Function at 0x4193e0
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, 0xab
mov dword [ebp - 0x184], eax
push ebx
add eax, 0xffffffd8
mov ebx, eax
jmp 0x41946e
push esi
mov esi, dword [ebp - 0x184]
cmp esi, dword [ebp - 0x1d8]
je 0x4194b6
cmp esi, dword [str.b2fJ68KEIvlnFgtLwZR5Wnz6Vp4IkEpuguOGYaw3xSemV]
jne 0x4194b6
xor esi, 0xffffffef
test esi, 0x91
je 0x4194b6
add esi, esi
mov edx, 0x9f
cmp esi, dword [ebp - 0x108]
je 0x4194b6
mov ecx, 0x66
mov dword [ebp - 0x184], edx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x1e0], esi
push edi
xor ecx, esi
mov dword [ebp - 0x184], esi
mov dword [ebp - 0x184], ecx
mov esi, ecx
sub esi, edx
jmp 0x4194e2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsA]
test eax, 0xab
jne 0x4194fb
mov ecx, dword [str.7KEAHT2G0Le19sR6kpPzN3wvM5mLaIFkD9i57qg3WUnbSBvea95z4Iv7szGfZx44IlkAH6zcmFucmpQ864lfBR5TZ3uwbsCxr1ZE1T1R0RRNBGxFHsgEOcNAm0MS68IFpQ6t9m8q470xQkRzTiDXeg75AlduqG8qz322bZ3bIwsXhNDoziX4EU0iNhychae8t4idXTU78by]
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x19c], eax
add ecx, ecx
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x184], eax
cmp eax, 1
jne 0x41951a
mov dword [ebp - 0x184], ecx
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp eax, dword [ebp - 0x1a8]
je 0x419543
mov edi, eax
add edi, edi
test eax, 0xf
je 0x419543
add edi, 0x76
mov dword [ebp - 0x184], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp edi, eax
jne 0x41958d
sub edi, 0x2e
cmp edi, dword [ebp - 0xd4]
je 0x41958d
test edi, 0x9bd004a2
je 0x41958d
cmp edi, 0xfffffffa
je 0x41958d
add edi, edi
jmp 0x41958d
mov dword [ebp - 0x60], eax
add eax, 0x78
jmp 0x4195c5
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
sub eax, edi
mov ecx, 0x5a
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x184], eax
push 0x94
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
add edi, eax
mov edx, eax
mov dword [ebp - 0x184], edx
jmp 0x4195ff
mov dword [ebp - 0x208], eax
mov eax, 0x1a
mov dword [ebp - 0x184], eax
mov edx, 0x3c14484
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x184], edx
xor edx, eax
jmp 0x41962b
mov eax, 0xcf
jmp 0x41963f
mov ebx, dword [ebp - 0x184]
cmp ebx, dword [str.L7guiti1XIjjd3KpqvlrvlkVMCE1s9M8pkatKxGF4HSh09LyXoRvC1qv2rwjEmLYYxNxhaGQsYpbaK3esjBE0VHkulzOfxARTQyJB2T4IZOaMfQAQAFrMxDoytaG5TeQnosUQNqJISKMBV8DRL9yYjX0pnamTkbeZFJ0bEyDa5dO8FR3klRpq0NfJnCCfdUDFbv4IpIckrNapzof5yu2HJeE]
je 0x419664
jmp 0x419664
xor eax, 0x27d19100
mov edi, 0xc2
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x184], eax
mov ecx, 0x72
jmp 0x419684
mov edx, 0x8f
xor edx, 0xffffffc9
jmp 0x419698
mov dword [ebp - 0x184], esi
test esi, 0xbec8084
jne 0x4196b4
mov ebx, dword [ebp - 0x184]
add ebx, esi
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x1b0], esi
and ebx, 0x72
jmp 0x419726
sub eax, edx
mov edi, dword [str.2deKz46xJVHMn4KjzLWBWY]
jmp 0x41974d
add ebx, 0xffffff8d
jmp 0x419792
sub ecx, eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x18]
je 0x4197b3
sub eax, ebx
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x1c4], eax
mov edx, 0x66
xor edx, ebx
cmp edx, dword [ebp - 0x48]
jne 0x4197c5
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x18c], ebx
mov edi, dword [ebp - 0x1b0]
sub edi, ebx
mov dword [ebp - 0x194], edi
mov dword [ebp - 0x18c], edi
sub ebx, edi
mov edx, 0x8d
jmp 0x4197eb
mov eax, dword [ebp - 0x194]
cmp eax, 0xffffffa1
jne 0x4197ff
or eax, 0xffffff8d
mov dword [ebp - 0x1b0], eax
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x184], eax
mov esi, dword [str.9swkQShcu3iR7aLtl8hMOMQt5d4sbjOVnZYyYsqDyiU8vrQN9HkL7I0cna8g80RH3P92cKGwT3OO30rdNln9O08D2Il1arptW3HFFX8YN3wYkRanRoXP3SC2vqN7nQF8DvB3dAvolkGX5ILQ2KmNLz46rXIfod0Xz06OdoMi2J]
add esi, 0x53
mov dword [ebp - 0x194], esi
push eax
xor esi, eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x184], eax
jmp 0x419845
push 0x8fde2e00
mov ebx, dword [ebp - 0x18c]
cmp ebx, dword [str.kjYp]
jne 0x419872
add ebx, 0x14
mov esi, dword [ebp - 0x194]
mov dword [ebp - 0x13c], ebx
jmp 0x419872
mov ecx, 0x80
xor ecx, 0xffffffa1
mov dword [ebp - 0x18c], ecx
call fcn.0041a142
xor eax, 0x30b0100
mov ebx, dword [0x41fbb0]
test eax, 0x2a
je 0x4198bd
cmp eax, ebx
je 0x4198bd
xor eax, esi
mov ecx, dword [ebp - 0x18c]
cmp ecx, 0xfffffff9
je 0x4198bd
xor ebx, 0
mov edi, dword [ebp - 0x18c]
cmp esi, 0x75
je 0x4198bd
jmp 0x4198bd
mov edi, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x184]
jmp 0x4198ce
shr edi, 0x10
mov dword [ebp - 0x18c], edi
cmp edi, 0x9bd3
jne 0x419c44
cmp edi, dword [str.IyPlW82Z3kDCQt4jq64u1uOjca73RbMB]
je 0x4198f1
mov dword [ebp - 0x1d0], edi
push 0x41f2d4
mov esi, edi
test esi, 0xca
je 0x419954
sub esi, 0x66
mov ebx, dword [ebp - 0x184]
mov dword [ebp - 0x198], esi
cmp ebx, dword [0x41f1dc]
je 0x419954
add ebx, 0x72
mov edi, dword [ebp - 0x18c]
cmp edi, dword [str.TGlewAki2IKBwrfABLdPQXAz39r3v9T0XecEU8mbjqcUTIWhl8xnA35YoQaoD62KTdWaJNkcub7ACo7CMK77GxuQwBf94T4bKzaFcnyxfdt4KSJahcTwPBzuQPeXSQ7sdUwgY2jLVaPXzLCt46K3pQlK9PcYrR3iuhZYXizalmTLA7PMA2HkCPkKyIRgl9YGaSGViaX]
jne 0x419954
xor edi, 0x25b41000
mov ecx, dword [ebp - 0x1b0]
cmp edi, ecx
jne 0x419954
add ecx, 0xffffffc4
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x198], edi
jmp 0x419954
push 0x41fbdc
mov eax, dword [ebp - 0x184]
cmp eax, dword [str.aLV3Yonn8S8HL3BvXp1fK]
je 0x41997e
cmp eax, dword [0x41f22c]
jne 0x41997e
add eax, eax
test eax, 0x8d1c
jne 0x41997e
mov dword [ebp - 0x1b0], eax
push 0x426978
test eax, 0x43300020
je 0x4199cf
sub eax, 0x56
mov edi, dword [ebp - 0x184]
mov dword [ebp - 0x168], edi
jmp 0x4199cf
push str.q_4_
mov ebx, dword [0x420048]
xor ebx, 0xffffffe4
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x1f4], ebx
dec edx
sub eax, 0x3c
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp - 0x184], edx
cmp ecx, dword [str.axqpwkjViY0lvQdYq6rTW0t91Ksp81i5zPgBrnqCGqsO68prrcDzlw4x6anDgrJnZB33dsBMYsjnRwrGrA6CX00gBHSxN5qERJxB2dI93sn7G6j5FcxwTRNyqZvterhBMr2epoFUB4GcUhYDGTXYTyVr28YD5YKThVyZbYdD5XzFBQfm4Uajmx3UrrovZXuph]
jne 0x419a0a
sub ecx, 0xb
mov dword [ebp - 0x184], ecx
cmp esi, eax
je 0x419a2f
mov esi, dword [ebp - 0x194]
jmp 0x419a2f
dec edx
add edx, 0x4c
mov ebx, edx
cmp ebx, 0xe598002b
jne 0x419a4f
test ecx, 0xbf
jne 0x419a4f
xor ebx, ecx
jmp 0x419a4f
call fcn.0041abe3
jmp 0x419a63
mov dword [ebp - 8], eax
sub edi, 0xffffffa8
mov esi, dword [ebp - 0x1b0]
cmp edi, 0xec0d
jne 0x419a90
mov dword [ebp - 0x194], edi
add esi, edi
mov eax, 0xff
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x18c], eax
mov esi, 0x63e149c7
mov dword [ebp - 0x1b0], esi
sub esi, 0x639fa010
jmp 0x419b6f
push dword [ebp - 0x1c0]
push 0x9bd4c4a8
push dword [ebp - 8]
call fcn.0041a9b7
add eax, eax
mov dword [ebp - 0x184], eax
add dword [ebp - 8], 0x29
xor eax, 0x13460900
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 8]
sub eax, ecx
mov esi, 0x2a
jmp 0x419bd6
call ecx
mov ecx, eax
mov dword [ebp - 0x194], eax
sub ecx, eax
cmp eax, dword [str.26xtT1j5Q1qrlpAbGNsmcw16q]
jne 0x419c14
mov esi, 0x7d
sub ecx, 0x7e
mov dword [ebp - 0xd0], esi
cmp ecx, 0xbd7
jne 0x419c14
mov dword [ebp - 0x1f4], edi
mov ebx, eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0x18c], ebx
cmp eax, dword [ebp - 0x5c]
je 0x419c3e
add edi, ecx
jmp 0x419c3e
mov dword [ebp - 0xd0], eax
and edi, eax
mov esi, 0x3f
jmp 0x419c58
jmp 0x419c67
mov edx, 0xee
mov dword [ebp - 0xd0], edx
pop edi
mov eax, 0xdd
sub eax, edx
cmp edi, 0xa4bc
je 0x419cd8
jmp 0x419cd8
pop esi
test esi, 0x263f
je 0x419d41
sub ecx, esi
test ecx, 0xf5
je 0x419d41
mov edx, dword [ebp - 0x18c]
and edx, 0xffffffea
cmp edx, 7
jne 0x419d41
mov eax, dword [ebp - 0x1f4]
add edx, 0x5a
test eax, 0x6c
je 0x419d41
mov ebx, 0x25
cmp ecx, 0x4ca5
jne 0x419d41
sub ebx, ecx
jmp 0x419d41
pop ebx
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x18c], esi
jmp 0x419de2
leave
ret