Function at 0x40247c
Capabilities:
Get system information on windows
Write file on windows

Disassembly:
push rbp
mov eax, 0x10f0
call fcn.00405160
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1080], ecx
mov qword [rbp + 0x1088], rdx
mov qword [rbp + 0x1090], r8
mov dword [rbp + 0x1098], r9d
lea rax, [rbp + 0x1020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov rax, qword [rbp + 0x1088]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1060], rax
cmp qword [rbp + 0x1060], 0
jne 0x402524
mov rax, qword [rbp + 0x1088]
mov rdx, rax
lea rcx, str.____Error_opening_dump_filepath:__S_n
call fcn.0040156c
mov ecx, dword [rbp + 0x1080]
call fcn.00401671
mov qword [rbp + 0x1058], rax
mov rax, qword [rbp + 0x1028]
mov qword [rbp + 0x1068], rax
jmp 0x40272c
lea rcx, [rbp + 0xff0]
mov rdx, qword [rbp + 0x1068]
mov rax, qword [rbp + 0x1058]
mov r9d, 0x30
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
call rax
test rax, rax
jne 0x402588
add qword [rbp + 0x1068], 0x1000
jmp 0x40272c
mov eax, dword [rbp + 0x1010]
and eax, 0x1000
test eax, eax
je 0x4025b5
mov eax, dword [rbp + 0x1014]
and eax, 0x100
test eax, eax
jne 0x4025b5
mov eax, dword [rbp + 0x1018]
and eax, 0x1060000
test eax, eax
jne 0x4025c8
mov rax, qword [rbp + 0x1008]
add qword [rbp + 0x1068], rax
jmp 0x40272c
mov rax, qword [rbp + 0x1068]
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x1008]
mov dword [rbp - 0x38], eax
mov eax, dword [rbp + 0x1010]
mov dword [rbp - 0x34], eax
mov eax, dword [rbp + 0x1018]
mov dword [rbp - 0x30], eax
mov eax, dword [rbp + 0x1014]
mov dword [rbp - 0x2c], eax
cmp qword [rbp + 0x1090], 0
je 0x402641
cmp dword [rbp + 0x1098], 0
je 0x402641
mov rax, qword [rbp - 0x40]
cmp rax, qword [rbp + 0x1090]
jb 0x402631
mov rax, qword [rbp - 0x40]
mov ecx, dword [rbp + 0x1098]
mov rdx, qword [rbp + 0x1090]
add rdx, rcx
cmp rax, rdx
jbe 0x402641
add qword [rbp + 0x1068], 0x1000
jmp 0x40272c
lea rcx, [rbp + 0xfec]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x1060]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x18
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
mov rdx, qword [rbp + 0x1008]
mov rax, qword [rbp + 0x1068]
add rax, rdx
mov qword [rbp + 0x1050], rax
jmp 0x402718
lea r8, [rbp - 0x20]
mov rdx, qword [rbp + 0x1068]
mov rax, qword [rbp + 0x1058]
lea rcx, [rbp + 0xfe0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call rax
test eax, eax
je 0x4026d1
mov rax, qword [rbp + 0xfe0]
cmp rax, 0x1000
je 0x4026dd
lea rcx, str.____Unable_to_read_a_full_page__
call fcn.0040156c
lea rcx, [rbp + 0xfec]
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x1060]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov r8d, 0x1000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
add qword [rbp + 0x1068], 0x1000
mov rax, qword [rbp + 0x1068]
cmp rax, qword [rbp + 0x1050]
jb 0x40268e
mov rax, qword [rbp + 0x1030]
cmp rax, qword [rbp + 0x1068]
ja 0x402549
mov rax, qword [rbp + 0x1058]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1060]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x10f0
pop rbp
ret