Function at 0x1009465
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x100f595
call fcn.0100e880
sub esp, 0x10
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.0100a9f8
lea ecx, [esi + 0x54]
call fcn.0100a998
mov edi, 0x400
push edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.msvcrt.dll_malloc]
jmp 0x10094c7
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push ebx
push 0x33
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x10094d3
push ebx
call dword [sym.imp.msvcrt.dll_free]
add dword [ebp - 0x10], edi
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x100949c
mov eax, 0xc000009a
test eax, eax
jge 0x10094e8
push eax
push 0x9e
call fcn.01008d3c
pop ecx
jmp 0x1009692
cmp dword [ebp - 0x14], 0
jne 0x10094f4
push ebx
jmp 0x100968c
mov ecx, dword [ebx + 4]
xor eax, eax
inc eax
and ecx, eax
mov dword [esi + 4], ecx
mov ecx, dword [ebx + 4]
shr ecx, 1
and ecx, eax
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 4]
shr ecx, 2
and ecx, eax
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 4]
shr ecx, 3
and ecx, eax
mov dword [esi + 8], ecx
mov ecx, dword [ebx + 4]
shr ecx, 4
and ecx, eax
mov dword [esi + 0x10], ecx
mov ecx, dword [ebx + 4]
shr ecx, 5
and ecx, eax
mov dword [esi + 0x18], ecx
mov ecx, dword [ebx + 4]
shr ecx, 7
and ecx, eax
mov dword [esi + 0x1c], ecx
mov ecx, dword [ebx + 4]
shr ecx, 6
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x20]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x24]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x44], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x48], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x4c], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x18], ebx
mov dword [esi + 0x50], eax
push 0x30
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10095b7
mov ecx, eax
call fcn.0100b336
mov edi, eax
mov dword [ebp - 0x10], edi
jmp 0x10095be
and dword [ebp - 0x10], 0
mov edi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x1009681
movzx eax, word [ebx + 8]
inc eax
lea ecx, [edi + 4]
push eax
call sub.MFC42u.DLL_CString::GetBuffer
test eax, eax
je 0x1009613
movzx ecx, word [ebx + 8]
mov esi, dword [ebx + 0xc]
lea ecx, [ecx + ecx + 2]
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movzx ecx, word [ebx + 8]
and word [eax + ecx*2], 0
mov ecx, dword [ebp - 0x10]
push 0xffffffffffffffff
add ecx, 4
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
push dword [edi + 4]
mov ecx, esi
call fcn.0100b432
test eax, eax
je 0x100962c
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
jmp 0x1009674
mov eax, dword [ebx + 0x3c]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x40]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x48]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x4c]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x50]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x54]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x58]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x5c]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0x60]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x64]
push edi
lea ecx, [esi + 0x54]
mov dword [edi + 0x2c], eax
push dword [ecx + 8]
call sub.MFC42u.DLL_CObArray::SetAtGrow
mov eax, dword [ebx]
test eax, eax
je 0x1009689
add ebx, eax
jmp 0x1009596
push 0x68
call fcn.01008d3c
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov dword fs:[0], ecx
leave
ret 4