Function at 0x467580
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x49bce4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push esi
call fcn.0047aec0
call fcn.00470fa0
xor eax, eax
push 0x11c
push eax
mov dword [0x4d1f38], eax
mov dword [0x4d1f3c], eax
mov dword [0x4d1f40], eax
mov dword [0x4d1f44], eax
lea eax, [esp + 0x38]
push eax
call fcn.004063f0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x11c
call esi
test eax, eax
jne 0x4675fc
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], 0x114
call esi
test eax, eax
je 0x467618
cmp dword [esp + 0x40], 2
jne 0x467618
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [0x4d1f38], eax
mov dword [0x4d1f3c], ecx
jmp 0x46762c
mov dword [0x4d1f38], 5
mov dword [0x4d1f3c], 1
xor eax, eax
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, 0x103
mov dword [0x4d1f14], eax
mov dword [0x4d1f1c], eax
mov ecx, 0x7fff
mov eax, 0xf
or ebx, 0xffffffff
mov dword [0x4d1f18], ecx
mov dword [0x4d1f20], eax
mov dword [0x4d1f2c], eax
mov eax, dword [esp + 0x10]
mov dword [0x4d1f30], ecx
mov ecx, dword [esp + 0x20]
push str.LIBCTX
mov dword [0x4d1f00], ebx
mov dword [0x4d1f04], ebx
mov dword [0x4d1f08], ebx
mov dword [0x4d1f0c], 0
mov dword [0x4d1f10], 0x40
mov dword [0x4d1f24], 0x3f
mov dword [0x4d1f28], 0xff
mov dword [0x4d1f34], 8
mov dword [0x4be8c0], eax
mov dword [0x4be8c4], ecx
mov dword [0x4be8c8], 0x10000
mov dword [0x4d36cc], 0x100000
call fcn.00465af0
mov esi, eax
mov eax, dword [0x4d36c4]
add esp, 4
test eax, eax
jne 0x46774d
push str.PVTHEAP
call fcn.00465af0
add esp, 4
mov dword [0x4d36c4], eax
test eax, eax
jne 0x46774d
push eax
push 0x80000
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push eax
push str.PVTHEAP
mov dword [0x4d36c4], eax
call fcn.00465a70
mov eax, dword [0x4d36c4]
add esp, 8
push 0x88
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x467769
push esi
mov ecx, eax
call fcn.004674b0
jmp 0x46776b
xor eax, eax
mov dword [0x4d36a0], eax
test esi, esi
je 0x467847
push 8
call fcn.00476f40
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x154], 0
test eax, eax
je 0x4677a4
mov edx, dword [esi + 0x1c]
push 0
push edx
mov ecx, eax
call fcn.00476ef0
jmp 0x4677a6
xor eax, eax
push 0x18
mov dword [esp + 0x158], ebx
mov dword [0x4d36ac], eax
call fcn.00476ec0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x154], 1
test eax, eax
je 0x4677e2
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0
push ecx
mov ecx, eax
call fcn.00476c10
jmp 0x4677e4
xor eax, eax
push 0x18
mov dword [esp + 0x158], ebx
mov dword [0x4d36a8], eax
call fcn.00476ec0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x154], 2
test eax, eax
je 0x467820
mov edx, dword [esi + 0x14]
push 0
push 0
push 0
push edx
mov ecx, eax
call fcn.00476c10
jmp 0x467822
xor eax, eax
mov dword [0x4d36a4], eax
cmp dword [esi], 1
mov dword [esp + 0x154], ebx
jl 0x4678f8
lea ecx, [esi + 0x84]
call fcn.004766b0
jmp 0x4678f8
push eax
push str.LIBCTX
call fcn.00465a70
push 8
call fcn.00476f40
add esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 0x154], 3
test eax, eax
je 0x46787a
push 0
mov ecx, eax
call fcn.00476ed0
jmp 0x46787c
xor eax, eax
push 0x18
mov dword [esp + 0x158], ebx
mov dword [0x4d36ac], eax
call fcn.00476ec0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x154], 4
test eax, eax
je 0x4678b2
push 0
push 0
mov ecx, eax
call fcn.00476bc0
jmp 0x4678b4
xor eax, eax
push 0x18
mov dword [esp + 0x158], ebx
mov dword [0x4d36a8], eax
call fcn.00476ec0
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x154], 5
test eax, eax
je 0x4678ea
push 0
push 0
mov ecx, eax
call fcn.00476bc0
jmp 0x4678ec
xor eax, eax
mov dword [esp + 0x154], ebx
mov dword [0x4d36a4], eax
mov eax, dword [0x4d36a0]
or dword [eax + 0xc], 0x40000000
mov eax, dword [fcn.00466500]
mov ecx, dword [fcn.00466540]
mov edx, dword [fcn.00466520]
mov dword [0x4be8b4], eax
mov dword [0x4be8b8], ecx
mov dword [0x4be8bc], edx
call fcn.004785a0
push str.BTK_UNICODE_DISABLED
call fcn.0040c972
add esp, 4
test eax, eax
setne al
mov byte [0x4be404], al
call fcn.00476870
test eax, eax
jne 0x46795f
push eax
call fcn.00476fe0
add esp, 4
test eax, eax
je 0x46795f
mov ecx, eax
call fcn.00456d20
mov ecx, dword [0x4d36ac]
mov edx, dword [ecx + 4]
mov eax, dword [0x4d36a0]
mov dword [eax + 0x1c], edx
mov ecx, dword [0x4d36a8]
mov edx, dword [ecx]
mov eax, dword [0x4d36a0]
mov dword [eax + 0x20], edx
mov ecx, dword [0x4d36a4]
mov edx, dword [ecx]
mov eax, dword [0x4d36a0]
mov dword [eax + 0x14], edx
mov eax, dword [0x4d36a0]
mov ecx, dword [eax + 0x14]
mov dword [eax + 0x70], ecx
call fcn.00467450
push 0x2c
push 0
push 0x4d2eb8
call fcn.004063f0
mov eax, dword [0x4e34cc]
mov edx, dword [0x4e34c8]
mov ecx, dword [0x4e34d0]
mov dword [0x4d2ec0], eax
mov eax, dword [0x4d36a0]
mov dword [0x4d2ecc], edx
mov edx, dword [0x4e34d4]
add esp, 0xc
mov dword [0x4d2ed0], 0x4bec98
mov dword [0x4d2ec4], ecx
mov dword [0x4d2ec8], edx
mov dword [0x4d2ed4], 0x4688c0
mov dword [0x4d2ed8], 0x46fed0
mov dword [0x4d2edc], 0x469bc0
mov dword [0x4d2ee0], 0x470be0
mov dword [0x4d2eb8], 1
test eax, eax
je 0x467a65
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x4d2eb8
push str.rtlcore
push eax
push 0x3ff
call fcn.00466d30
add esp, 0x1c
pop esi
mov dword [0x4be408], eax
mov eax, dword [esp + 4]
pop ebx
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
add esp, 0x150
ret
mov ecx, ebx
mov dword [0x4be408], ecx
mov ecx, dword [esp + 0x14c]
pop esi
mov eax, 0x23
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret