Function at 0x100022e0
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100d9140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [edx]
xorps xmm0, xmm0
push esi
mov esi, ecx
mov dword [ebp - 0x54], edx
push edi
mov dword [ebp - 0x68], esi
cmp eax, dword [edx + 4]
jne 0x10002375
movzx eax, byte [0x10064139]
lea ecx, [ebp - 0xc]
push eax
push dword [ebx + 8]
xor edx, edx
movlpd qword [ebp - 0xc], xmm0
call fcn.10003eb0
add esp, 8
mov eax, esi
cmp byte [ebp - 8], 0
je 0x1000235b
mov ecx, dword [ebp - 0xc]
mov dword [esi], ecx
mov byte [esi + 4], 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov byte [esi], 0
mov byte [esi + 4], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034fda
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x50]
movaps xmmword [ebp - 0x50], xmm0
push eax
movaps xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x48]
mov edi, dword [ebx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov eax, ecx
sub eax, esi
mov dword [ebp - 0x58], ecx
sub dword [ebp - 0x58], edi
cmp eax, edi
mov eax, dword [ebp - 0x58]
cmovbe eax, esi
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x60], eax
sub eax, ecx
cmp eax, edi
jbe 0x100023c2
lea eax, [ecx + edi]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x58]
cmp eax, esi
cmovb eax, esi
mov esi, dword [ebp - 0x60]
cmp dword [ebp - 0x44], esi
mov dword [ebp - 0x58], eax
cmovb esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x60], esi
lea esi, [eax - 1]
dec eax
add ecx, eax
not esi
and ecx, esi
mov dword [ebp - 0x6c], esi
mov eax, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x64], ecx
cmp ecx, dword [ebp - 0x58]
jbe 0x10002510
mov si, word [ebp - 6]
mov dword [ebp - 0x14], edi
mov edi, dword [edx]
mov dword [ebp - 8], eax
cmp edi, dword [edx + 4]
je 0x10002435
nop dword [eax]
mov ecx, dword [edi]
mov edx, ecx
sub edx, eax
sub eax, ecx
cmp dword [ebp - 0x64], ecx
cmovbe eax, edx
cmp eax, dword [ebx + 0xc]
ja 0x10002507
mov eax, dword [ebp - 0x54]
add edi, 4
cmp edi, dword [eax + 4]
mov eax, dword [ebp - 0x64]
jne 0x10002410
push 0x1c
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x38], 0
xorps xmm0, xmm0
push ecx
push eax
movaps xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10002507
mov ecx, dword [ebp - 0x3c]
mov edx, ecx
and dl, 0x70
mov word [ebp - 0x72], si
neg dl
sbb dl, dl
and dl, 4
test cl, 0x66
setne al
and cl, 0x44
or dl, al
neg cl
sbb cl, cl
and cl, 2
or dl, cl
cmp dword [ebp - 0x40], 0x10000
mov byte [ebp - 0x74], dl
sete al
mov byte [ebp - 0x73], al
mov eax, dword [ebp - 0x74]
shr eax, 8
test al, al
je 0x100024e2
push dword [ebx + 0xc]
mov edi, dword [ebp - 0x64]
mov ecx, edi
mov edx, dword [ebp - 0x54]
call fcn.10002640
add esp, 4
test al, al
je 0x100024e2
movzx eax, byte [0x10064139]
lea ecx, [ebp - 0xc]
push eax
push dword [ebx + 8]
xorps xmm0, xmm0
mov edx, edi
movlpd qword [ebp - 0xc], xmm0
call fcn.10003eb0
add esp, 8
cmp byte [ebp - 8], 0
je 0x100024e2
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x100024f9
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
dec eax
and eax, dword [ebp - 0x6c]
mov dword [ebp - 0x64], eax
cmp eax, dword [ebp - 0x58]
jbe 0x1000250a
jmp 0x10002402
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov byte [ecx + 4], 1
jmp 0x10002629
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebx + 0xc]
cmp ecx, dword [ebp - 0x60]
jae 0x1000261f
mov dword [ebp - 8], edi
mov si, word [ebp - 6]
mov eax, dword [edx]
mov dword [ebp - 0x14], ecx
cmp eax, dword [edx + 4]
je 0x10002557
nop word [eax + eax]
mov edx, dword [eax]
mov edi, edx
sub edi, ecx
sub ecx, edx
cmp dword [ebp - 0x5c], edx
cmovbe ecx, edi
mov edi, dword [ebx + 0xc]
cmp ecx, edi
ja 0x1000261f
mov ecx, dword [ebp - 0x54]
add eax, 4
cmp eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x5c]
jne 0x10002530
push 0x1c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x38], 0
xorps xmm0, xmm0
push eax
push ecx
movaps xmmword [ebp - 0x50], xmm0
movq qword [ebp - 0x40], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000261f
mov ecx, dword [ebp - 0x3c]
mov edx, ecx
and dl, 0x70
mov word [ebp - 0x72], si
neg dl
sbb dl, dl
and dl, 4
test cl, 0x66
setne al
and cl, 0x44
or dl, al
neg cl
sbb cl, cl
and cl, 2
or dl, cl
cmp dword [ebp - 0x40], 0x10000
mov byte [ebp - 0x74], dl
sete al
mov byte [ebp - 0x73], al
mov eax, dword [ebp - 0x74]
shr eax, 8
test al, al
je 0x10002606
mov edx, dword [ebp - 0x54]
push edi
mov edi, dword [ebp - 0x5c]
mov ecx, edi
call fcn.10002640
add esp, 4
test al, al
je 0x10002606
movzx eax, byte [0x10064139]
lea ecx, [ebp - 0x18]
push eax
push dword [ebx + 8]
xorps xmm0, xmm0
mov edx, edi
movlpd qword [ebp - 0x18], xmm0
call fcn.10003eb0
add esp, 8
cmp byte [ebp - 0x14], 0
je 0x10002606
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x100024f9
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x44]
mov dword [ebp - 0x5c], ecx
cmp ecx, dword [ebp - 0x60]
jae 0x1000261f
mov edi, dword [ebx + 0xc]
mov edx, dword [ebp - 0x54]
jmp 0x10002520
mov ecx, dword [ebp - 0x68]
mov byte [ecx], 1
mov byte [ecx + 4], 0
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10034fda
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret