Function at 0x4161c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
mov ecx, 9
sub esp, 0x5c
lea edx, [esp + 0x2c]
mov ebx, dword [esp + 0x70]
mov ebp, dword [esp + 0x74]
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
movzx eax, word [esp + 0x2c]
movzx edx, word [esp + 0x4c]
cmp ax, 5
je 0x416590
jbe 0x416240
cmp ax, 8
je 0x4163b5
jbe 0x416410
cmp ax, 0xa
je 0x4163c4
jb 0x416564
cmp ax, 0xffff
jne 0x4164b0
mov dword [ebx], 0x6e6b6e75
mov dword [ebx + 4], 0x6e776f
jmp 0x416270
cmp ax, 2
je 0x416550
ja 0x416390
test ax, ax
je 0x416540
cmp ax, 1
jne 0x4164b0
mov dword [ebx], 0x7370696d
mov byte [ebx + 4], 0
lea esi, [esi]
xor eax, eax
mov byte [esp + 0x29], 0
mov edi, str.CyrixInstead
cpuid
lea eax, [esp + 0x1d]
mov dword [esp + 0x25], ecx
mov dword [esp + 0x1d], ebx
mov dword [esp + 0x21], edx
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4163f0
mov edi, str.CentaurHauls
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416440
mov edi, str.RiseRiseRise
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416474
mov edi, str.GenuineIntel
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416490
mov edi, str.AuthenticAMD
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416460
mov edi, str.GenuineTMx86
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4165b0
mov edi, str.Geode_by_NSC
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4165d0
mov edi, str.UMC_UMC_UMC
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416600
mov edi, str.AMD_ISBETTER
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416460
mov edi, str.DEI
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416460
mov edi, str.NexGenerationAMD
mov ecx, 0x11
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x416460
mov edi, str.NexGenDriven
mov ecx, 0xd
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4165e5
mov dword [ebp], 0x6e6b6e55
mov dword [ebp + 4], 0x6e776f
jmp 0x416400
cmp ax, 3
je 0x416580
cmp ax, 4
jne 0x4164b0
mov edi, 0x6873
mov byte [ebx + 2], 0
mov word [ebx], di
jmp 0x416270
mov dword [ebx], 0x6c69736d
mov byte [ebx + 4], 0
jmp 0x416270
mov eax, 0x34
mov dword [ebx], 0x32334149
mov dword [ebx + 4], 0x206e6f20
mov dword [ebx + 8], 0x366e6957
mov word [ebx + 0xc], ax
jmp 0x416270
mov esi, 0x78
mov dword [ebp], 0x69727943
mov word [ebp + 4], si
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
cmp ax, 6
je 0x4165a0
cmp ax, 7
jne 0x4164b0
mov dword [ebx], 0x68706c61
mov dword [ebx + 4], 0x343661
jmp 0x416270
mov dword [ebp], 0x746e6543
mov dword [ebp + 4], 0x727561
add esp, 0x5c
pop ebx
mov eax, 1
pop esi
pop edi
pop ebp
ret
mov dword [ebp], 0x444d41
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp], 0x65736952
mov byte [ebp + 4], 0
add esp, 0x5c
pop ebx
mov eax, 1
pop esi
pop edi
pop ebp
ret
mov ebx, 0x6c
mov dword [ebp], 0x65746e49
mov eax, 1
mov word [ebp + 4], bx
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
test ax, ax
mov dword [ebx], 0x6e6b6e75
mov dword [ebx + 4], 0x6e776f
jne 0x416270
sub edx, 3
cmp dx, 0xc
ja case.0x4164d2.5
movzx edx, dx
jmp dword [edx*4 + 0x636500]
mov dword [ebx], 0x36383769
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36383669
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36383569
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36383469
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36383369
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36387869
mov byte [ebx + 4], 0
jmp 0x416270
mov dword [ebx], 0x36387869
mov byte [ebx + 4], 0
jmp 0x4164c6
mov eax, 0x61
mov dword [ebx], 0x68706c61
mov word [ebx + 4], ax
jmp 0x416270
mov eax, 0x34
mov dword [ebx], 0x36646d61
mov word [ebx + 4], ax
jmp 0x416270
mov dword [ebx], 0x637070
jmp 0x416270
mov dword [ebx], 0x6d7261
jmp 0x416270
mov dword [ebx], 0x34364149
mov byte [ebx + 4], 0
jmp 0x416270
mov ecx, 0x61
mov dword [ebp], 0x6e617254
mov dword [ebp + 4], 0x74656d73
mov word [ebp + 8], cx
jmp 0x416400
mov edx, 0x65
mov dword [ebp], 0x646f6547
mov word [ebp + 4], dx
jmp 0x416400
mov eax, 0x6e65
mov dword [ebp], 0x4778654e
mov byte [ebp + 6], 0
mov word [ebp + 4], ax
jmp 0x416400
mov dword [ebp], 0x434d55
jmp 0x416400