Function at 0x10002c7d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x1001d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x6e
mov dword [ebp - 0x88], eax
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
pop eax
push 0x74
mov word [ebp - 0x2c], ax
pop eax
push 0x64
mov word [ebp - 0x2a], ax
pop eax
push 0x6c
pop esi
push 0x2e
pop ecx
push 0x65
pop edx
push 0x72
movaps xmm0, xmmword [0x1001aa20]
mov word [ebp - 0x28], ax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x22], cx
pop ecx
push 0x73
mov word [ebp - 0x1a], ax
pop eax
push 0x6b
mov byte [ebp - 0x4f], al
pop eax
push 0x6e
mov byte [ebp - 0x50], cl
mov word [ebp - 0x14], cx
pop ecx
push 0x33
mov word [ebp - 0x18], ax
pop eax
mov word [ebp - 0xc], ax
push 0x32
pop eax
mov word [ebp - 0xa], ax
xor eax, eax
mov word [ebp - 8], ax
mov byte [ebp - 0x65], al
lea eax, [ebp - 0x2c]
movups xmmword [ebp - 0x64], xmm0
push eax
movaps xmm0, xmmword [str.GetNativeSystemIRtlGetNtVersionN_02X_02X_02X_02X_08X_04X_04X_02X]
mov word [ebp - 0x26], si
mov word [ebp - 0x24], si
mov word [ebp - 0x1e], si
mov word [ebp - 0x1c], si
mov word [ebp - 0x54], 0x6d75
mov byte [ebp - 0x52], 0x62
mov byte [ebp - 0x51], dl
mov byte [ebp - 0x4e], bl
mov word [ebp - 0x16], dx
mov word [ebp - 0x12], cx
mov word [ebp - 0x10], dx
mov word [ebp - 0xe], si
movups xmmword [ebp - 0x78], xmm0
mov byte [ebp - 0x68], cl
mov word [ebp - 0x67], 0x6f66
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10002d98
lea eax, [ebp - 0x64]
push eax
push esi
call edi
test eax, eax
je 0x10002d91
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x84]
push ecx
call eax
movzx eax, word [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call edi
test eax, eax
je 0x10002db8
lea ecx, [ebp - 0xac]
push ecx
call eax
jmp 0x10002dc5
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0xac], 9
je 0x10002dd9
cmp word [ebp - 0xac], 6
jne 0x10002ddc
xor ebx, ebx
inc ebx
mov edx, dword [ebp - 0x88]
xor eax, eax
push 8
pop ecx
push 0x25
mov edi, edx
rep stosd dword es:[edi], eax
pop ecx
push 0x64
pop eax
push 0x2e
pop esi
push 0x28
mov word [ebp - 0x4a], ax
mov word [ebp - 0x44], ax
mov word [ebp - 0x3e], ax
pop eax
push 0x73
mov word [ebp - 0x3c], ax
pop eax
push 0x29
mov word [ebp - 0x38], ax
pop eax
mov word [ebp - 0x36], ax
xor eax, eax
mov word [ebp - 0x34], ax
test ebx, ebx
mov dword [ebp - 0x32], eax
mov word [ebp - 0x2e], ax
mov eax, 0x1001a9a8
mov word [ebp - 0x4c], cx
mov word [ebp - 0x46], cx
mov word [ebp - 0x40], cx
mov word [ebp - 0x3a], cx
mov ecx, 0x1001a9b0
cmove eax, ecx
mov word [ebp - 0x48], si
push eax
push dword [ebp - 0x7c]
lea eax, [ebp - 0x4c]
mov word [ebp - 0x42], si
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push eax
push 0x10
push edx
call fcn.10001026
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1000423e
mov esp, ebp
pop ebp
ret 8