Function at 0x41b120
Capabilities:
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5b76b4
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x6d2e20]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d2e20]
xor eax, esp
push eax
lea eax, [esp + 0x120]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov ecx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040c050
mov eax, dword [0x6d4a8c]
xor esi, esi
push esi
push 0x6a6f4e
push eax
push esi
mov ecx, 0x6d4a78
call fcn.004109b0
test eax, eax
je 0x41b19b
push 0xffffffffffffffff
push esi
push 0x6d4a78
mov ecx, ebx
call fcn.00411090
jmp 0x41ba0b
cmp dword [edi], esi
jne 0x41b1a9
mov eax, 1
jmp 0x41ba0d
lea ecx, [esp + 0x60]
call fcn.0040c280
mov dword [esp + 0x128], esi
push str.Select__FROM_Win32_OperatingSystem
lea ebx, [esp + 0x5c]
mov dword [esp + 0x20], esi
call fcn.00410f60
mov esi, eax
push 0x6ac068
lea ebx, [esp + 0x28]
mov byte [esp + 0x12c], 1
call fcn.00410f60
mov byte [esp + 0x128], 2
mov ecx, dword [esi]
xor ebx, ebx
cmp ecx, ebx
je 0x41b1f7
mov ecx, dword [ecx]
jmp 0x41b1f9
xor ecx, ecx
mov eax, dword [eax]
cmp eax, ebx
je 0x41b203
mov edx, dword [eax]
jmp 0x41b205
xor edx, edx
mov eax, dword [edi]
mov esi, dword [eax]
lea edi, [esp + 0x1c]
push edi
push ebx
push 0x30
push ecx
mov ecx, dword [esi + 0x50]
push edx
push eax
call ecx
lea edi, [esp + 0x24]
mov esi, eax
call fcn.00410f10
lea edi, [esp + 0x58]
mov byte [esp + 0x128], bl
call fcn.00410f10
cmp esi, ebx
mov eax, dword [esp + 0x1c]
jge 0x41b258
cmp eax, ebx
je 0x41b248
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ecx, [esp + 0x60]
call fcn.00411690
mov eax, esi
jmp 0x41ba0d
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], ebx
cmp eax, ebx
je 0x41b8c8
mov ebp, 0xf
lea edi, [ebp - 7]
mov ecx, dword [eax]
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x1c]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [esp + 0x3c], ebx
je 0x41b8b8
cmp eax, ebx
jne 0x41b8b8
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
xor edx, edx
push ebx
mov eax, 0x6a73b4
lea esi, [esp + 0xe8]
mov word [esp + 0x30], cx
mov dword [esp + 0x100], 7
mov dword [esp + 0xfc], ebx
mov word [esp + 0xec], dx
call fcn.0040e1e0
mov byte [esp + 0x128], 3
push ebx
push 0x6a6f4e
lea ecx, [esp + 0xd0]
mov dword [esp + 0xe8], ebp
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
call fcn.00411450
push ebx
push ebx
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x134], 4
mov eax, dword [esp + 0x24]
mov ecx, dword [eax]
push ebx
push str.Version
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, ebx
jne 0x41b395
cmp word [esp + 0x2c], 1
je 0x41b395
mov edi, dword [esp + 0x34]
lea ecx, [esp + 0x58]
push ecx
call fcn.00410d70
mov byte [esp + 0x128], 5
mov eax, dword [eax]
cmp eax, ebx
je 0x41b35c
mov eax, dword [eax]
jmp 0x41b35e
xor eax, eax
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x41b363
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xe8]
call fcn.0040e1e0
lea edi, [esp + 0x58]
mov byte [esp + 0x128], 4
call fcn.00410f10
mov edi, 8
cmp dword [esp + 0xf8], ebx
jne 0x41b3b6
push 3
push 0x6ac59c
lea ecx, [esp + 0xd0]
call fcn.00411450
jmp 0x41b762
lea edx, [esp + 0x40]
push edx
call fcn.0040c820
mov byte [esp + 0x128], 6
xor eax, eax
mov word [esp + 0x84], ax
push 1
mov eax, 0x6ac5a0
lea esi, [esp + 0x84]
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], ebx
call fcn.0040e1e0
mov ecx, esi
push ecx
lea edx, [esp + 0xe8]
push edx
lea ecx, [esp + 0x48]
mov byte [esp + 0x130], 7
call fcn.0041cef0
mov byte [esp + 0x128], 6
cmp dword [esp + 0x98], edi
jb 0x41b434
mov eax, dword [esp + 0x84]
push eax
call fcn.0044fdf0
add esp, 4
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x24], 0x3a8
jne 0x41b464
call fcn.0058abb2
mov esi, dword [esp + 0x4c]
cmp dword [esi + 0x18], edi
jb 0x41b46e
mov eax, dword [esi + 4]
jmp 0x41b471
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x28]
lea edi, [esp + 0x84]
call fcn.0042a3a0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd4]
mov byte [esp + 0x134], 8
call fcn.0040dc10
mov byte [esp + 0x128], 6
cmp dword [esp + 0x98], 0x10
jb 0x41b4bf
mov edx, dword [esp + 0x84]
push edx
call fcn.0044fdf0
add esp, 4
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x24], 0x3a8
cmp eax, 1
ja 0x41b4f2
call fcn.0058abb2
mov esi, dword [esp + 0x4c]
cmp dword [esi + 0x34], 8
jb 0x41b4fd
mov esi, dword [esi + 0x20]
jmp 0x41b500
add esi, 0x20
push esi
lea ecx, [esp + 0x28]
lea edi, [esp + 0x84]
call fcn.0042a3a0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd4]
mov byte [esp + 0x134], 9
call fcn.0040dc10
mov byte [esp + 0x128], 6
cmp dword [esp + 0x98], 0x10
jb 0x41b54e
mov ecx, dword [esp + 0x84]
push ecx
call fcn.0044fdf0
add esp, 4
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
push ebx
push 0x6ac5a4
push eax
call edx
cmp eax, ebx
jne 0x41b5ff
cmp word [esp + 0x2c], 1
je 0x41b5ff
mov ecx, dword [esp + 0x34]
mov eax, 0x17
mov word [esp + 0xa4], ax
mov dword [esp + 0xac], ecx
lea esi, [esp + 0xa4]
lea edi, [esp + 0x78]
mov byte [esp + 0x128], 0xa
call fcn.0041e590
mov byte [esp + 0x128], 0xb
mov eax, dword [eax]
cmp eax, ebx
je 0x41b5bd
mov eax, dword [eax]
jmp 0x41b5bf
xor eax, eax
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x41b5c4
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xe8]
call fcn.0040e1e0
lea edi, [esp + 0x78]
call fcn.00410f10
lea edx, [esp + 0xa4]
push edx
mov byte [esp + 0x12c], 6
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [esp + 0xfc], 8
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x24], 0x3a8
jae 0x41b61f
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x28]
lea edi, [esp + 0x84]
call fcn.0042a3a0
add esp, 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd4]
mov byte [esp + 0x134], 0xc
call fcn.0040dc10
mov byte [esp + 0x128], 6
cmp dword [esp + 0x98], 0x10
jb 0x41b66d
mov eax, dword [esp + 0x84]
push eax
call fcn.0044fdf0
add esp, 4
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [esp + 0x34]
push edx
push ebx
push str.ServicePackMinorVersion
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp eax, ebx
jne 0x41b716
cmp word [esp + 0x2c], 1
je 0x41b716
mov edx, dword [esp + 0x34]
mov ecx, 0x17
mov word [esp + 0xb4], cx
mov dword [esp + 0xbc], edx
lea esi, [esp + 0xb4]
lea edi, [esp + 0x20]
mov byte [esp + 0x128], 0xd
call fcn.0041e590
mov byte [esp + 0x128], 0xe
mov eax, dword [eax]
cmp eax, ebx
je 0x41b6dc
mov eax, dword [eax]
jmp 0x41b6de
xor eax, eax
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x41b6e3
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xe8]
call fcn.0040e1e0
lea edi, [esp + 0x20]
call fcn.00410f10
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [esp + 0x128], 4
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x41b744
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x50]
push ecx
call fcn.004102f0
mov edx, dword [esp + 0x50]
add esp, 4
push edx
call fcn.0044fdf0
add esp, 4
mov eax, dword [esp + 0x40]
push eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.0044fdf0
add esp, 4
mov edi, 8
push ebx
push 0x6a6f4e
lea ecx, [esp + 0x108]
mov dword [esp + 0x120], ebp
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
call fcn.00411450
lea ecx, [esp + 0x80]
push ecx
mov byte [esp + 0x12c], 0xf
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [esp + 0x80]
cmp ax, 9
je 0x41b7bc
cmp ax, 6
je 0x41b7bc
push 2
push 0x6ac7b0
jmp 0x41b7c3
push 2
push 0x6ac7ac
lea ecx, [esp + 0x108]
call fcn.00411450
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x108]
push edx
lea ecx, [esp + 0xd4]
call fcn.0040dc10
lea esi, [esp + 0x100]
call fcn.0041d0c0
push 0xffffffffffffffff
push ebx
mov eax, esi
push eax
lea ecx, [esp + 0xd4]
call fcn.0040dc10
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [esp + 0x64]
call fcn.0040c420
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esp + 0x118], 0x10
jb 0x41b846
mov eax, dword [esp + 0x104]
push eax
call fcn.0044fdf0
add esp, 4
cmp dword [esp + 0xe0], 0x10
mov dword [esp + 0x118], ebp
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
jb 0x41b875
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.0044fdf0
add esp, 4
mov byte [esp + 0x128], bl
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0xfc], edi
jb 0x41b8aa
mov edx, dword [esp + 0xe8]
push edx
call fcn.0044fdf0
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x41b270
jmp 0x41b8c8
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x41b8c8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x6c]
cmp eax, ebx
je 0x41b9d9
mov ecx, dword [esp + 0x74]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x41b9d9
push ebx
lea ecx, [esp + 0x64]
call fcn.0041d190
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
push eax
call fcn.00411090
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x64]
call fcn.0042a970
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebp, dword [esp + 0x14]
push 1
push 0x6ac604
mov ecx, ebp
call fcn.0040dd10
cmp esi, ebx
jne 0x41b9a4
call fcn.0058abb2
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41b947
call fcn.0058abb2
add edi, 0x1c
cmp esi, ebx
jne 0x41b9a8
call fcn.0058abb2
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x41b95f
call fcn.0058abb2
push 0xffffffffffffffff
push ebx
push edi
mov ecx, ebp
call fcn.0040dc10
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x6c], eax
jbe 0x41b97d
call fcn.0058abb2
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x28], edi
cmp esi, ebx
jne 0x41b9ac
call fcn.0058abb2
xor eax, eax
lea ebp, [edi + 0x1c]
cmp ebp, dword [eax + 0x10]
ja 0x41b9b7
cmp esi, ebx
je 0x41b9b0
mov eax, dword [esi]
jmp 0x41b9b2
mov eax, dword [esi]
jmp 0x41b93d
mov eax, dword [esi]
jmp 0x41b955
mov eax, dword [esi]
jmp 0x41b994
xor eax, eax
cmp ebp, dword [eax + 0xc]
jae 0x41b9be
call fcn.0058abb2
xor ebx, ebx
cmp esi, ebx
je 0x41b9c8
cmp esi, dword [esp + 0x78]
je 0x41b9cd
call fcn.0058abb2
cmp ebp, dword [esp + 0x20]
jne 0x41b920
jmp 0x41b9f0
push ebx
lea ecx, [esp + 0x64]
call fcn.0041d190
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
push eax
call fcn.00411090
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push ebx
push edx
mov ecx, 0x6d4a78
call fcn.00411090
lea ecx, [esp + 0x60]
call fcn.00411690
xor eax, eax
mov ecx, dword [esp + 0x120]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0058848d
add esp, 0x118
ret