Function at 0x428cb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481696
mov eax, dword fs:[0]
push eax
sub esp, 0x190
mov eax, dword [0x4a7018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov eax, dword fs:[0x2c]
mov dword [edi + 8], esi
mov dword [ebp - 0x40], esi
mov ecx, dword [eax]
mov eax, dword [0x4aa610]
cmp eax, dword [ecx + 4]
jg 0x4290f0
mov eax, dword [0x4aa608]
test eax, eax
jne 0x428d17
xor al, al
jmp 0x428da8
lea ecx, [ebp - 0x44]
push ecx
push esi
call eax
test eax, eax
jne 0x428da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
lea ecx, [ebp - 0xf4]
mov esi, eax
call fcn.004064e0
mov dword [ebp - 4], 6
push ecx
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x5c], str..._.._util_win_process_info.cc
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0x4b
mov dword [ebp - 0x50], 2
call fcn.0041b720
mov dword [ebp - 0x4c], esi
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xf4]
mov edx, 0x49647c
mov dword [ebp - 0x3c], 0x10
call fcn.00405b50
lea ecx, [ebp - 0xf4]
mov dword [ebp - 4], 0xffffffff
xor ebx, ebx
call fcn.0041bc20
mov esi, dword [ebp - 0x40]
xor al, al
jmp 0x428da8
cmp dword [ebp - 0x44], 0
setne al
mov byte [edi + 0x5d], al
test al, al
je 0x428e62
mov byte [edi + 0x5c], 0
lea eax, [ebp - 0x40]
xor edx, edx
push eax
lea eax, [ebp - 0x2c]
mov ecx, esi
push 0x18
push eax
call fcn.004280f0
add esp, 0xc
mov dword [ebp - 0x44], eax
test eax, eax
jns 0x428ef2
push ecx
lea ecx, [ebp - 0xf4]
call fcn.004064e0
mov dword [ebp - 4], 0xa
push ecx
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0x5c], str..._.._util_win_process_info.cc
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0xc5
mov dword [ebp - 0x50], 2
call fcn.0041b720
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0xf4]
or ebx, 0x200
mov edx, str.NtQueryInformationProcess
mov dword [ebp - 0x3c], ebx
call fcn.00405b50
mov dword [ebp - 4], 0xffffffff
test ebx, 0x200
je 0x428f77
lea ecx, [ebp - 0xf4]
and ebx, 0xfffffdff
call fcn.00426e10
jmp 0x428f77
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x38], 9
sete al
mov byte [edi + 0x5c], al
test al, al
je 0x428db7
push ecx
lea ecx, [ebp - 0xec]
call fcn.004064e0
mov dword [ebp - 4], 8
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x54], str..._.._util_win_process_info.cc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x210
mov dword [ebp - 0x48], 2
call fcn.0041b720
mov dword [ebp - 4], 9
lea ecx, [ebp - 0xec]
or ebx, 1
mov edx, str.Reading_x64_process_from_x86_process_not_supported
mov dword [ebp - 0x3c], ebx
call fcn.00405b50
test bl, 1
je 0x4290cc
lea ecx, [ebp - 0xec]
call fcn.0041b540
xor al, al
jmp 0x4290d2
cmp dword [ebp - 0x40], 0x18
je 0x428fea
push ecx
lea ecx, [ebp - 0xec]
call fcn.004064e0
mov dword [ebp - 4], 0xc
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x54], str..._.._util_win_process_info.cc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xc9
mov dword [ebp - 0x48], 2
call fcn.0041b720
mov dword [ebp - 4], 0xd
lea ecx, [ebp - 0xec]
or ebx, 0x400
mov edx, str.NtQueryInformationProcess_incorrect_size
mov dword [ebp - 0x3c], ebx
call fcn.00405b50
mov dword [ebp - 4], 0xffffffff
test ebx, 0x400
je 0x428f77
lea ecx, [ebp - 0xec]
and ebx, 0xfffffbff
call fcn.0041b540
push ecx
lea ecx, [ebp - 0xec]
call fcn.004064e0
mov dword [ebp - 4], 0x10
push ecx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x54], str..._.._util_win_process_info.cc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x21e
mov dword [ebp - 0x48], 2
call fcn.0041b720
mov dword [ebp - 4], 0x11
lea ecx, [ebp - 0xec]
or ebx, 2
mov edx, str.GetProcessBasicInformation_failed
mov dword [ebp - 0x3c], ebx
call fcn.00405b50
test bl, 2
je 0x4290cc
lea ecx, [ebp - 0xec]
call fcn.0041b540
xor al, al
jmp 0x4290d2
mov eax, dword [ebp - 0x1c]
mov edx, edi
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x28]
mov ecx, eax
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0x230
mov dword [edi + 0x34], 0
cmp byte [edi + 0x5c], 0
mov eax, dword [edi + 0x2c]
push eax
push ecx
mov ecx, esi
je 0x429028
call fcn.004299a0
jmp 0x42902d
call fcn.0042a100
add esp, 8
test al, al
jne 0x429079
push 2
push 0x227
push str..._.._util_win_process_info.cc
push ecx
lea ecx, [ebp - 0xec]
call fcn.0041b3c0
mov dword [ebp - 4], 0x12
or ebx, 4
mov edx, str.ReadProcessData_failed
mov dword [ebp - 0x3c], ebx
mov ecx, eax
call fcn.00405b50
test bl, 4
je 0x4290cc
lea ecx, [ebp - 0xec]
call fcn.0041b540
xor al, al
jmp 0x4290d2
mov dl, byte [edi + 0x5c]
mov ecx, esi
push edi
call fcn.00428300
add esp, 4
test al, al
jne 0x4290d0
push 2
push 0x22c
push str..._.._util_win_process_info.cc
push ecx
lea ecx, [ebp - 0x19c]
call fcn.0041b3c0
mov dword [ebp - 4], 0x13
or ebx, 8
mov edx, str.ReadMemoryInfo_failed
mov dword [ebp - 0x3c], ebx
mov ecx, eax
call fcn.00405b50
test bl, 8
je 0x4290cc
lea ecx, [ebp - 0x19c]
call fcn.0041b540
xor al, al
jmp 0x4290d2
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00457ec6
mov esp, ebp
pop ebp
ret 4
push 0x4aa610
call fcn.004582c1
add esp, 4
cmp dword [0x4aa610], 0xffffffff
jne 0x428d07
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x429127
push 0x496f4e
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x429127
push 0x4aa610
mov dword [0x4aa608], eax
mov dword [ebp - 4], 0xffffffff
call fcn.00458277
add esp, 4
jmp 0x428d07