Function at 0x432fd0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
test rcx, rcx
je 0x4337da
lea rsi, [rcx - 0x10]
mov rdx, qword [0x0045f948]
cmp rsi, rdx
jb 0x433802
mov rcx, qword [rcx - 8]
mov eax, ecx
and eax, 3
cmp rax, 1
je 0x433802
mov r14, rcx
and r14, 0xfffffffffffffff8
lea r9, [rsi + r14]
test cl, 1
jne 0x4332db
mov rcx, qword [rsi]
test rax, rax
je 0x4330c8
sub rsi, rcx
cmp rsi, rdx
jb 0x433802
add r14, rcx
cmp qword [0x0045f950], rsi
je 0x433155
cmp rcx, 0xff
ja 0x43317c
mov rbx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
movabs rax, 0x3fffffff8
and rax, rcx
lea rdi, [0x0045f930]
lea rax, [rdi + rax*2 + 0x48]
cmp rbx, rax
je 0x433091
cmp rdx, rbx
ja 0x433802
cmp qword [rbx + 0x18], rsi
jne 0x433802
cmp r8, rbx
je 0x4331c0
cmp r8, rax
je 0x4330b2
cmp rdx, r8
ja 0x433802
cmp qword [r8 + 0x10], rsi
jne 0x433802
mov qword [rbx + 0x18], r8
mov qword [r8 + 0x10], rbx
cmp rsi, r9
jb 0x4332e4
jmp 0x433802
add r14, rcx
add r14, 0x20
je 0x433149
sub rsi, rcx
lea rdi, [rbp - 0x30]
mov rbx, r14
nop dword [rax + rax]
mov r8d, 0x30
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32_VirtualQuery
cmp qword [rbp - 0x18], rbx
ja 0x4337da
test rax, rax
je 0x4337da
cmp qword [rbp - 0x30], rsi
jne 0x4337da
cmp qword [rbp - 0x28], rsi
jne 0x4337da
cmp dword [rbp - 0x10], 0x1000
jne 0x4337da
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call sub.KERNEL32_VirtualFree
test eax, eax
je 0x4337da
mov rax, qword [rbp - 0x18]
add rsi, rax
sub rbx, rax
jne 0x4330e0
sub qword [0x0045fc88], r14
jmp 0x4337da
mov rax, qword [r9 + 8]
mov ecx, eax
and ecx, 3
cmp rcx, 3
jne 0x4332db
mov qword [0x0045f938], r14
and rax, 0xfffffffffffffffe
mov qword [r9 + 8], rax
jmp 0x4334c1
mov rbx, qword [rsi + 0x18]
mov r8, qword [rsi + 0x30]
cmp rbx, rsi
je 0x4331df
mov rax, qword [rsi + 0x10]
cmp rdx, rax
ja 0x433802
cmp qword [rax + 0x18], rsi
jne 0x433802
cmp qword [rbx + 0x10], rsi
jne 0x433802
mov qword [rax + 0x18], rbx
mov qword [rbx + 0x10], rax
test r8, r8
jne 0x433239
jmp 0x4332db
shr rcx, 3
mov eax, 0xfffffffe
rol eax, cl
and dword [0x0045f930], eax
cmp rsi, r9
jb 0x4332e4
jmp 0x433802
mov rdi, qword [rsi + 0x28]
test rdi, rdi
je 0x4331ee
lea rcx, [rsi + 0x28]
jmp 0x433200
lea rcx, [rsi + 0x20]
mov rdi, qword [rcx]
test rdi, rdi
je 0x4337e5
nop
mov rbx, rdi
mov rax, rcx
lea rcx, [rbx + 0x28]
mov rdi, qword [rbx + 0x28]
test rdi, rdi
jne 0x433200
lea rcx, [rbx + 0x20]
mov rdi, qword [rbx + 0x20]
test rdi, rdi
jne 0x433200
cmp rdx, rax
ja 0x433802
mov qword [rax], 0
test r8, r8
je 0x4332db
mov ecx, dword [rsi + 0x38]
lea rax, [0x0045f930]
cmp qword [rax + rcx*8 + 0x258], rsi
je 0x43326f
cmp qword [0x0045f948], r8
ja 0x433802
xor eax, eax
cmp qword [r8 + 0x20], rsi
setne al
mov qword [r8 + rax*8 + 0x20], rbx
test rbx, rbx
jne 0x43327c
jmp 0x4332db
mov qword [rax + rcx*8 + 0x258], rbx
test rbx, rbx
je 0x4332ce
mov rcx, qword [0x0045f948]
cmp rcx, rbx
ja 0x433802
mov qword [rbx + 0x30], r8
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x4332aa
cmp rcx, rax
ja 0x433802
mov qword [rbx + 0x20], rax
mov qword [rax + 0x30], rbx
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x4332db
cmp rcx, rax
ja 0x433802
mov qword [rbx + 0x28], rax
mov qword [rax + 0x30], rbx
cmp rsi, r9
jb 0x4332e4
jmp 0x433802
mov eax, 0xfffffffe
rol eax, cl
and dword [0x0045f934], eax
cmp rsi, r9
jae 0x433802
mov rdx, qword [r9 + 8]
test dl, 1
je 0x433802
test dl, 2
jne 0x433390
cmp qword [0x0045f958], r9
je 0x43346d
cmp qword [0x0045f950], r9
je 0x4334ac
cmp rdx, 0xff
ja 0x433544
mov rcx, qword [r9 + 0x10]
mov rbx, qword [r9 + 0x18]
movabs rax, 0x3fffffff8
and rax, rdx
lea rdi, [0x0045f930]
lea rax, [rdi + rax*2 + 0x48]
cmp rcx, rax
je 0x43335e
cmp qword [0x0045f948], rcx
ja 0x433802
cmp qword [rcx + 0x18], r9
jne 0x433802
cmp rbx, rcx
je 0x43369d
cmp rbx, rax
je 0x433383
cmp qword [0x0045f948], rbx
ja 0x433802
cmp qword [rbx + 0x10], r9
jne 0x433802
mov qword [rcx + 0x18], rbx
mov qword [rbx + 0x10], rcx
jmp 0x4337b0
and rdx, 0xfffffffffffffffe
mov qword [r9 + 8], rdx
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
cmp r14, 0xff
ja 0x4333fc
mov rcx, r14
shr rcx, 3
movabs rax, 0x3fffffff8
and rax, r14
lea rdx, [0x0045f930]
lea rax, [rdx + rax*2 + 0x48]
mov edx, dword [0x0045f930]
mov ebx, 1
shl ebx, cl
bt edx, ecx
jae 0x4334d5
mov rcx, qword [rax + 0x10]
cmp qword [0x0045f948], rcx
jbe 0x4334e0
jmp 0x433802
mov rdx, r14
shr rdx, 8
je 0x4334f5
mov ecx, 0x1f
cmp r14, 0xffffff
ja 0x4334f7
lea eax, [rdx + 0xfff00]
shr eax, 0x10
and eax, 8
mov ecx, eax
shl edx, cl
lea ecx, [rdx + 0x7f000]
shr ecx, 0x10
and ecx, 4
or eax, ecx
shl edx, cl
lea ecx, [rdx + 0x3c000]
shr ecx, 0x10
and ecx, 2
or eax, ecx
mov ebx, 0xe
sub ebx, eax
shl edx, cl
shr edx, 0xf
lea eax, [rbx + rdx]
lea ecx, [rbx + rdx + 7]
mov rdx, r14
shr rdx, cl
and edx, 1
lea ecx, [rdx + rax*2]
jmp 0x4334f7
add r14, qword [0x0045f940]
mov qword [0x0045f940], r14
mov qword [0x0045f958], rsi
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
cmp rsi, qword [0x0045f950]
je 0x43362c
cmp r14, qword [0x0045f960]
ja 0x43364f
jmp 0x4337da
add r14, qword [0x0045f938]
mov qword [0x0045f938], r14
mov qword [0x0045f950], rsi
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
jmp 0x4337da
or edx, ebx
mov dword [0x0045f930], edx
mov rcx, rax
mov qword [rax + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
jmp 0x4337da
xor ecx, ecx
mov eax, ecx
lea rdx, [0x0045f930]
lea rax, [rdx + rax*8 + 0x258]
mov dword [rsi + 0x38], ecx
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
mov edx, dword [0x0045f934]
mov ebx, 1
shl ebx, cl
bt edx, ecx
jae 0x433530
mov rdx, qword [rax]
cmp ecx, 0x1f
jne 0x433590
xor eax, eax
jmp 0x43359d
or edx, ebx
mov dword [0x0045f934], edx
mov qword [rax], rsi
mov qword [rsi + 0x30], rax
jmp 0x433679
mov rbx, qword [r9 + 0x18]
mov r8, qword [r9 + 0x30]
cmp rbx, r9
je 0x4336b6
mov rax, qword [r9 + 0x10]
cmp qword [0x0045f948], rax
ja 0x433802
cmp qword [rax + 0x18], r9
jne 0x433802
cmp qword [rbx + 0x10], r9
jne 0x433802
mov qword [rax + 0x18], rbx
mov qword [rbx + 0x10], rax
test r8, r8
jne 0x43371d
jmp 0x4337b0
shr ecx, 1
add ecx, 6
mov eax, 0x3f
sub rax, rcx
mov rcx, qword [rdx + 8]
and rcx, 0xfffffffffffffff8
cmp rcx, r14
jne 0x4335af
mov rax, rdx
jmp 0x4335e8
mov rbx, r14
mov ecx, eax
shl rbx, cl
nop word [rax + rax]
mov rcx, rbx
shr rcx, 0x3f
mov rax, qword [rdx + rcx*8 + 0x20]
test rax, rax
je 0x433660
add rbx, rbx
mov rcx, qword [rax + 8]
and rcx, 0xfffffffffffffff8
cmp rcx, r14
mov rdx, rax
jne 0x4335c0
mov rdx, qword [0x0045f948]
cmp rdx, rax
ja 0x433802
mov rcx, qword [rax + 0x10]
cmp rdx, rcx
ja 0x433802
mov qword [rcx + 0x18], rsi
mov qword [rax + 0x10], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x30], 0
dec qword [0x0045f968]
jne 0x4337da
jmp 0x43368e
mov qword [0x0045f950], 0
mov qword [0x0045f938], 0
cmp r14, qword [0x0045f960]
jbe 0x4337da
xor ecx, ecx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.00433810
lea rax, [rdx + rcx*8 + 0x20]
cmp qword [0x0045f948], rax
ja 0x433802
mov qword [rax], rsi
mov qword [rsi + 0x30], rdx
mov qword [rsi + 0x18], rsi
mov qword [rsi + 0x10], rsi
dec qword [0x0045f968]
jne 0x4337da
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.00433ab0
mov rcx, rdx
shr rcx, 3
mov eax, 0xfffffffe
rol eax, cl
and dword [0x0045f930], eax
jmp 0x4337b0
mov rdi, qword [r9 + 0x28]
test rdi, rdi
je 0x4336c5
lea rcx, [r9 + 0x28]
jmp 0x4336e0
lea rcx, [r9 + 0x20]
mov rdi, qword [rcx]
test rdi, rdi
je 0x4337f5
nop word cs:[rax + rax]
mov rbx, rdi
mov rax, rcx
lea rcx, [rbx + 0x28]
mov rdi, qword [rbx + 0x28]
test rdi, rdi
jne 0x4336e0
lea rcx, [rbx + 0x20]
mov rdi, qword [rbx + 0x20]
test rdi, rdi
jne 0x4336e0
cmp qword [0x0045f948], rax
ja 0x433802
mov qword [rax], 0
test r8, r8
je 0x4337b0
mov ecx, dword [r9 + 0x38]
lea rax, [0x0045f930]
cmp qword [rax + rcx*8 + 0x258], r9
je 0x433754
cmp qword [0x0045f948], r8
ja 0x433802
xor eax, eax
cmp qword [r8 + 0x20], r9
setne al
mov qword [r8 + rax*8 + 0x20], rbx
test rbx, rbx
jne 0x433761
jmp 0x4337b0
mov qword [rax + rcx*8 + 0x258], rbx
test rbx, rbx
je 0x4337a3
mov rcx, qword [0x0045f948]
cmp rcx, rbx
ja 0x433802
mov qword [rbx + 0x30], r8
mov rax, qword [r9 + 0x20]
test rax, rax
je 0x43378b
cmp rcx, rax
ja 0x433802
mov qword [rbx + 0x20], rax
mov qword [rax + 0x30], rbx
mov rax, qword [r9 + 0x28]
test rax, rax
je 0x4337b0
cmp rcx, rax
ja 0x433802
mov qword [rbx + 0x28], rax
mov qword [rax + 0x30], rbx
jmp 0x4337b0
mov eax, 0xfffffffe
rol eax, cl
and dword [0x0045f934], eax
and rdx, 0xfffffffffffffff8
add r14, rdx
mov rax, r14
or rax, 1
mov qword [rsi + 8], rax
mov qword [rsi + r14], r14
cmp rsi, qword [0x0045f950]
jne 0x4333a7
mov qword [0x0045f938], r14
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
xor ebx, ebx
test r8, r8
jne 0x433239
jmp 0x4332db
xor ebx, ebx
test r8, r8
jne 0x43371d
jmp 0x4337b0
call fcn.004456d0
ud2