Function at 0x491b30
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d75ec
mov eax, dword fs:[0]
push eax
mov eax, 0x2007c
call fcn.004a4d60
mov eax, dword [0x517ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x51cfd8], 0
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x20054], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20068], eax
jne 0x491c1b
push 0x51cfd4
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x4eb4bc
call edi
push 0x4e287c
mov esi, eax
call edi
push dword [ebp - 0x20054]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x4f4284
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f4294
push esi
mov dword [0x51cfbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f42a4
push esi
mov dword [0x51cfc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4f42b4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51cfc4], eax
call esi
push 0x4f42c4
push edi
mov dword [0x51cfc8], eax
call esi
push 0x4f42d4
push edi
mov dword [0x51cfcc], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x51cfd0], eax
cmp dword [0x51d518], 0
jne 0x491c38
push 0x4f430c
push 0x4e287c
call edi
push eax
call esi
mov dword [0x51d518], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x51d5f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x51d004]
cmp eax, dword [ecx + 0xc]
jg 0x4920d9
mov esi, 0xfa00
push esi
call fcn.004b1722
mov ecx, dword [0x51d518]
add esp, 4
mov edi, eax
mov dword [ebp - 0x20054], eax
lea eax, [ebp - 0x20064]
push eax
push esi
push edi
push 5
call ecx
test eax, eax
je 0x491cb5
push edi
call fcn.004b1707
shl esi, 2
push esi
call fcn.004b1722
add esp, 8
lea ecx, [ebp - 0x20064]
mov edi, eax
mov eax, dword [0x51d518]
push ecx
push esi
push edi
push 5
call eax
test eax, eax
jne 0x491c85
mov dword [ebp - 0x20054], edi
cmp dword [edi + 0x44], 4
mov dword [ebp - 0x20048], edi
jbe 0x49209e
mov esi, dword [edi + 0x44]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
je 0x49209e
push esi
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x20060], eax
test eax, eax
je 0x49209e
mov eax, dword [ebp - 0x20048]
add edi, 0xb8
mov dword [ebp - 0x20038], edi
mov dword [ebp - 0x2005c], 0
cmp dword [eax + 4], 0
jbe 0x49208c
nop dword [eax + eax]
push 0
push dword [0x51c748]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x49208c
mov edx, dword [edi + 0x30]
mov esi, dword [edi]
mov eax, dword [edi + 0x20]
mov edi, dword [edi + 4]
mov dword [ebp - 0x20034], edx
mov dword [ebp - 0x20084], edx
mov edx, dword [ebp - 0x20038]
mov dword [ebp - 0x20044], esi
mov dword [ebp - 0x20080], esi
mov esi, dword [ebp - 0x20038]
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x20074], ecx
mov dword [ebp - 0x20014], ecx
mov ecx, dword [0x51cffc]
mov dword [ebp - 0x20088], eax
mov eax, dword [edx + 8]
mov edx, dword [edx + 0x24]
mov dword [ebp - 0x20040], edx
mov dword [ebp - 0x20030], edx
mov edx, dword [esi + 0x20]
mov esi, dword [ebp - 0x20044]
mov dword [ebp - 0x20078], eax
mov dword [ebp - 0x20018], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x20028], edx
mov edx, dword [ebp - 0x20034]
mov dword [ebp - 0x2007c], edi
mov dword [ebp - 0x20020], esi
xor esi, esi
cmp byte [eax + 0xd], 0
mov dword [ebp - 0x2001c], edi
mov edi, ecx
mov dword [ebp - 0x20024], edx
mov edx, dword [ebp - 0x20040]
mov dword [ebp - 0x20044], ecx
mov dword [ebp - 0x20034], eax
mov dword [ebp - 0x2003c], edi
jne 0x491e13
mov dword [ebp - 0x20034], eax
cmp dword [eax + 0x10], edx
jae 0x491e00
mov eax, dword [eax + 8]
jmp 0x491e04
mov edi, eax
mov eax, dword [eax]
sbb esi, esi
inc esi
cmp byte [eax + 0xd], 0
je 0x491df0
mov dword [ebp - 0x2003c], edi
cmp byte [edi + 0xd], 0
jne 0x491fc5
cmp edx, dword [edi + 0x10]
jb 0x491fc5
mov eax, dword [edi + 0x18]
lea edx, [edi + 0x18]
mov edi, dword [ebp - 0x20038]
mov ecx, edx
cmp eax, dword [edi + 0x20]
jne 0x492050
mov esi, dword [edi + 0xc]
mov eax, dword [edi + 8]
mov dword [ebp - 0x20040], eax
mov dword [ebp - 0x20058], esi
cmp dword [edx + 0x14], esi
jg 0x492050
jl 0x491e63
cmp dword [edx + 0x10], eax
ja 0x492050
mov esi, dword [edi + 4]
mov ecx, edx
mov eax, dword [edi]
mov dword [ebp - 0x20034], eax
mov dword [ebp - 0x2004c], esi
cmp dword [edx + 0xc], esi
jg 0x492050
jl 0x491e8a
cmp dword [edx + 8], eax
ja 0x492050
mov esi, dword [edi + 0x30]
mov ecx, edx
cmp dword [edx + 4], esi
ja 0x492050
mov eax, dword [ebp - 0x2003c]
mov ecx, dword [ebp - 0x20040]
mov edi, dword [ebp - 0x20058]
sub ecx, dword [eax + 0x28]
mov dword [ebp - 0x20040], ecx
sbb edi, dword [eax + 0x2c]
mov dword [ebp - 0x20044], ecx
mov dword [ebp - 0x20058], edi
mov edi, dword [ebp - 0x20034]
mov ecx, edi
sub ecx, dword [eax + 0x20]
mov dword [ebp - 0x2003c], ecx
mov ecx, dword [ebp - 0x2004c]
sbb ecx, dword [eax + 0x24]
sub esi, dword [eax + 0x1c]
mov eax, dword [ebp - 0x2004c]
mov dword [edx + 8], edi
mov edi, dword [ebp - 0x20038]
mov dword [edx + 0xc], eax
mov dword [ebp - 0x20034], ecx
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0xc]
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], ecx
mov eax, dword [edi + 0x30]
mov dword [edx + 4], eax
jne 0x491f65
mov edx, dword [ebp - 0x20058]
mov edi, dword [ebp - 0x20034]
mov eax, dword [ebp - 0x20044]
mov ecx, dword [ebp - 0x2003c]
mov dword [ebp - 0x2004c], edx
mov dword [ebp - 0x2004c], edi
mov edi, eax
or edi, edx
mov dword [ebp - 0x2003c], ecx
mov edi, dword [ebp - 0x20038]
jne 0x491f6b
mov edi, dword [ebp - 0x20034]
mov dword [ebp - 0x2004c], edx
mov edx, ecx
mov dword [ebp - 0x2004c], edi
or ecx, edi
mov edi, dword [ebp - 0x20038]
je 0x492067
jmp 0x491f71
mov eax, dword [ebp - 0x20040]
mov edx, dword [ebp - 0x2003c]
push dword [ebp - 0x20068]
lea ecx, [ebp - 0x20010]
push ecx
push esi
push edx
push eax
push dword [ebp - 0x20060]
push dword [edi + 0x24]
push dword [edi + 0x20]
call fcn.00491690
add esp, 0x20
test al, al
je 0x492067
movzx ecx, word [ebp - 0x1ffe8]
lea eax, [ebp - 0x20010]
push eax
mov eax, dword [ebp - 0x1ffe4]
lea eax, [eax + ecx*4]
add eax, 0x34
push eax
call fcn.0046ad20
add esp, 8
jmp 0x492067
cmp dword [0x51d000], 0x5555555
je 0x492137
mov dword [ebp - 0x20070], 0x51cffc
push 0x30
mov dword [ebp - 4], 1
mov dword [ebp - 0x2006c], 0
call fcn.004a4441
movups xmm0, xmmword [ebp - 0x20030]
mov ecx, dword [ebp - 0x20044]
add esp, 4
mov dword [ebp - 4], 0xffffffff
movups xmmword [eax + 0x10], xmm0
mov dword [ebp - 0x2006c], 0
movups xmm0, xmmword [ebp - 0x20020]
push eax
push esi
push dword [ebp - 0x20034]
movups xmmword [eax + 0x20], xmm0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, 0x51cffc
mov word [eax + 0xc], 0
call fcn.004200b0
mov edi, dword [ebp - 0x20038]
lea ecx, [eax + 0x18]
movups xmm0, xmmword [ebp - 0x20088]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0x20078]
movq qword [ecx + 0x10], xmm0
mov esi, dword [ebp - 0x2005c]
add edi, 0x40
mov eax, dword [ebp - 0x20048]
inc esi
mov dword [ebp - 0x2005c], esi
mov dword [ebp - 0x20038], edi
cmp esi, dword [eax + 4]
jb 0x491d20
push dword [ebp - 0x20060]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x20048]
mov eax, dword [edi]
test eax, eax
je 0x4920ab
add edi, eax
jmp 0x491cb5
push dword [ebp - 0x20054]
call fcn.004b1707
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4433
mov esp, ebp
pop ebp
ret
push 0x51d004
call fcn.004a4830
add esp, 4
cmp dword [0x51d004], 0xffffffff
jne 0x491c58
push 0x30
mov dword [ebp - 4], 0
call fcn.004a4441
push 0x4d9a70
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [0x51cffc], eax
call fcn.004a46e8
push 0x51d004
mov dword [ebp - 4], 0xffffffff
call fcn.004a47e6
add esp, 0xc
jmp 0x491c58
call fcn.004202a0
int3