Function at 0x100d3c6
Capabilities:
Get system information on windows

Disassembly:
push 0x50
push 0x100d900
call fcn.010015a0
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
inc ebx
mov dword [0x10401b4], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], edi
push 0x43c
push edi
push 0x10403b8
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
lea ecx, [ebp - 0x60]
call fcn.01002827
mov dword [ebp - 4], edi
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov esi, 0x1040398
push esi
call fcn.01010dbe
mov dword [0x10401b0], 0x100d8c8
mov dword [0x1040184], esi
push 0x100d8d8
call fcn.0101134b
mov dword [0x10401b4], 2
push edi
push 4
lea eax, [ebp - 0x48]
push eax
push 9
pop esi
push esi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x100d473
mov eax, dword [ebp - 0x48]
shr eax, 0x18
and eax, 4
push eax
push ebx
call fcn.010015ea
push 0x100d854
call fcn.01010e2d
call fcn.01011a91
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a888
mov dword [0x10401b4], 3
call fcn.01011165
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a8c6
mov dword [0x10401b4], 4
call fcn.01010cd9
test eax, eax
je 0x101a8f6
mov dword [0x10401b4], 5
call fcn.01010cb5
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a940
mov dword [0x10401b4], 6
call fcn.01010ff0
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a97f
mov dword [0x10401b4], 7
call fcn.01010de6
mov dword [0x10401b4], 8
push 0x10403b8
call fcn.010115bf
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a9a3
mov dword [0x10401b4], esi
mov eax, dword [0x10403c0]
cmp dword [eax + 0x70], edi
jne 0x10125b4
mov ebx, 0x1040184
mov esi, 0x1010c90
mov dword [0x10401b4], 0xa
push edi
push 0x101232c
mov ecx, dword [0x10403b8]
call fcn.0100188c
test eax, eax
jne 0x100d57c
push 0x1001795
call fcn.01012251
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101a9d6
mov dword [0x10401b4], 0xb
push edi
push edi
mov ecx, dword [0x10403bc]
call fcn.01005ed9
call fcn.010116e2
push edi
call fcn.01009750
call fcn.01011fc4
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101aa04
push 1
push 0x10403b8
call fcn.0100db1d
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101aa3a
mov dword [0x10401b4], 0xd
push 0x100d868
call fcn.01002093
mov eax, dword [0x10403c0]
push dword [eax + 0x70]
mov ecx, dword [0x10403b8]
call fcn.01010fe7
push eax
mov ecx, dword [0x10403c0]
call fcn.010100b0
mov dword [ebp - 0x1c], eax
push 0x100d878
call fcn.01002093
cmp dword [ebp - 0x1c], edi
jne 0x101aa65
mov dword [0x10401b4], 0xe
call fcn.01010399
test eax, eax
je 0x100d624
call fcn.0101037d
test eax, eax
jne 0x101aa92
push edi
push 0x1006530
call fcn.010028d6
push edi
call dword [sym.imp.USER32.dll_UpdatePerUserSystemParameters]
push edi
push 0x1006540
call fcn.010028d6
mov dword [0x10401b4], 0xf
mov eax, dword [0x10403c0]
cmp dword [eax + 0x70], edi
jne 0x1012758
mov ecx, dword [0x10403c0]
call fcn.010029fc
cmp eax, 1
je 0x100d678
call sub.KERNEL32.dll_BaseInitAppcompatCacheSupport
mov dword [0x10401b4], 0x12
call fcn.01010399
test eax, eax
je 0x100d68e
call fcn.0101037d
test eax, eax
jne 0x101ab5e
mov ecx, dword [0x10403b8]
call fcn.01002917
test eax, eax
jne 0x100d6b3
cmp dword [0x10401c0], edi
jne 0x100d6b3
mov eax, dword [0x10403c0]
cmp dword [eax + 0x70], edi
jne 0x10124f4
mov dword [0x10401b4], 0x13
call fcn.01010555
cmp eax, edi
jl 0x101ad51
mov dword [0x10401b4], 0x14
mov ecx, dword [0x10403b8]
call fcn.01010731
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101ad88
mov dword [0x10401b4], 0x15
push 0x10403b8
call fcn.010108b0
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101adb3
mov dword [0x10401b4], 0x16
push 0x100d888
call fcn.01002093
push 0x10403b8
call fcn.0100dbd9
mov dword [ebp - 0x1c], eax
push 0x100d898
call fcn.01002093
cmp dword [ebp - 0x1c], edi
jne 0x101aded
mov dword [0x10401b4], 0x17
call fcn.0100fc51
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101ae1a
mov dword [0x10401b4], 0x19
push edi
push 0x10403b8
call fcn.0100db1d
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101ae45
mov dword [0x10401b4], 0x1a
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x100d79a
test byte [eax + 0x1c], 1
je 0x100d79a
cmp byte [eax + 0x19], 5
jae 0x101ae70
call fcn.0100ed23
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101ae83
mov dword [0x10401b4], 0x1b
call fcn.0100ea36
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x101aeba
mov dword [0x10401b4], 0x1c
push 0x100d8a8
call fcn.01002093
lea ecx, [ebp - 0x60]
call fcn.010034d4
lea ecx, [ebp - 0x60]
call fcn.01002045
push eax
push 0x1905
push edi
call sub.ntdll.dll_WinSqmSetDWORD
lea eax, [ebp - 0x28]
push eax
push 0x10403b8
call fcn.0100d9a5
mov dword [ebp - 0x1c], eax
push 0x100d8b8
call fcn.01002093
cmp dword [ebp - 0x1c], edi
jne 0x101aee8
mov dword [0x10401b4], 0x1d
mov ecx, dword [0x1040184]
mov dword [ebp - 4], 0xfffffffe
call fcn.0101812e
call fcn.01017c8d
cmp dword [0x10401b4], 2
jb 0x100d847
call fcn.010180e9
mov eax, dword [ebp - 0x1c]
call fcn.01001580
ret 0x10
push edi
call dword [sym.imp.ntdll.dll_RtlpVerifyAndCommitUILanguageSettings]
cmp eax, edi
jge 0x100d6b3
jmp 0x101ad09
call fcn.010126e6
mov dword [0x10401b8], eax
cmp eax, ebx
je 0x1018267
cmp eax, 4
je 0x1018267
xor eax, eax
mov dword [0x10401bc], eax
call fcn.0101250d
mov dword [0x10401c0], eax
mov ecx, dword [0x1040184]
mov ebx, 0x1040184
cmp ecx, ebx
je 0x100d539
test byte [ecx + 0x1c], 1
je 0x100d539
cmp byte [ecx + 0x19], 4
jb 0x100d539
cmp eax, edi
mov edx, 0x1002c84
jne 0x1012615
mov edx, 0x1012648
cmp dword [0x10401bc], edi
mov eax, 0x1002c84
jne 0x1012627
mov eax, 0x1012648
push edx
push dword [0x10401b8]
push eax
mov esi, 0x1010c90
push esi
push 0x10
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01012653
jmp 0x100d53e
call 0x10127c7
cmp eax, edi
jl 0x101aaf3
mov dword [0x10401b4], 0x10
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x1012792
test byte [eax + 0x1c], 0x10
je 0x1012792
cmp byte [eax + 0x19], 4
jb 0x1012792
push esi
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
push 0x1010c70
call fcn.01002093
call sub.WINSTA.dll__WinStationWaitForConnect
test al, al
je 0x101ab2a
push 0x1010c80
call fcn.01002093
mov dword [0x10401b4], 0x11
jmp 0x100d659
mov eax, ebx
jmp 0x10125d1
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push eax
push 0x1010c90
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
jmp 0x100d822
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push eax
push 0x1010c90
push 0xb
jmp 0x101a8b6
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x101a934
test byte [ecx + 0x1c], 1
je 0x101a934
cmp byte [ecx + 0x19], 1
jb 0x101a934
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1010c90
push 0xc
mov eax, dword [0x1040184]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x1c], 0x400
jmp 0x100d828
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x101a973
test byte [ecx + 0x1c], 1
je 0x101a973
cmp byte [ecx + 0x19], 1
jb 0x101a973
push eax
push 0x1010c90
push 0xd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x1c], 0x40a
jmp 0x100d828
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x101a973
test byte [ecx + 0x1c], 1
je 0x101a973
cmp byte [ecx + 0x19], 1
jb 0x101a973
push eax
push 0x1010c90
push 0xe
jmp 0x101a962
mov ecx, dword [0x1040184]
cmp ecx, 0x1040184
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push eax
push 0x1010c90
push 0xf
jmp 0x101a8b6
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x101a9fc
test byte [eax + 0x1c], 1
je 0x101a9fc
cmp byte [eax + 0x19], 3
jb 0x101a9fc
push dword [ebp - 0x1c]
push esi
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
mov dword [ebp - 0x1c], edi
jmp 0x100d572
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x12
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
jmp 0x100d822
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x13
jmp 0x101a8b6
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push dword [ebp - 0x1c]
push esi
push 0x14
jmp 0x101a8b6
push 0x101b150
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x100d624
push 0x101b13c
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x101aadf
push 0x101b124
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x101aadf
mov ecx, dword [0x10403c0]
call fcn.01005a31
push eax
call dword [ebp - 0x4c]
jmp 0x101aaec
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 0x20], 0
xor edi, edi
jmp 0x100d624
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ab1e
test byte [ecx + 0x1c], 1
je 0x101ab1e
cmp byte [ecx + 0x19], 1
jb 0x101ab1e
push eax
push esi
push 0x15
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x1c], 5
jmp 0x100d828
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 0x10
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x17
jmp 0x101a8b6
call fcn.0103a639
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1c], eax
test edi, edi
jne 0x101abab
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ab9d
test byte [ecx + 0x1c], 1
je 0x101ab9d
cmp byte [ecx + 0x19], 1
jb 0x101ab9d
push eax
push esi
push 0x18
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x24], 1
xor edi, edi
jmp 0x100d828
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x101abd1
test byte [eax + 0x1c], 1
je 0x101abd1
cmp byte [eax + 0x19], 4
jb 0x101abd1
push dword [ebp - 0x1c]
push esi
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
push 1
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x101abff
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ab9d
test byte [ecx + 0x1c], 1
je 0x101ab9d
cmp byte [ecx + 0x19], 1
jb 0x101ab9d
push eax
push esi
push 0x1a
jmp 0x101ab8c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [0x10401c0], edi
jne 0x101ac24
push edi
push edi
push 2
mov ecx, dword [0x10403c0]
call fcn.01002c8e
call sub.UXINIT.dll_Ordinal_14
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.010289aa
mov dword [ebp - 0x1c], eax
cmp dword [0x10401c0], edi
jne 0x101ac68
cmp dword [ebp - 0x24], edi
jne 0x101ac68
cmp dword [ebp - 0x20], edi
je 0x101ac5a
cmp dword [ebp - 0x2c], edi
je 0x101ac4e
call dword [ebp - 0x2c]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x20], edi
push edi
push edi
push edi
mov ecx, dword [0x10403c0]
call fcn.01002c8e
cmp dword [ebp - 0x1c], edi
je 0x101ac9a
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ab9d
test byte [ecx + 0x1c], 1
je 0x101ab9d
cmp byte [ecx + 0x19], 1
jb 0x101ab9d
push dword [ebp - 0x1c]
push esi
push 0x1b
jmp 0x101ab8c
cmp dword [ebp - 0x24], 1
jne 0x101acf5
and dword [ebp - 0x38], 0
lea ebx, [ebp - 0x28]
xor edi, edi
lea esi, [ebp - 0x38]
mov eax, dword [ebp - 0x30]
call fcn.01028b33
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x101acde
test byte [eax + 0x1c], 1
je 0x101acde
cmp byte [eax + 0x19], 4
jb 0x101acde
push 0x1010c90
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
push dword [ebp - 0x38]
push 0x10403b8
call fcn.01016a21
mov dword [ebp - 0x1c], eax
xor edi, edi
jmp 0x100d822
push edi
push edi
mov ecx, dword [0x10403bc]
call fcn.01005ed9
xor edi, edi
jmp 0x100d68e
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ad34
test byte [ecx + 0x1c], 0x10
je 0x101ad34
cmp byte [ecx + 0x19], 1
jb 0x101ad34
push eax
push esi
push 0x1d
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x1c], 0x40c
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x24], 1
jmp 0x100d828
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x101ad7c
test byte [ecx + 0x1c], 1
je 0x101ad7c
cmp byte [ecx + 0x19], 1
jb 0x101ad7c
push eax
push esi
push 0x1e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001f65
mov ecx, dword [0x1040184]
mov dword [ebp - 0x1c], 0x401
jmp 0x100d828
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x1f
jmp 0x101a8b6
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x100d709
test dword [eax + 0x1c], 0x40000
je 0x100d709
cmp byte [eax + 0x19], 2
jb 0x100d709
push dword [ebp - 0x1c]
push esi
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x100d709
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push dword [ebp - 0x1c]
push esi
push 0x21
jmp 0x101a8b6
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push eax
push esi
push 0x22
jmp 0x101a8b6
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x23
jmp 0x101a8b6
push esi
push 0x24
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
jmp 0x100d79a
mov eax, dword [0x1040184]
cmp eax, ebx
je 0x100d7aa
test byte [eax + 0x1c], 1
je 0x100d7aa
cmp byte [eax + 0x19], 2
jb 0x100d7aa
push dword [ebp - 0x1c]
push esi
push 0x25
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001f65
jmp 0x100d7aa
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test dword [ecx + 0x1c], 0x1000
je 0x100d828
cmp byte [ecx + 0x19], 2
jb 0x100d828
push eax
push esi
push 0x26
jmp 0x101a8b6
mov ecx, dword [0x1040184]
cmp ecx, ebx
je 0x100d828
test byte [ecx + 0x1c], 1
je 0x100d828
cmp byte [ecx + 0x19], 1
jb 0x100d828
push dword [ebp - 0x1c]
push esi
push 0x27
jmp 0x101a8b6