_Total___d_MB_Free_n
mov rdx, qword [rsp + 0x60]
shr r8, 0x14
shr rdx, 0x14
call fcn.180001120
jmp 0x18000b1af
lea rcx, str.Failed_to_get_disk_usage__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b1af
lea rcx, str.Failed_to_get_disk_usage__n
call fcn.180001120
mov rcx, r14
call fcn.180020c30
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b1f1
movsd xmm3, qword [0x18004d238]
lea rcx, str.The_volume_of_the_cylinder_with_radius__lf_and_height__lf_is:__lf_n
movq r9, xmm3
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180001120
lea rcx, str.Square_root_of__.2f:__.2f_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movaps xmm6, xmmword [rsp + 0xc0d0]
test eax, eax
jns 0x18000b250
movss xmm1, dword [0x18004d288]
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x18000b223
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x18000b22b
movaps xmm0, xmm1
call fcn.18003af10
movsd xmm1, qword [0x18004d280]
lea rcx, str.Square_root_of__.2f:__.2f_n
xorps xmm2, xmm2
movq rdx, xmm1
cvtss2sd xmm2, xmm0
movq r8, xmm2
call fcn.180001120
mov ecx, 0x1c
mov dword [rsp + 0x40], r12d
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x18000b273
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x40]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
jne 0x18000b2c1
mov rcx, rsi
call fcn.180020c30
mov ecx, dword [rsp + 0x40]
call fcn.180020ffc
mov rsi, rax
test rax, rax
jne 0x18000b2c1
lea rcx, str.Error_allocating_memory_needed_to_call_GetExtendedTcpTable
call fcn.18001db60
mov dword [rsp + 0x28], r12d
lea rdx, [rsp + 0x40]
mov r9d, 2
mov dword [rsp + 0x20], 5
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x18000b3d9
cmp dword [rsi], r12d
jbe 0x18000b3ea
nop word [rax + rax]
lea rcx, str.Local_Address:__s:_u_n
mov r14d, r12d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b342
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0xc]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 8]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Local_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.Remote_Address:__s:_u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b381
lea rdi, [r14 + r14*2]
movzx ecx, word [rsi + rdi*8 + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, dword [rsi + rdi*8 + 0x10]
movzx ebx, ax
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8d, ebx
lea rcx, str.Remote_Address:__s:_u_n
mov rdx, rax
call fcn.180001120
lea rcx, str.State:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b3a6
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 4]
lea rcx, str.State:__u_n
call fcn.180001120
lea rcx, str.PID:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000b3cb
lea rax, [r14 + r14*2]
mov edx, dword [rsi + rax*8 + 0x18]
lea rcx, str.PID:__u_n
call fcn.180001120
inc r12d
cmp r12d, dword [rsi]
jb 0x18000b300
jmp 0x18000b3ea
lea rcx, str.GetExtendedTcpTable_failed_with_error
call fcn.18001db60
test rsi, rsi
je 0x18000b3f2
mov rcx, rsi
call fcn.180020c30
movzx eax, r15b
mov rcx, qword [rbp + 0xbfb0]
xor rcx, rsp
call fcn.180018ca0
lea r11, [rsp + 0xc0e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret