Function at 0x40eae0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [0x46cd00], 0x464550
mov dword [0x46ccfc], edx
call fcn.0040eee0
push 0x2c
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00422210
add esp, 0xc
lea eax, [ebp - 0x38]
push 0
push 0x2c
push eax
push 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x40eb3d
mov edx, 0x10000
mov al, 1
or ecx, 0xffffffff
mov esi, edx
lea edi, [edx - 1]
jmp 0x40eb4c
mov al, byte [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
cmp dword [0x46bae0], 0x3e
cbw
mov dword [0x46cd0c], ecx
mov word [0x46cd08], ax
mov dword [0x46cd10], edx
mov dword [0x46cd14], esi
mov dword [0x46cd18], edi
jb 0x40eb91
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46cd04], eax
jmp 0x40eb96
mov eax, dword [0x46cd04]
test eax, eax
jne 0x40ebd5
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46cd04], eax
test eax, eax
je 0x40eec6
push 4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x46d018
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
test eax, eax
js 0x40eec6
mov ax, 1
cmp ax, word [0x46cd08]
sbb eax, eax
and eax, 0xfa0
mov dword [0x46be44], eax
mov eax, 0x46d478
test al, 7
jne 0x40eeb8
mov eax, 0x46d460
mov dword [0x46d478], 0
mov dword [0x46d47c], 0
test al, 7
jne 0x40eeb8
xor eax, eax
mov dword [0x46d46c], 0x200
mov dword [0x46d460], eax
mov ecx, 0x28
mov dword [0x46d464], eax
mov dword [0x46d468], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
mov edx, eax
mov dword [0x46d470], 0x38
mov dword [0x46cce8], eax
mov dword [0x46d060], eax
call fcn.004060e0
mov esi, eax
mov edx, 1
xor eax, eax
mov word [esi], ax
lock xadd dword [0x46ccec], edx
inc edx
dec dl
mov dword [esi + 8], eax
movzx eax, dl
mov ecx, 0x28
mov byte [esi + 2], dl
mov dword [esi + 0xc], str.Type
mov dword [0x46cce8], esi
mov dword [eax*4 + 0x46d060], esi
movzx eax, dl
mov edx, esi
mov word [esi - 8], ax
mov dword [esi + 4], 1
call fcn.004060e0
mov edx, eax
mov esi, 1
xor eax, eax
mov ecx, esi
mov word [edx], ax
lock xadd dword [0x46ccec], ecx
inc ecx
dec cl
mov dword [edx + 4], eax
mov dword [edx + 8], eax
movzx eax, cl
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Alloc
mov dword [0x46cce4], edx
mov dword [eax*4 + 0x46d060], edx
call fcn.00407ba0
mov dword [0x46ce74], eax
cmp eax, 0xffffffff
je 0x40eec6
call fcn.004065a0
jmp 0x40ed40
test al, al
je 0x40eec6
cmp byte [0x7ffe03c4], 1
jne 0x40ed89
mov eax, dword [0x7ffe03c0]
dec eax
cmp eax, 0x1f
ja 0x40ed89
mov ax, word [0x46cd08]
mov word [0x46cd1e], ax
xor eax, eax
mov word [0x46cd20], si
mov byte [0x46cd1c], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420701
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], 0
push eax
lea edx, [ebp - 0x3c]
call fcn.00411b80
lea esp, [esp]
test eax, eax
js 0x40ee89
mov ebx, dword ds:[ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x40], ebx
movzx eax, word [ebx + 0xa]
mov dword [ebp - 0x3c], eax
movzx edi, ax
cmp cx, ax
jae 0x40ee7a
mov si, word [ebp - 0x44]
lea ecx, [ebx + 0x21]
mov edx, edi
movzx eax, byte ds:[ecx]
lea ecx, [ecx + 0x2c]
add si, ax
sub edx, 1
jne 0x40edd2
cmp word [ebp - 0x3c], 1
jbe 0x40ee7a
lea eax, ds:[edi + edi]
push eax
push 4
lfence
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebp - 0x40]
mov ebx, eax
xor ecx, ecx
mov dword [0x46cd24], ebx
add edx, 0x21
movzx eax, si
lea edx, [edx + 0x2c]
mov dword [ebp - 0x44], eax
lea ecx, [ecx + 2]
movzx eax, byte [edx - 0x2c]
mov word [ecx + ebx - 2], ax
sub edi, 1
je 0x40ee38
mov ebx, dword [0x46cd24]
jmp 0x40ee16
push dword [ebp - 0x40]
push 0
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x44]
test ax, ax
je 0x40ee89
mov word [0x46cd1e], ax
mov eax, dword [ebp - 0x3c]
mov word [0x46cd20], ax
xor eax, eax
mov byte [0x46cd1c], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420701
mov esp, ebp
pop ebp
ret
push ebx
push 0
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ax, word [0x46cd08]
mov word [0x46cd1e], ax
mov eax, 1
mov word [0x46cd20], ax
mov byte [0x46cd1c], al
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420701
mov esp, ebp
pop ebp
ret
push 0x80000002
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [ebp - 4]
mov eax, 0xc0000001
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420701
mov esp, ebp
pop ebp
ret