Function at 0x41b8b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4aac
mov eax, dword fs:[0]
push eax
sub esp, 0x708
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00488db0
test eax, eax
jne 0x41bb7a
call fcn.0043c7f0
test eax, eax
jne 0x41bb7a
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x26a]
push ebx
push ecx
mov word [ebp - 0x26c], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x26c]
push edx
push 1
push ebx
push 2
call fcn.0043baf0
test eax, eax
jns 0x41b93a
mov eax, 0x80
jmp 0x41bb7f
mov ecx, 0xa
mov esi, str.kmso2pdfplugins.dll
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov ecx, 0xb
mov esi, str.kmso2pdfplugins64.dll
lea edi, [ebp - 0x64]
push eax
mov dword [ebp - 0x6f0], ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00446210
add esp, 4
test eax, eax
js 0x41ba4b
mov ecx, 0x82
lea esi, [ebp - 0x26c]
lea edi, [ebp - 0x474]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x474]
add edi, 0xfffffffe
mov edi, edi
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x41b990
mov ecx, dword [0x4c7780]
lea eax, [ebp - 0x38]
mov dword [edi], ecx
mov esi, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41b9b0
lea edi, [ebp - 0x474]
sub eax, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x41b9c6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4c79ac
lea ecx, [ebp - 0x6ec]
call fcn.00405cd0
lea edx, [ebp - 0x474]
push edx
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 4], ebx
call fcn.00405cd0
mov edx, dword [ebp + 8]
push 1
lea eax, [ebp - 0x6ec]
push eax
lea ecx, [ebp - 0x6d0]
push ecx
push edx
mov byte [ebp - 4], 1
call fcn.00438eb0
add esp, 0x10
test eax, eax
lea ecx, [ebp - 0x6d0]
sets bl
call fcn.004a9f30
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 4], 0xffffffff
call fcn.004a9f30
test bl, bl
je 0x41ba55
mov dword [ebp - 0x6f0], 0x80
lea eax, [ebp - 0x714]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x714]
cmp ax, 9
je 0x41ba79
cmp ax, 6
jne 0x41bb72
lea ecx, [ebp - 0x64]
push ecx
call fcn.00446210
add esp, 4
test eax, eax
js 0x41bb68
mov ecx, 0x82
lea esi, [ebp - 0x26c]
lea edi, [ebp - 0x67c]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x67c]
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41bab0
mov edx, dword [0x4c7780]
lea eax, [ebp - 0x64]
mov dword [edi], edx
mov esi, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41bad0
lea edi, [ebp - 0x67c]
sub eax, esi
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x41bae6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4c79ac
lea ecx, [ebp - 0x698]
call fcn.00405cd0
lea eax, [ebp - 0x67c]
push eax
lea ecx, [ebp - 0x6b4]
mov dword [ebp - 4], 2
call fcn.00405cd0
mov eax, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x698]
push ecx
lea edx, [ebp - 0x6b4]
push edx
push eax
mov byte [ebp - 4], 3
call fcn.00438eb0
add esp, 0x10
test eax, eax
lea ecx, [ebp - 0x6b4]
sets bl
call fcn.004a9f30
lea ecx, [ebp - 0x698]
call fcn.004a9f30
test bl, bl
je 0x41bb72
mov dword [ebp - 0x6f0], 0x80
mov eax, dword [ebp - 0x6f0]
jmp 0x41bb7f
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret