Function at 0x100b67a
Capabilities:
Get system information on windows

Disassembly:
push 8
mov eax, 0x1013a89
call fcn.01012132
mov edi, dword [ebp + 8]
and dword [ebp - 0x10], 0
mov ecx, edi
call fcn.0100d4a5
lea ecx, [edi + 0x60]
call fcn.0100d46f
mov ebx, 0x4000
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.msvcrt.dll_malloc]
jmp 0x100b6d8
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push esi
push 0x33
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x100b6e4
push esi
call dword [sym.imp.msvcrt.dll_free]
add dword [ebp + 8], ebx
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov esi, eax
pop ecx
test esi, esi
jne 0x100b6ad
mov eax, 0xc000009a
test eax, eax
jge 0x100b6f9
push eax
push 0x9e
call fcn.0100aec8
pop ecx
jmp 0x100b8ae
cmp dword [ebp - 0x10], 0
jne 0x100b705
push esi
jmp 0x100b8a8
mov ecx, dword [esi + 4]
xor eax, eax
inc eax
and ecx, eax
mov dword [edi + 4], ecx
mov ecx, dword [esi + 4]
shr ecx, 1
and ecx, eax
mov dword [edi + 0xc], ecx
mov ecx, dword [esi + 4]
shr ecx, 2
and ecx, eax
mov dword [edi + 0x1c], ecx
mov ecx, dword [esi + 4]
shr ecx, 3
and ecx, eax
mov dword [edi + 8], ecx
mov ecx, dword [esi + 4]
shr ecx, 4
and ecx, eax
mov dword [edi + 0x10], ecx
mov ecx, dword [esi + 4]
shr ecx, 5
and ecx, eax
mov dword [edi + 0x14], ecx
mov ecx, dword [esi + 4]
shr ecx, 7
and ecx, eax
mov dword [edi + 0x18], ecx
mov ecx, dword [esi + 4]
shr ecx, 8
and ecx, eax
mov dword [edi + 0x20], ecx
mov ecx, dword [esi + 4]
shr ecx, 9
and ecx, eax
mov dword [edi + 0x24], ecx
mov ecx, dword [esi + 4]
shr ecx, 0xa
and ecx, eax
mov dword [edi + 0x28], ecx
mov ecx, dword [esi + 4]
shr ecx, 0xb
and ecx, eax
mov dword [edi + 0x2c], ecx
mov eax, dword [esi + 0x10]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x58], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], esi
mov dword [edi + 0x5c], eax
push 0x30
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp eax, ebx
je 0x100b7e5
mov ecx, eax
call fcn.0100d3d0
mov ebx, eax
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100b89d
movzx eax, word [esi + 8]
inc eax
lea ecx, [ebx + 4]
push eax
call sub.MFC42u.dll_CString::GetBuffer
mov dword [ebp + 8], eax
test eax, eax
je 0x100b832
movzx ecx, word [esi + 8]
lea ecx, [ecx + ecx + 2]
push ecx
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
movzx eax, word [esi + 8]
mov edx, dword [ebp + 8]
xor ecx, ecx
add esp, 0xc
mov word [edx + eax*2], cx
push 0xffffffffffffffff
lea ecx, [ebx + 4]
call sub.MFC42u.dll_CString::ReleaseBuffer
push dword [ebx + 4]
mov ecx, edi
call fcn.0100d4f6
test eax, eax
je 0x100b84b
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
jmp 0x100b890
mov eax, dword [esi + 0x3c]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x40]
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x48]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x4c]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x50]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x54]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x58]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x5c]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x60]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x64]
push ebx
lea ecx, [edi + 0x60]
mov dword [ebx + 0x2c], eax
call fcn.0100a2fa
mov eax, dword [esi]
test eax, eax
je 0x100b8a5
add esi, eax
jmp 0x100b7c8
push 0x68
call fcn.0100aec8
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_free]
xor eax, eax
pop ecx
inc eax
call fcn.010121e0
ret 4