Function at 0x462e40
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x1bc
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x1b4], eax
push ebx
push ebp
push esi
push edi
push 0xf8
lea eax, [esp + 0x24]
mov ebx, edx
push 0
push eax
mov dword [esp + 0x128], ebx
mov ebp, ecx
call fcn.005861d0
add esp, 0xc
lea eax, [esp + 0x28]
push 0xf0
push 0
push eax
call fcn.005861d0
add esp, 0xc
lea eax, [esp + 0x14]
push ebx
push 0x410
push eax
call sym.SystemInformer.exe_Ordinal_1560
nop dword [eax + eax]
test eax, eax
jns 0x462f8e
push ebx
push 0x400
lea eax, [esp + 0x1c]
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1560
mov esi, eax
test esi, esi
jns 0x462f8e
cmp esi, 0xc0000022
je 0x462efe
cmp esi, 0xc0000005
je 0x462efe
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x462eec
movzx eax, si
jmp 0x462f08
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x462f0c
mov eax, esi
jmp 0x462f08
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x462f17
push esi
lfence
call sym.SystemInformer.exe_Ordinal_1660
jmp 0x462f25
push eax
lfence
call sym.SystemInformer.exe_Ordinal_1670
mov esi, eax
test esi, esi
je 0x462f74
lfence
lfence
push dword [esi + 4]
push 0x5d369c
push str.Unable_to_open_the_process.
push 0xfffe
push 0x20
push ebp
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4631b0
lfence
call fcn.004fe1e0
jmp 0x4631b0
push str.Unable_to_open_the_process.
push 0x5d369c
push 0x10
push ebp
call sym.SystemInformer.exe_Ordinal_1698
add esp, 0x10
jmp 0x4631b0
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x118]
push 0
push eax
push 0
push str.LdrSystemDllInitBlock
push 0x6309f4
push ebx
call sym.SystemInformer.exe_Ordinal_1525
mov edi, eax
test edi, edi
js 0x46302c
push 0x98
push 4
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x98
mov esi, eax
push 0
push esi
call fcn.005861d0
add esp, 0xc
push 0
push 0x98
push esi
push dword [esp + 0x124]
push ebx
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x4631cc
mov ecx, dword [esi]
lea eax, [esi + 0x7c]
add ecx, esi
cmp eax, ecx
jbe 0x463028
push esi
push 0
lfence
push dword [0x633a54]
mov edi, 0xc0000004
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [eax]
test edi, edi
js 0x46302c
mov esi, dword [esp + 0x10]
mov dword [esp + 0x24], esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x120]
call fcn.00486f20
nop dword [eax]
test eax, eax
js 0x46318d
xor esi, esi
lea edi, [esp + 0x30]
nop
mov edx, dword [esp + esi*4 + 0x120]
test edx, edx
je 0x46307d
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00487420
test al, al
je 0x46307d
mov eax, dword [esp + 0x18]
mov dword [edi - 4], eax
mov eax, dword [esp + 0x1c]
mov dword [edi], eax
inc esi
add edi, 0xc
cmp esi, 0x14
jb 0x463050
cmp dword [esp + 0x11c], 4
jne 0x463104
push 0
push 4
lea eax, [esp + 0x124]
push eax
push 0xdd
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x463104
mov eax, dword [esp + 0x11c]
lea edx, [esp + 0x118]
mov ecx, eax
and eax, 0x100
shr ecx, 4
and ecx, 0x30
or ecx, eax
lea eax, [esp + 0x1c]
shr ecx, 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x11c], ecx
push eax
mov ecx, 0xf
call fcn.00487420
test al, al
je 0x463104
mov eax, dword [esp + 0x18]
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xe4], eax
mov esi, dword [0x633a40]
lea eax, [esp + 0x10]
push eax
push 0
push 5
push 0xd7
push esi
call sym.SystemInformer.exe_Ordinal_1412
nop
test al, al
je 0x46313a
lea eax, [esp + 0x20]
push eax
push 0x463200
push ebp
push dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
lea esi, [esp + 0x30]
mov edi, 0x14
mov eax, dword [esi - 4]
mov dword [esi - 4], 0
test eax, eax
je 0x463165
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x463165
nop
call fcn.004fe1e0
mov eax, dword [esi]
mov dword [esi], 0
test eax, eax
je 0x463185
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x463185
nop
call fcn.004fe1e0
add esi, 0xc
sub edi, 1
jne 0x463143
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4631a6
push eax
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword ds:[esp + 0x1c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x1bc
ret
push esi
push 0
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x46302c