Function at 0x416db0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
add ecx, 0x348
je 0x416dd9
mov edx, ecx
mov eax, ecx
and edx, 0xf
je 0x416dd9
sub eax, edx
add eax, 0x10
cmp dword [0x43c300], 2
lea ebx, [eax + 0x10]
mov dword [esp + 0x14], 0xffffffff
jne 0x416fc2
mov esi, dword [0x43d048]
cmp esi, 1
jne 0x416e28
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
movdqu xmmword [esp + 0x24], xmm0
movdqu xmmword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x20]
mov dword [0x43d048], esi
test esi, esi
je 0x416fc2
mov eax, ebx
xor edx, edx
div esi
push 1
push 0x1000
lea ebx, [eax + 1]
imul ebx, esi
lea eax, [ebx + esi*2]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x10], eax
test eax, eax
je 0x416eb7
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 4
push ebx
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x416e85
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 2
mov dword [edi + 4], eax
jmp 0x416ed3
cmp byte [0x43ed17], 0
jne 0x416e9a
mov byte [0x43ed17], 1
call fcn.004162d0
push 0x8000
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
jne 0x416ecc
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x416ecc
cmp byte [0x43ed17], 0
jne 0x416ecc
mov byte [0x43ed17], 1
call fcn.004162d0
mov dword [edi + 4], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x416fcd
sub esi, dword [ebp + 8]
lea edx, [esi - 0x180]
add edx, ebx
add edx, eax
mov ecx, edx
and ecx, 0xf
je 0x416ef4
sub edx, ecx
lea esi, [edx - 0x1c8]
mov dword [edi + 4], esi
cmp esi, eax
jb 0x416fbc
mov byte [esi], 0xaa
add ecx, 0x180
mov eax, dword [edi + 4]
mov ebx, dword [ebp + 8]
mov dword [eax + 0x44], 0x180
mov eax, dword [edi + 4]
mov dword [eax + 0x3c], ecx
mov eax, dword [edi + 4]
mov ecx, dword [0x43e5c8]
inc ecx
mov dword [0x43e5c8], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [edi + 4]
mov dword [eax + 0xc], ecx
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x14]
mov dword [eax + 0x10], ebx
mov eax, dword [edi + 4]
mov byte [eax + 0x28], 0
mov eax, dword [edi + 4]
mov byte [eax + 0x38], 0
mov eax, dword [edi + 4]
mov byte [eax + 0x39], 0
mov eax, dword [edi + 4]
mov dword [eax + 0x34], ecx
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x10]
mov byte [eax + 0x38], 0
mov eax, dword [edi + 4]
mov byte [eax + 0x39], 0
mov eax, dword [edi + 4]
mov dword [eax + 0x30], ecx
lea ecx, [edx + ebx]
mov eax, dword [edi + 4]
mov dword [eax + 0x40], ecx
mov eax, dword [edi + 4]
push dword [eax + 0x3c]
push 0xd0
push dword [eax + 0x40]
call fcn.0041a7b0
mov eax, dword [edi + 4]
add esp, 0xc
push dword [eax + 0x44]
add eax, 0x48
push 0xd0
push eax
call fcn.0041a7b0
mov eax, dword [edi + 4]
add esp, 0xc
mov eax, dword [eax + 0x2c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.004166b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8