Function at 0x462ca0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x1bc
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
push ebp
push esi
push edi
push 0xf8
lea eax, [esp + 0x24]
mov ebx, edx
push 0
push eax
mov dword [esp + 0x128], ebx
mov ebp, ecx
call fcn.005861b0
add esp, 0xc
lea eax, [esp + 0x28]
push 0xf0
push 0
push eax
call fcn.005861b0
add esp, 0xc
lea eax, [esp + 0x14]
push ebx
push 0x410
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
jns 0x462dee
push ebx
push 0x400
lea eax, [esp + 0x1c]
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1560
mov esi, eax
test esi, esi
jns 0x462dee
cmp esi, 0xc0000022
je 0x462d5e
cmp esi, 0xc0000005
je 0x462d5e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x462d4c
movzx eax, si
jmp 0x462d68
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x462d6c
mov eax, esi
jmp 0x462d68
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x462d77
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x462d85
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x462dd4
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_open_the_process.
push 0xfffe
push 0x20
push ebp
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x463010
lfence
call fcn.004fe0c0
jmp 0x463010
push str.Unable_to_open_the_process.
push 0x5d369c
push 0x10
push ebp
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
jmp 0x463010
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x118]
push 0
push eax
push 0
push str.LdrSystemDllInitBlock
push 0x6309f4
push ebx
call sym.SystemInformer.exe_Ordinal_1525
mov edi, eax
test edi, edi
js 0x462e8c
push 0x98
push 4
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x98
mov esi, eax
push 0
push esi
call fcn.005861b0
add esp, 0xc
push 0
push 0x98
push esi
push dword [esp + 0x124]
push ebx
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x46302c
mov ecx, dword [esi]
lea eax, [esi + 0x7c]
add ecx, esi
cmp eax, ecx
jbe 0x462e88
push esi
push 0
lfence
push dword [0x633a74]
mov edi, 0xc0000004
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [eax]
test edi, edi
js 0x462e8c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x24], esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x120]
call fcn.00486de0
nop dword [eax]
test eax, eax
js 0x462fed
xor esi, esi
lea edi, [esp + 0x30]
nop
mov edx, dword [esp + esi*4 + 0x120]
test edx, edx
je 0x462edd
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004872e0
test al, al
je 0x462edd
mov eax, dword [esp + 0x18]
mov dword [edi - 4], eax
mov eax, dword [esp + 0x1c]
mov dword [edi], eax
inc esi
add edi, 0xc
cmp esi, 0x14
jb 0x462eb0
cmp dword [esp + 0x11c], 4
jne 0x462f64
push 0
push 4
lea eax, [esp + 0x124]
push eax
push 0xdd
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x462f64
mov eax, dword [esp + 0x11c]
lea edx, [esp + 0x118]
mov ecx, eax
and eax, 0x100
shr ecx, 4
and ecx, 0x30
or ecx, eax
lea eax, [esp + 0x1c]
shr ecx, 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x11c], ecx
push eax
mov ecx, 0xf
call fcn.004872e0
test al, al
je 0x462f64
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xe4], eax
mov esi, dword [0x633a60]
lea eax, [esp + 0x10]
push eax
push 0
push 5
push 0xd7
push esi
call sym.SystemInformer.exe_Ordinal_1412
nop
test al, al
je 0x462f9a
lea eax, [esp + 0x20]
push eax
push 0x463060
push ebp
push dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
lea esi, [esp + 0x30]
mov edi, 0x14
mov eax, dword [esi - 4]
mov dword [esi - 4], 0
test eax, eax
je 0x462fc5
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x462fc5
nop
call fcn.004fe0c0
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x462fe5
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x462fe5
nop
call fcn.004fe0c0
add esi, 0xc
sub edi, 1
jne 0x462fa3
mov eax, dword [esp + 0x24]
test eax, eax
je 0x463006
push eax
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword ds:[esp + 0x1c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x1bc
ret
push esi
push 0
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x462e8c