Function at 0x411ed0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov ebx, 0x419700
xor eax, eax
push ebp
push 0x4121d5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
push 0x419664
push 0x18
mov eax, dword [0x4174d8]
push eax
call sub.user32.dll_LoadStringA_1
push 0x41970c
push 0x419664
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
mov eax, 0x4121e4
xor edx, edx
call fcn.00411cd0
mov byte [ebx], al
mov eax, 0x4121ec
xor edx, edx
call fcn.00411cd0
mov byte [ebx + 1], al
mov eax, 0x4121f4
mov edx, 1
call fcn.00411cd0
mov byte [ebx + 2], al
mov eax, 0x412200
mov edx, 1
call fcn.00411cd0
mov byte [ebx + 3], al
mov eax, 0x412208
mov edx, 1
call fcn.00411cd0
mov byte [ebx + 5], al
mov eax, 0x412210
xor edx, edx
call fcn.00411cd0
test eax, eax
setne al
mov byte [ebx + 7], al
mov eax, 0x412218
mov edx, 1
call fcn.00411cd0
test eax, eax
setne al
mov byte [ebx + 8], al
mov eax, dword [ebx]
mov dword [0x4182cc], eax
mov eax, dword [ebx + 4]
mov dword [0x4182d0], eax
mov al, byte [ebx + 8]
mov byte [0x4182d4], al
mov word [0x417906], 0x15
xor eax, eax
mov dword [0x419714], eax
mov eax, 0x419720
mov edx, 0x412228
call fcn.004035d4
lea eax, [ebp - 0x34]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [0x41971c], eax
mov eax, dword [0x41971c]
mov dword [0x419718], eax
mov byte [0x419724], 1
mov edx, 0x412238
lea eax, [ebp - 0x200]
call fcn.00404df2
lea eax, [ebp - 0x200]
call fcn.00405117
call fcn.004026bc
test eax, eax
jne 0x4121ba
jmp 0x412192
lea edx, [ebp - 4]
lea eax, [ebp - 0x200]
call fcn.00403ac4
lea eax, [ebp - 0x200]
call fcn.004050b4
call fcn.00402664
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00411df8
mov eax, dword [ebp - 8]
mov edx, 0x41224c
call fcn.00403910
jne 0x412069
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00411df8
mov eax, dword [ebp - 8]
cmp byte [eax], 0x2d
jne 0x412087
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.004039f8
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00411df8
mov eax, dword [ebp - 0xc]
mov edx, 0x412258
call fcn.00403910
jne 0x4120ac
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00411df8
mov eax, dword [ebp - 8]
mov edx, 0x412264
call fcn.00403910
je 0x4120ca
mov eax, dword [ebp - 8]
mov edx, 0x412270
call fcn.00403910
jne 0x4120df
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00402994
mov dword [0x419718], eax
jmp 0x412192
mov eax, dword [ebp - 8]
mov edx, 0x412280
call fcn.00403910
je 0x4120fd
mov eax, dword [ebp - 8]
mov edx, 0x41228c
call fcn.00403910
jne 0x412117
xor eax, eax
mov dword [0x419714], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00402994
mov word [0x417906], ax
jmp 0x412192
mov eax, dword [ebp - 8]
mov edx, 0x41229c
call fcn.00403910
je 0x412135
mov eax, dword [ebp - 8]
mov edx, 0x4122a8
call fcn.00403910
jne 0x41214e
mov dword [0x419714], 1
mov eax, 0x419720
mov edx, dword [ebp - 0xc]
call fcn.004035d4
jmp 0x412192
mov eax, dword [ebp - 8]
mov edx, 0x4122bc
call fcn.00403910
jne 0x412176
mov dword [0x419714], 2
mov eax, 0x419720
mov edx, dword [ebp - 0xc]
call fcn.004035d4
jmp 0x412192
mov eax, dword [ebp - 8]
mov edx, 0x4122d0
call fcn.00403910
jne 0x412192
mov eax, dword [ebp - 0xc]
call fcn.00411e58
mov byte [0x419724], al
lea eax, [ebp - 0x200]
call fcn.00404f34
call fcn.00402664
test al, al
je 0x412026
lea eax, [ebp - 0x200]
call fcn.00404ef8
call fcn.00402664
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4121dc
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004035a4
ret