Function at 0x4747a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x71164e
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x7f9c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], 0
call fcn.00509920
push eax
mov dword [ebp - 0x30], eax
call fcn.005098a0
mov dword [ebp - 0x44], eax
call fcn.00509920
push eax
mov dword [ebp - 0x48], eax
call fcn.005098a0
add esp, 8
mov esi, eax
mov dword [ebp - 0x38], esi
call fcn.005098c0
cmp dword [edi + 0x2a8], 0xf
lea ecx, [edi + 0x294]
mov dword [ebp - 0x40], eax
jbe 0x474816
mov ecx, dword [ecx]
push ecx
push 0x71ae14
push esi
call fcn.00509420
push 0x71aa07
push str.userid
push esi
call fcn.00509420
add esp, 0x18
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x18], 0
movups xmmword [ebp - 0x28], xmm0
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x6c]
cmp ax, 9
je 0x474906
cmp ax, 6
je 0x474906
mov edi, dword [ebp - 0x14]
cmp edi, 6
jb 0x4748b0
cmp edi, 0xf
mov dword [ebp - 0x18], 6
push 6
lea esi, [ebp - 0x28]
cmova esi, dword [ebp - 0x28]
push str.pc_x86
push esi
call fcn.006e0e90
add esp, 0xc
mov byte [esi + 6], 0
jmp 0x4749c8
mov ecx, edi
mov eax, bind
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x4748c6
mov ecx, bind
jmp 0x4748d3
lea eax, [edi + ecx]
mov ecx, 0xf
cmp eax, ecx
cmova ecx, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044b200
mov ecx, dword [ebp - 0x2c]
mov esi, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [str.pc_x86]
mov dword [ebp - 0x18], 6
mov dword [esi], ecx
mov cx, word [0x71c05c]
jmp 0x474989
mov edi, dword [ebp - 0x14]
cmp edi, 6
jb 0x474938
cmp edi, 0xf
mov dword [ebp - 0x18], 6
push 6
lea esi, [ebp - 0x28]
cmova esi, dword [ebp - 0x28]
push str.pc_x64
push esi
call fcn.006e0e90
add esp, 0xc
mov byte [esi + 6], 0
jmp 0x4749c8
mov ecx, edi
mov eax, bind
shr ecx, 1
sub eax, ecx
cmp edi, eax
jbe 0x47494e
mov ecx, bind
jmp 0x47495b
lea eax, [edi + ecx]
mov ecx, 0xf
cmp eax, ecx
cmova ecx, eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0044b200
mov ecx, dword [ebp - 0x2c]
mov esi, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [str.pc_x64]
mov dword [ebp - 0x18], 6
mov dword [esi], ecx
mov cx, word [0x71c064]
add esp, 8
mov word [esi + 4], cx
mov byte [esi + 6], 0
cmp edi, 0xf
jbe 0x4749c5
mov ecx, dword [ebp - 0x28]
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x4749bb
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474b24
push edi
push ecx
call fcn.006dec1c
add esp, 8
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
mov esi, dword [ebp - 0x38]
cmova eax, dword [ebp - 0x28]
push eax
push str.system_type
push esi
call fcn.00509420
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0xf
jbe 0x474a20
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x474a16
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x474b24
push ecx
push edx
call fcn.006dec1c
add esp, 8
mov edi, dword [ebp - 0x3c]
cmp dword [edi + 0x2c0], 0xf
lea eax, [edi + 0x2ac]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jbe 0x474a46
mov eax, dword [eax]
push eax
push str.devicekey
push esi
call fcn.00509420
push str.1.2.8.9
push str.sdk_version
push esi
call fcn.00509420
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call fcn.0050a290
add esp, 0x14
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
push str.hook_type
push esi
call fcn.005093d0
movsd xmm0, qword [0x71e7f0]
add esp, 8
movsd qword [esp], xmm0
push str.equipment_type
push esi
call fcn.005093d0
push dword [ebp - 0x40]
push str.server
push esi
call fcn.00509090
movsd xmm0, qword [0x71e800]
add esp, 0x14
mov esi, dword [ebp - 0x44]
movsd qword [esp], xmm0
push str.type
push esi
call fcn.005093d0
push dword [ebp - 0x48]
push str.request
push esi
call fcn.00509090
push dword [ebp - 0x30]
call fcn.005096a0
add esp, 0x20
lea ecx, [edi + 0x2c4]
mov esi, eax
push 0
push esi
call fcn.004986c0
push dword [ebp - 0x30]
call fcn.00509770
push esi
call fcn.00509070
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006def69
mov esp, ebp
pop ebp
ret
call fcn.006e51cf
int3