Function at 0x4445a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x501814]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x50b880], 1
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x4445dc
push 0
push 0x4ce734
push 0x4ceb98
push 0x4f9080
call fcn.00403760
add esp, 0x10
add esi, 8
mov ecx, esi
call fcn.00448540
push 0x4d2cb8
push esi
call fcn.0043f110
push 0x4d2ce0
push str.Service_version:__ls
push esi
call fcn.0043f110
add esp, 0x14
mov dword [ebp - 8], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
call fcn.004941b0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x34]
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push pe_nt_image_headers32
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.004a6d90
add esp, 0xc
mov dword [ebp - 0x26c], 0x11c
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4447c9
mov eax, dword [ebp - 0x268]
movzx ecx, word [ebp - 0x158]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x260]
push ebx
mov dword [ebp - 0x278], eax
movzx eax, word [ebp - 0x156]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0x150], 0x11c
push 0x100
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x274], ecx
push 0
push eax
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
call fcn.004a6d90
add esp, 0xc
mov dword [ebp - 0x38], 0x10000
xor eax, eax
mov dword [ebp - 0x3c], eax
push 1
push 0x80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x80
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
push str.wintrust.dll
sete byte [ebp - 0x26e]
cmp word [ebp - 0x34], 9
sete byte [ebp - 0x26d]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x44475a
push str.CryptCATAdminAcquireContext2
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x26d], 0
mov ecx, 0x4d2778
mov eax, 0x4d2774
cmove eax, ecx
cmp byte [ebp - 0x26e], 0
push eax
mov ecx, str.client
mov eax, str.server
cmove eax, ecx
push eax
push dword [ebp - 0x274]
lea eax, [ebp - 0x10]
push dword [ebp - 0x278]
push dword [ebp - 0x27c]
push dword [ebp - 0x280]
push str._lu._lu._lu._lu._hs._hs
push eax
call fcn.00432740
add esp, 0x20
pop ebx
test eax, eax
je 0x4447c9
lea ecx, [ebp - 0x10]
call fcn.004948b0
push eax
push str.OS_version:__ls
push esi
call fcn.0043f110
add esp, 0xc
mov edx, dword [edi]
mov eax, edx
mov ecx, dword [edi + 4]
or eax, ecx
je 0x44480b
push ecx
push edx
push str.RID:__llu
push esi
call fcn.0043f110
lea eax, [ebp - 0x28]
push eax
call fcn.0046b200
add esp, 0x14
mov ecx, eax
call fcn.00496a00
push eax
push str.IP:__hs
push esi
call fcn.0043f110
add esp, 0xc
lea ecx, [ebp - 0x28]
call fcn.00496800
lea ecx, [ebp - 0x10]
call fcn.004941d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004a559d
mov esp, ebp
pop ebp
ret 4