Function at 0x40e640
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov dword [0x46ecbc], 0x4658a0
mov dword [0x46ecb8], edx
call fcn.0040ea40
push 0x2c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004233f0
add esp, 0xc
mov dword [0x46ecc4], 0x11000
lea eax, [esp + 0x20]
mov dword [0x46ecc8], 0xffffffff
mov ebx, 1
mov dword [0x46eccc], 0x10000
mov dword [0x46ecd0], 0x10000
push 0
push 0x2c
push eax
push 0
mov dword [0x46ecd4], 0xffff
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp dword [0x46dad8], 0x3e
movzx eax, word [esp + 0x28]
mov word [0x46ecc4], ax
movsx eax, byte [esp + 0x48]
mov word [0x46ecc6], ax
mov eax, dword [esp + 0x2c]
mov dword [0x46ecc8], eax
mov eax, dword [esp + 0x38]
mov dword [0x46eccc], eax
mov eax, dword [esp + 0x40]
mov dword [0x46ecd0], eax
mov eax, dword [esp + 0x44]
mov dword [0x46ecd4], eax
jb 0x40e725
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46ecc0], eax
jmp 0x40e72a
mov eax, dword [0x46ecc0]
test eax, eax
jne 0x40e76b
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46ecc0], eax
test eax, eax
je 0x40ea09
push 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x46efdc
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
nop
test eax, eax
js 0x40ea09
mov ax, bx
cmp ax, word [0x46ecc6]
sbb eax, eax
and eax, 0xfa0
mov dword [0x46dfec], eax
mov eax, 0x46f458
test al, 7
jne 0x40e9fe
mov eax, 0x46f440
xorps xmm0, xmm0
movlpd qword [0x46f458], xmm0
test al, 7
jne 0x40e9fe
lea eax, [esp + 0x20]
movq qword [0x46f440], xmm0
mov edx, eax
mov dword [0x46f448], 0
mov ecx, 0x28
mov dword [0x46f44c], 0x200
mov dword [0x46f450], 0x38
movups xmmword [esp + 0x20], xmm0
mov dword [0x46eca4], eax
movups xmmword [esp + 0x30], xmm0
mov dword [0x46f040], eax
movq qword [esp + 0x40], xmm0
call fcn.00406000
mov esi, eax
mov edx, ebx
xor eax, eax
mov word [esi], ax
lock xadd dword [0x46eca8], edx
inc edx
dec dl
mov dword [esi + 8], eax
movzx eax, dl
mov ecx, 0x28
mov byte [esi + 2], dl
mov dword [esi + 0xc], str.Type
mov dword [0x46eca4], esi
mov dword [eax*4 + 0x46f040], esi
movzx eax, dl
mov edx, esi
mov word [esi - 8], ax
mov dword [esi + 4], ebx
call fcn.00406000
mov edx, eax
mov ecx, ebx
xor eax, eax
mov word [edx], ax
lock xadd dword [0x46eca8], ecx
inc ecx
dec cl
mov dword [edx + 4], eax
mov dword [edx + 8], eax
movzx eax, cl
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Alloc
mov dword [eax*4 + 0x46f040], edx
call fcn.00407b40
mov dword [0x46ee30], eax
nop word [eax + eax]
cmp eax, 0xffffffff
je 0x40ea09
call fcn.00406500
test al, al
je 0x40ea09
cmp byte [0x7ffe03c4], bl
jne 0x40e8d4
mov eax, dword [0x7ffe03c0]
dec eax
cmp eax, 0x1f
ja 0x40e8d4
mov byte [0x46ecd8], bl
jmp 0x40e9d6
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea edx, [esp + 0x18]
call fcn.00411600
test eax, eax
js 0x40e9cf
mov ebp, dword [esp + 0x14]
xor eax, eax
movzx ebx, word [ebp + 0xa]
mov dword [esp + 0x14], ebx
movzx edi, bx
cmp ax, bx
jae 0x40e9bb
mov si, word [esp + 0x18]
lea ecx, [ebp + 0x21]
mov edx, edi
movzx eax, byte ds:[ecx]
lea ecx, [ecx + 0x2c]
add si, ax
sub edx, 1
jne 0x40e916
cmp ebx, 1
jbe 0x40e9bb
lea eax, ds:[edi + edi]
push eax
push 4
lfence
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea edx, [ebp + 0x21]
mov dword [0x46ece0], ebx
xor ecx, ecx
movzx eax, si
lea edx, [edx + 0x2c]
mov dword [esp + 0x18], eax
lea ecx, [ecx + 2]
movzx eax, byte [edx - 0x2c]
mov word [ecx + ebx - 2], ax
sub edi, 1
je 0x40e976
mov ebx, dword [0x46ece0]
jmp 0x40e953
push ebp
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x18]
test ax, ax
je 0x40e9ca
mov word [0x46ecda], ax
mov eax, dword [esp + 0x14]
mov word [0x46ecdc], ax
xor eax, eax
mov byte [0x46ecd8], 0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00421733
add esp, 0x4c
ret
push ebp
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, 1
mov byte [0x46ecd8], 1
mov ax, word [0x46ecc6]
mov word [0x46ecda], ax
xor eax, eax
mov word [0x46ecdc], bx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00421733
add esp, 0x4c
ret
push 0x80000002
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [esp + 0x54]
mov eax, 0xc0000001
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421733
add esp, 0x4c
ret