Function at 0x49f090
Capabilities:
Get system information on windows
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
push 0x74
xorps xmm0, xmm0
mov byte [esp + 0x20], 0
push 0
push 0x560cd4
movlpd qword [esp + 0x2c], xmm0
call fcn.004d36e0
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x50]
lea esi, [esp + 0x2c]
mov dword [0x560d34], eax
xor ecx, ecx
xor eax, eax
xor edi, edi
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov esi, 0x53b0d8
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov dword [0x560cd4], eax
mov dword [0x560cd8], ecx
mov dword [0x560cdc], edx
cmp dword [esi + 4], edx
sete dh
cmp dword [esi - 4], eax
sete byte [esp + 0x13]
and dh, byte [esp + 0x13]
mov edx, dword [esp + 0x34]
jne 0x49f133
inc edi
add esi, 0x10
cmp edi, 4
jb 0x49f110
jmp 0x49f141
shl edi, 4
mov eax, dword [edi + 0x53b0d0]
mov dword [0x560d24], eax
mov eax, 1
cmp dword [esp + 0x18], eax
jb 0x49f43e
xor ecx, ecx
lea esi, [esp + 0x2c]
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
mov edx, dword [esp + 0x2c]
mov ecx, edx
shr ecx, 8
mov esi, edx
shr esi, 4
and ecx, 0xf
mov eax, edx
mov dword [0x560d28], ecx
and esi, 0xf
and eax, 0xf
mov dword [0x560d2c], esi
mov dword [0x560d30], eax
cmp ecx, 0xf
jne 0x49f1b5
mov eax, edx
shr eax, 0x14
and eax, 0xff
add eax, ecx
mov dword [0x560d28], eax
mov eax, edx
shr eax, 0xc
and eax, 0xf0
add esi, eax
mov dword [0x560d2c], esi
mov eax, dword [esp + 0x30]
mov esi, dword [0x560d38]
movzx ecx, al
mov dword [0x560d4c], ecx
mov ecx, eax
shr eax, 0x10
shr ecx, 8
and eax, 0xff
shr edx, 0xc
and ecx, 0xff
and edx, 3
shl ecx, 3
mov dword [0x560d54], eax
mov eax, dword [esp + 0x34]
mov dword [0x560d48], edx
mov dword [0x560d50], ecx
test al, 1
je 0x49f209
or esi, 0x100000
mov dword [0x560d38], esi
test al, 2
je 0x49f219
or esi, 0x80000000
mov dword [0x560d38], esi
test al, 8
je 0x49f229
or esi, 0x4000000
mov dword [0x560d38], esi
test eax, 0x200
je 0x49f23c
or esi, 0x200000
mov dword [0x560d38], esi
test eax, 0x2000
je 0x49f24c
or esi, 0x40
mov dword [0x560d38], esi
test eax, 0x80000
je 0x49f25f
or esi, 0x800000
mov dword [0x560d38], esi
test eax, 0x100000
je 0x49f272
or esi, 0x1000000
mov dword [0x560d38], esi
test eax, 0x400000
je 0x49f285
or esi, 0x8000000
mov dword [0x560d38], esi
test eax, 0x800000
je 0x49f298
or esi, 0x10000000
mov dword [0x560d38], esi
test eax, 0x2000000
je 0x49f2ab
or esi, 0x40000000
mov dword [0x560d38], esi
mov edi, dword [0x560d3c]
test eax, 0x4000000
je 0x49f2c1
or edi, 8
mov dword [0x560d3c], edi
test eax, 0x8000000
je 0x49f2d1
or edi, 0x10
mov dword [0x560d3c], edi
test eax, 0x40000000
je 0x49f2e1
or edi, 1
mov dword [0x560d3c], edi
mov ecx, dword [esp + 0x38]
test cl, 0x10
je 0x49f2f3
or esi, 4
mov dword [0x560d38], esi
test ecx, 0x100
je 0x49f304
or esi, 0x20
mov dword [0x560d38], esi
test ecx, 0x8000
je 0x49f315
or esi, 0x10
mov dword [0x560d38], esi
test ecx, 0x80000
je 0x49f329
or esi, 0x80
mov dword [0x560d38], esi
test ecx, 0x800000
je 0x49f33d
or esi, 0x4000
mov dword [0x560d38], esi
test ecx, 0x1000000
je 0x49f351
or esi, 0x1000
mov dword [0x560d38], esi
test ecx, 0x2000000
je 0x49f365
or esi, 0x48000
mov dword [0x560d38], esi
test ecx, 0x4000000
je 0x49f379
or esi, 0xc0000
mov dword [0x560d38], esi
and ecx, 0x10000000
je 0x49f38a
or esi, 2
mov dword [0x560d38], esi
mov edx, dword [esp + 0x50]
cmp edx, 1
jne 0x49f3b1
cmp dword [0x560d24], 2
jne 0x49f3b1
test ecx, ecx
mov dword [esp + 0x14], 2
cmovne edx, dword [esp + 0x14]
mov dword [0x560d34], edx
mov ecx, eax
and ecx, 0xc000000
cmp ecx, 0xc000000
jne 0x49f3d0
mov eax, dword [esp + 0x34]
xor ecx, ecx
xgetbv
mov dword [esp + 0x24], edx
jmp 0x49f3d4
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
test eax, 0x10000000
je 0x49f44c
and ecx, 6
cmp cl, 6
jne 0x49f44c
or edi, 0x20
mov dword [0x560d3c], edi
test eax, 0x800
je 0x49f403
or edi, 0x400
mov dword [0x560d3c], edi
test eax, 0x4000
je 0x49f416
or edi, 0x100
mov dword [0x560d3c], edi
test eax, 0x10000
je 0x49f429
or edi, 0x200
mov dword [0x560d3c], edi
test eax, 0x20000000
je 0x49f44c
or edi, 0x80
mov dword [0x560d3c], edi
jmp 0x49f44c
mov eax, dword [esp + 0x20]
mov esi, dword [0x560d38]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x18], 7
jb 0x49f5ff
xor ecx, ecx
lea edi, [esp + 0x2c]
mov eax, 7
cpuid
mov dword [edi], eax
mov eax, edi
mov edi, dword [0x560d3c]
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x30]
test al, 1
je 0x49f48b
or edi, 0x20000
mov dword [0x560d3c], edi
test al, 8
je 0x49f49b
or edi, 0x800
mov dword [0x560d3c], edi
test al, 0x10
je 0x49f4ab
or edi, 0x2000
mov dword [0x560d3c], edi
test eax, 0x100
je 0x49f4be
or edi, 0x1000
mov dword [0x560d3c], edi
test eax, 0x200
je 0x49f4d1
or edi, 0x40000
mov dword [0x560d3c], edi
test eax, 0x800
je 0x49f4e4
or edi, 0x4000
mov dword [0x560d3c], edi
mov edx, dword [esp + 0x1c]
test eax, 0x4000
movzx edx, dl
mov ecx, 1
cmovne edx, ecx
test eax, 0x40000
je 0x49f508
or edi, 2
mov dword [0x560d3c], edi
test eax, 0x80000
je 0x49f51b
or edi, 0x8000
mov dword [0x560d3c], edi
test eax, 0x800000
je 0x49f52e
or esi, 0x100
mov dword [0x560d38], esi
test eax, 0x20000000
je 0x49f53e
or edi, 4
mov dword [0x560d3c], edi
test byte [esp + 0x34], cl
je 0x49f550
or esi, 0x400
mov dword [0x560d38], esi
mov ecx, edi
shr ecx, 5
test cl, 1
je 0x49f567
test al, 0x20
je 0x49f567
or edi, 0x40
mov dword [0x560d3c], edi
test eax, 0x10000
je 0x49f603
mov ecx, dword [esp + 0x14]
and ecx, 0x76
cmp cl, 0x76
jne 0x49f603
or edi, 0x80000
mov dword [0x560d3c], edi
test eax, 0x20000
je 0x49f5a1
or edi, 0x800000
mov dword [0x560d3c], edi
test eax, 0x4000000
je 0x49f5b4
or edi, 0x200000
mov dword [0x560d3c], edi
test eax, 0x8000000
je 0x49f5c7
or edi, 0x400000
mov dword [0x560d3c], edi
test eax, 0x10000000
je 0x49f5da
or edi, 0x100000
mov dword [0x560d3c], edi
test eax, 0x40000000
je 0x49f5ed
or edi, 0x1000000
mov dword [0x560d3c], edi
test eax, eax
jns 0x49f603
or edi, 0x2000000
mov dword [0x560d3c], edi
jmp 0x49f603
mov edx, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0xd
jb 0x49f641
test dl, dl
je 0x49f641
xor ecx, ecx
lea edi, [esp + 0x2c]
mov eax, 0xd
cpuid
mov dword [edi], eax
mov eax, edi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x14]
and eax, dword [esp + 0x2c]
and eax, 0x18
cmp al, 0x18
jne 0x49f641
or dword [0x560d3c], 0x10000
xor ecx, ecx
lea edi, [esp + 0x2c]
mov eax, closesocket
cpuid
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov ecx, closesocket
mov dword [edi + 0xc], edx
mov edx, 0x80000004
mov eax, dword [esp + 0x2c]
mov edi, 0x560ce4
cmp eax, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
cmovb edx, eax
mov dword [esp + 0x14], edx
cmp edx, ecx
jb 0x49f7bb
mov eax, ecx
lea edi, [esp + 0x2c]
xor ecx, ecx
cpuid
mov dword [edi], eax
mov eax, edi
mov edi, dword [esp + 0x1c]
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], edx
cmp ecx, 0x80000001
je 0x49f6e8
lea eax, [ecx + 0x7ffffffe]
cmp eax, 2
ja 0x49f7ac
mov eax, dword [esp + 0x2c]
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 4], eax
mov eax, dword [esp + 0x34]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x38]
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [0x560d38]
mov dword [esp + 0x1c], edi
jmp 0x49f7ac
mov eax, dword [esp + 0x34]
test al, 1
je 0x49f6fc
or esi, 0x800
mov dword [0x560d38], esi
test al, 0x20
je 0x49f70c
or esi, 0x20000000
mov dword [0x560d38], esi
test al, 0x40
je 0x49f71c
or esi, 0x400000
mov dword [0x560d38], esi
test al, al
jns 0x49f72c
or esi, 0x2000000
mov dword [0x560d38], esi
test eax, 0x100
je 0x49f73f
or esi, 0x200
mov dword [0x560d38], esi
mov eax, dword [esp + 0x38]
test eax, 0x100000
je 0x49f753
or esi, 1
mov dword [0x560d38], esi
test eax, 0x200000
je 0x49f766
or esi, 0x2000
mov dword [0x560d38], esi
test eax, 0x400000
je 0x49f779
or esi, 0x8000
mov dword [0x560d38], esi
test eax, 0x8000000
je 0x49f789
or esi, 8
mov dword [0x560d38], esi
test eax, 0x40000000
je 0x49f79c
or esi, 0x28000
mov dword [0x560d38], esi
test eax, eax
jns 0x49f7ac
or esi, 0x10000
mov dword [0x560d38], esi
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [esp + 0x14]
jbe 0x49f685
mov al, byte [0x560ce4]
xor ah, ah
mov byte [esp + 0x13], ah
mov ecx, 0x560ce4
mov byte [0x560ce4], ah
mov edx, ecx
test al, al
je 0x49f806
cmp al, 0x20
jne 0x49f7ec
cmp ah, 0x40
je 0x49f7fb
mov ah, byte [ecx + 1]
cmp ah, al
je 0x49f7f7
cmp ah, 0x40
je 0x49f7f7
mov ah, al
mov byte [edx], al
inc edx
mov byte [esp + 0x13], ah
jmp 0x49f7fb
mov ah, byte [esp + 0x13]
mov al, byte [ecx + 1]
inc ecx
mov byte [ecx], 0
test al, al
jne 0x49f7d7
pop edi
pop esi
mov byte [edx], 0
pop ebx
mov esp, ebp
pop ebp
ret