Function at 0x4b2f60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x655830
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x49c], 0
jne 0x4b2fa4
lea ecx, [esi + 0x498]
call fcn.004d8220
lea ecx, [esi + 0x4b0]
call fcn.004d9de0
mov edx, dword [esi + 0x57c]
mov ecx, dword [esi + 0x460]
mov byte [ebp - 0x71], al
mov edi, dword [edx]
push dword [ecx + 0x7c]
mov ecx, edx
call dword [edi + 0x40]
mov ecx, dword [esi + 0x580]
mov eax, dword [esi + 0x460]
mov edx, dword [ecx]
push dword [eax + 0x7c]
call dword [edx + 0x40]
mov edi, dword [esi + 0x558]
mov ecx, edi
push 0xffffffffffffffff
mov eax, dword [edi]
call dword [eax + 0x104]
mov ecx, dword [edi + 0x264]
call fcn.0056e330
mov eax, dword [esi + 0x558]
mov edi, dword [eax + 0x264]
test edi, edi
je 0x4b309d
push 0
push 0xffffffffffffffff
push 0x6aa980
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push 0x6af2b8
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push 0x6af2c0
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.700M___CD
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.4092M___FAT
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.4480M___DVD
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.8128M___DVD_DL
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.23040M___BD
mov ecx, edi
call fcn.0056e233
push 0
push 0xffffffffffffffff
push str.1457664___3.5__floppy
mov ecx, edi
call fcn.0056e233
lea ecx, [esi + 0x400]
call fcn.004524c0
xor ebx, ebx
lea ecx, [esi + 4]
cmp byte [esi + 0x404], bl
push 0xffffffffffffffff
push str.check_show_password
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b30d8
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b30f3
push 0xffffffffffffffff
push str.check_show_password
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
xor ebx, ebx
lea ecx, [esi + 4]
cmp byte [esi + 0x405], bl
push 0xffffffffffffffff
push str.check_encrypt_file_name
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b312b
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b3146
push 0xffffffffffffffff
push str.check_encrypt_file_name
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
add eax, 0x60
cmp byte [eax + 1], 0
jne 0x4b316e
cmp byte [esi + 0x433], 0
je 0x4b316e
mov al, byte [esi + 0x432]
jmp 0x4b3170
mov al, byte [eax]
xor ebx, ebx
lea ecx, [esi + 4]
test al, al
push 0xffffffffffffffff
push str.check_symbol_link
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b319c
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b31b7
push 0xffffffffffffffff
push str.check_symbol_link
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
add eax, 0x62
cmp byte [eax + 1], 0
jne 0x4b31df
cmp byte [esi + 0x431], 0
je 0x4b31df
mov al, byte [esi + 0x430]
jmp 0x4b31e1
mov al, byte [eax]
xor ebx, ebx
lea ecx, [esi + 4]
test al, al
push 0xffffffffffffffff
push str.check_hard_link
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b320d
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b3228
push 0xffffffffffffffff
push str.check_hard_link
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
add eax, 0x64
cmp byte [eax + 1], 0
jne 0x4b3250
cmp byte [esi + 0x42f], 0
je 0x4b3250
mov al, byte [esi + 0x42e]
jmp 0x4b3252
mov al, byte [eax]
xor ebx, ebx
lea ecx, [esi + 4]
test al, al
push 0xffffffffffffffff
push str.check_file_streams
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b327e
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b3299
push 0xffffffffffffffff
push str.check_file_streams
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
add eax, 0x66
cmp byte [eax + 1], 0
jne 0x4b32c1
cmp byte [esi + 0x42d], 0
je 0x4b32c1
mov al, byte [esi + 0x42c]
jmp 0x4b32c3
mov al, byte [eax]
xor ebx, ebx
lea ecx, [esi + 4]
test al, al
push 0xffffffffffffffff
push str.check_file_security
setne bl
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b32ef
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b330a
push 0xffffffffffffffff
push str.check_file_security
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push ebx
mov ecx, edi
call fcn.005576b8
mov ecx, esi
call fcn.004b4640
mov edi, dword [esi + 0x54c]
mov ecx, edi
push 0xffffffffffffffff
mov eax, dword [edi]
call dword [eax + 0x104]
mov ecx, dword [edi + 0x264]
call fcn.0056e330
mov eax, dword [esi + 0x54c]
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov eax, dword [eax + 0x264]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x460]
mov eax, dword [eax + 0x78]
shr eax, 0x1f
mov dword [ebp - 0x78], eax
cmp dword [esi + 0x458], ecx
jbe 0x4b351e
nop dword [eax + eax]
mov eax, dword [esi + 0x454]
mov edx, 0x6b134c
mov dword [ebp - 0x7c], 0
or edi, 0xffffffff
mov ebx, dword [eax + ecx*4]
mov eax, dword [esi + 0x450]
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x80], eax
mov ecx, dword [eax + 0xc]
call fcn.0049ea70
test al, al
je 0x4b33b2
mov ecx, dword [esi + 0x55c]
push ebx
call fcn.0055785f
xor edi, edi
jmp 0x4b3404
mov ecx, dword [ebp - 0x80]
mov edx, 0x6ac1bc
mov ecx, dword [ecx + 0xc]
call fcn.0049ea70
test al, al
je 0x4b33d9
mov ecx, dword [esi + 0x560]
push ebx
call fcn.0055785f
mov edi, 1
jmp 0x4b3404
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x88]
push 0
push 0xffffffffffffffff
push dword [eax + 0xc]
call fcn.0056e233
mov ecx, dword [esi + 0x54c]
push ebx
push eax
mov dword [ebp - 0x7c], eax
mov ecx, dword [ecx + 0x264]
call fcn.0056fd60
cmp byte [ebp - 0x71], 0
je 0x4b3418
cmp ebx, dword [esi + 0x4b0]
jne 0x4b3505
jmp 0x4b347b
cmp byte [ebp - 0x78], 0
jne 0x4b3459
mov eax, dword [esi + 0x460]
cmp dword [eax + 0x78], ebx
jne 0x4b3505
test edi, edi
je 0x4b347f
push 1
cmp edi, 1
je 0x4b34af
mov ecx, dword [esi + 0x564]
call fcn.005576b8
mov ecx, dword [esi + 0x54c]
push dword [ebp - 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x104]
jmp 0x4b34fb
cmp dword [ebp - 0x84], 0
je 0x4b347b
mov eax, dword [ebp - 0x80]
mov edx, dword [esi + 0x408]
mov ecx, dword [eax + 0xc]
call fcn.0049ea70
test al, al
je 0x4b3505
test edi, edi
jne 0x4b34a8
mov ecx, dword [esi + 0x55c]
push 1
call fcn.005576b8
mov ecx, dword [esi + 0x54c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x104]
mov dword [esi + 0x594], 0
jmp 0x4b3505
push 1
cmp edi, 1
jne 0x4b34d6
mov ecx, dword [esi + 0x560]
call fcn.005576b8
mov ecx, dword [esi + 0x54c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x104]
mov dword [esi + 0x594], 1
jmp 0x4b3505
mov ecx, dword [esi + 0x564]
call fcn.005576b8
mov ecx, dword [esi + 0x54c]
push dword [ebp - 0x7c]
mov eax, dword [ecx]
call dword [eax + 0x104]
mov eax, dword [esi + 0x460]
mov dword [eax + 0x78], ebx
mov dword [esi + 0x594], 2
mov ecx, dword [ebp - 0x84]
inc ecx
mov dword [ebp - 0x84], ecx
cmp ecx, dword [esi + 0x458]
jb 0x4b3370
mov ecx, dword [esi + 0x564]
call fcn.00555733
test eax, eax
jne 0x4b354f
mov ecx, dword [esi + 0x54c]
mov eax, dword [ecx]
call dword [eax + 0xfc]
test eax, eax
jns 0x4b354f
mov ecx, dword [esi + 0x54c]
push 0
mov eax, dword [ecx]
call dword [eax + 0x104]
push 8
call fcn.00545b74
xor ecx, ecx
mov dword [ebp - 0x1c], eax
add esp, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 3
mov word [eax], cx
push 1
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], ecx
push eax
mov eax, dword [esi + 0x460]
mov ecx, esi
add eax, 0x68
push eax
call fcn.004b4a80
lea eax, [esi + 0x438]
mov edx, 2
lea ebx, [esi + 0x444]
cmp eax, ebx
je 0x4b35ed
mov eax, dword [eax + 4]
mov dword [ebp - 0x78], eax
cmp eax, dword [ebx + 8]
jbe 0x4b35d2
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov edi, eax
push dword [ebx]
call fcn.00545b61
mov eax, dword [ebp - 0x78]
add esp, 4
mov dword [ebx], edi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
lea eax, [eax*2 + 2]
push eax
push dword [esi + 0x438]
push dword [ebx]
call fcn.005e0850
add esp, 0xc
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004b4bf0
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.00545b61
add esp, 4
mov ecx, esi
call fcn.004b5160
mov eax, dword [esi + 0x548]
mov ebx, dword [eax + 0x264]
test ebx, ebx
je 0x4b3a2b
xor edi, edi
cmp dword [esi + 0x418], edi
jbe 0x4b3654
nop
cmp edi, 0x14
jae 0x4b3654
mov eax, dword [esi + 0x414]
mov ecx, ebx
push 0
push 0xffffffffffffffff
mov eax, dword [eax + edi*4]
push dword [eax]
call fcn.0056e233
inc edi
cmp edi, dword [esi + 0x418]
jb 0x4b3630
mov ecx, dword [esi + 0x554]
mov eax, dword [ecx]
call dword [eax + 0x100]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x4b36ae
nop word [eax + eax]
mov ecx, dword [esi + 0x554]
push dword [edi*4 + 0x692358]
push edi
mov ecx, dword [ecx + 0x264]
call fcn.0056fd60
mov ecx, dword [esi + 0x460]
mov eax, dword [edi*4 + 0x692358]
cmp eax, dword [ecx]
jne 0x4b36a9
mov ecx, dword [esi + 0x554]
push edi
mov eax, dword [ecx]
call dword [eax + 0x104]
inc edi
cmp edi, ebx
jl 0x4b3670
mov eax, dword [esi + 0x460]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4b36ed
push 0xffffffffffffffff
push str.radio_relate_path
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b36e4
mov eax, dword [edi]
mov ecx, edi
push str.radio
call dword [eax + 4]
test eax, eax
jne 0x4b3765
push 0xffffffffffffffff
push str.radio_relate_path
jmp 0x4b3751
cmp eax, 2
jne 0x4b3720
push 0xffffffffffffffff
push str.radio_abs_path
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b3717
mov eax, dword [edi]
mov ecx, edi
push str.radio
call dword [eax + 4]
test eax, eax
jne 0x4b3765
push 0xffffffffffffffff
push str.radio_abs_path
jmp 0x4b3751
cmp eax, 1
jne 0x4b376e
push 0xffffffffffffffff
push str.radio_full_path
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b374a
mov eax, dword [edi]
mov ecx, edi
push str.radio
call dword [eax + 4]
test eax, eax
jne 0x4b3765
push 0xffffffffffffffff
push str.radio_full_path
push str.radio
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push 1
mov ecx, edi
call fcn.005576b8
mov ecx, esi
call fcn.004b62c0
mov ecx, esi
call fcn.004b6580
push 0x4e
lea eax, [ebp - 0x6e]
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x98]
xor edi, edi
cmp ebx, 0xa
jb 0x4b37cc
mov eax, 0xcccccccd
mul ebx
shr edx, 3
mov al, dl
mov cl, dl
shl al, 2
add cl, al
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [ebp + edi - 0x20], bl
mov ebx, edx
inc edi
cmp ebx, 0xa
jae 0x4b37a6
lea eax, [ebx + 0x30]
mov word [ebp - 0x70], ax
lea ecx, [ebp - 0x6e]
test edi, edi
je 0x4b37f0
nop word [eax + eax]
movzx eax, byte [ebp + edi - 0x21]
dec edi
mov word [ecx], ax
add ecx, 2
test edi, edi
jne 0x4b37e0
xor eax, eax
xor edi, edi
mov word [ecx], ax
cmp word [ebp - 0x70], ax
je 0x4b3808
nop dword [eax]
inc edi
cmp word [ebp + edi*2 - 0x70], ax
jne 0x4b3800
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [edi*2 + 2]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
push ecx
lea ecx, [ebp - 0x70]
push ecx
push eax
call fcn.005e0850
add esp, 0xc
mov dword [ebp - 4], 1
xor ebx, ebx
nop dword [eax + eax]
inc ebx
cmp word [ebx*2 + 0x6b1354], 0
jne 0x4b3850
test ebx, ebx
je 0x4b387c
lea ecx, [ebx + edi]
mov eax, ecx
add ecx, 0x10
shr eax, 1
add eax, ecx
lea ecx, [ebp - 0x1c]
and eax, 0xfffffff0
dec eax
push eax
call fcn.0049f070
mov edi, dword [ebp - 0x18]
lea eax, [ebx*2 + 2]
push eax
mov eax, dword [ebp - 0x1c]
push 0x6b1354
lea eax, [eax + edi*2]
push eax
call fcn.005e0850
add esp, 0xc
lea ecx, [esi + 4]
add edi, ebx
mov dword [ebp - 0x18], edi
push 0xffffffffffffffff
push str.text_num_cpu
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b38c2
mov edx, dword [edi]
mov ecx, edi
push 0x6ad160
call dword [edx + 4]
test eax, eax
jne 0x4b38dd
push 0xffffffffffffffff
push str.text_num_cpu
push 0x6ad160
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
mov eax, dword [edi]
mov ecx, edi
mov ebx, dword [ebp - 0x1c]
push ebx
call dword [eax + 0x40]
mov eax, dword [esi + 0x460]
xor ecx, ecx
push 0xffffffffffffffff
push str.check_create_sfx
cmp byte [eax + 0x5c], cl
setne cl
mov dword [ebp - 0x78], ecx
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b391e
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b3939
push 0xffffffffffffffff
push str.check_create_sfx
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push dword [ebp - 0x78]
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
xor ecx, ecx
push 0xffffffffffffffff
push str.check_compress_share_file
cmp byte [eax + 0x5d], cl
setne cl
mov dword [ebp - 0x78], ecx
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b3979
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b3994
push 0xffffffffffffffff
push str.check_compress_share_file
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push dword [ebp - 0x78]
mov ecx, edi
call fcn.005576b8
mov eax, dword [esi + 0x460]
xor ecx, ecx
push 0xffffffffffffffff
push str.check_delete_after_compress
cmp byte [eax + 0x5e], cl
setne cl
mov dword [ebp - 0x78], ecx
lea ecx, [esi + 4]
call fcn.00554534
mov edi, eax
test edi, edi
je 0x4b39d4
mov eax, dword [edi]
mov ecx, edi
push 0x6ae180
call dword [eax + 4]
test eax, eax
jne 0x4b39ef
push 0xffffffffffffffff
push str.check_delete_after_compress
push 0x6ae180
push str.FindChildByName2_Failed__no_window_of_class___s__with_name_of___s__was_found_within___d__levels
call fcn.00414520
add esp, 0x10
xor edi, edi
push dword [ebp - 0x78]
mov ecx, edi
call fcn.005576b8
mov ecx, esi
call fcn.004b6bb0
mov ecx, esi
call fcn.004b7150
mov ecx, esi
call fcn.004b9410
mov ecx, esi
call fcn.004b7940
cmp byte [ebp - 0x71], 0
je 0x4b3a22
mov ecx, esi
call fcn.004b3a50
push ebx
call fcn.00545b61
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret