Function at 0x101e61c
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0x10]
push edi
test ebx, ebx
je 0x101e50a
push 8
pop ecx
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
cmp dword [ebp + 0xc], 0x200
jb 0x101e6f0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0101e4a4
test eax, eax
je 0x101e54c
mov dword [ebp - 4], 2
test ebx, ebx
je 0x101e6ef
push 6
lea esi, [eax + 0x10]
lea edi, [ebx + 8]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx], 1
jmp 0x101e6ef
mov eax, dword [ebp + 8]
lea edi, [eax - 1]
and edi, 1
je 0x101e565
mov cl, byte [eax + 0xb]
mov byte [ebp + 0x10], cl
mov cl, byte [eax + 0xc]
mov byte [ebp + 0x11], cl
jmp 0x101e56c
movzx ecx, word [eax + 0xb]
mov dword [ebp + 0x10], ecx
mov cl, byte [eax + 0xd]
lea esi, [eax + 3]
push str._FVE_FS_
push esi
mov byte [ebp + 0xf], cl
call fcn.0101e44b
test al, al
je 0x101e5cf
mov dword [ebp - 4], 2
test ebx, ebx
je 0x101e6ef
movzx ecx, word [ebp + 0x10]
movzx eax, byte [ebp + 0xf]
imul eax, ecx
push 0
mov dword [ebx], eax
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x3c]
push dword [eax + 0x38]
call fcn.0100e3d0
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x10], eax
mov eax, edx
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x10]
mov dword [ebx + 8], eax
mov eax, edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0xc], eax
jmp 0x101e6ef
push str.NTFS
push esi
call fcn.0101e44b
test al, al
jne 0x101e6e8
push str.EXFAT
push esi
call fcn.0101e44b
test al, al
jne 0x101e6e8
mov eax, dword [ebp + 8]
mov bl, byte [eax + 0x10]
test bl, bl
je 0x101e6ef
mov ecx, eax
and ecx, 1
je 0x101e618
mov dl, byte [eax + 0xe]
mov byte [ebp - 0x10], dl
mov dl, byte [eax + 0xf]
mov byte [ebp - 0xf], dl
jmp 0x101e61f
movzx edx, word [eax + 0xe]
mov dword [ebp - 0x10], edx
test edi, edi
je 0x101e631
mov dl, byte [eax + 0x13]
mov byte [ebp - 8], dl
mov dl, byte [eax + 0x14]
mov byte [ebp - 7], dl
jmp 0x101e638
movzx edx, word [eax + 0x13]
mov dword [ebp - 8], edx
test al, 3
je 0x101e659
mov dl, byte [eax + 0x20]
mov byte [ebp + 8], dl
mov dl, byte [eax + 0x21]
mov byte [ebp + 9], dl
mov dl, byte [eax + 0x22]
mov byte [ebp + 0xa], dl
mov dl, byte [eax + 0x23]
mov byte [ebp + 0xb], dl
mov esi, dword [ebp + 8]
jmp 0x101e65c
mov esi, dword [eax + 0x20]
test ecx, ecx
je 0x101e66e
mov cl, byte [eax + 0x16]
mov byte [ebp - 0xc], cl
mov cl, byte [eax + 0x17]
mov byte [ebp - 0xb], cl
jmp 0x101e675
movzx ecx, word [eax + 0x16]
mov dword [ebp - 0xc], ecx
test edi, edi
je 0x101e687
mov cl, byte [eax + 0x11]
mov al, byte [eax + 0x12]
mov byte [ebp + 8], cl
mov byte [ebp + 9], al
jmp 0x101e68e
movzx eax, word [eax + 0x11]
mov dword [ebp + 8], eax
cmp word [ebp - 8], 0
je 0x101e699
movzx esi, word [ebp - 8]
cmp word [ebp + 0x10], 0
je 0x101e6ef
cmp byte [ebp + 0xf], 0
je 0x101e6ef
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 8]
shl eax, 5
lea eax, [eax + ecx - 1]
lea edx, [ecx - 1]
not edx
and eax, edx
cdq
idiv ecx
movzx edx, word [ebp - 0xc]
mov ecx, eax
mov eax, esi
sub eax, ecx
movzx ecx, bl
imul ecx, edx
sub eax, ecx
movzx ecx, word [ebp - 0x10]
sub eax, ecx
movzx ecx, byte [ebp + 0xf]
xor edx, edx
div ecx
inc eax
inc eax
cmp eax, 0xff7
jb 0x101e6ef
mov dword [ebp - 4], 1
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret 0xc