Function at 0x40321b
Capabilities:
Get os information via kuser_shared_data
Get windows directory from kuser_shared_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
lea eax, [ebp - 0xc]
push eax
cmp dword [ebp + 8], ebx
je 0x403240
push 8
push 0xffffffffffffffff
call dword [0x40616c]
jmp 0x40324c
push ebx
push ebx
push 8
push 0xfffffffffffffffe
call dword [0x40614c]
cmp eax, ebx
jl 0x4034ca
mov al, byte [0x41e220]
movzx eax, al
mov dword [ebp + 8], ebx
call 0x407020
mov dword [ebp - 0x48], esp
xor edi, edi
mov dword [ebp - 0x10], 0x30
mov eax, dword [ebp - 0x10]
cmp edi, eax
jae 0x403286
sub eax, edi
call 0x407020
mov edi, dword [ebp - 0x48]
mov dword [ebp + 8], esp
sub edi, esp
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 8]
push 1
push dword [ebp - 0xc]
call dword [0x406168]
mov dword [ebp - 0x44], eax
cmp eax, 0xc0000023
je 0x403270
push dword [ebp - 0xc]
call dword [0x4061c4]
cmp dword [ebp - 0x44], ebx
jl 0x4034ca
push 0x5c
pop eax
mov word [esi], ax
push 0x3f
pop eax
mov word [esi + 2], ax
mov word [esi + 4], ax
push 0x5c
pop eax
mov word [esi + 6], ax
xor eax, eax
mov word [ebp - 8], ax
mov eax, 0x7f8
mov word [ebp - 6], ax
lea eax, [esi + 8]
mov ecx, 0x7ffe0030
mov dword [ebp - 4], eax
movzx eax, word [ecx]
movzx edx, word [ebp - 8]
mov edi, dword [ebp - 4]
mov word [edi + edx*2], ax
inc word [ebp - 8]
inc ecx
inc ecx
cmp ax, 0x5c
jne 0x4032e7
shl word [ebp - 8], 1
cmp dword [0x7ffe026c], 6
mov eax, 0x41c7c0
jb 0x403318
mov eax, 0x41c7d4
push eax
lea eax, [ebp - 8]
push eax
call dword [0x40611c]
push 0x1c
pop eax
mov word [ebp - 0x2a], ax
xor eax, eax
inc eax
mov word [ebp - 0x28], ax
xor eax, eax
push 0x14
mov byte [ebp - 0x2c], 2
mov byte [ebp - 0x2b], bl
lea edi, [ebp - 0x26]
stosw word es:[edi], ax
pop eax
mov word [ebp - 0x22], ax
mov eax, 0x1004
mov word [ebp - 0x3e], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x40]
push eax
push esi
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x23], 3
mov dword [ebp - 0x20], 0x1f01fe
mov byte [ebp - 0x1c], 1
mov byte [ebp - 0x1b], 1
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], 1
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x40], 1
mov byte [ebp - 0x3f], bl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.0040303b
mov ax, word [ebp - 8]
sub word [ebp - 6], ax
movzx ecx, ax
add dword [ebp - 4], ecx
xor eax, eax
mov word [ebp - 8], ax
mov eax, dword [ebp + 8]
push ebx
push dword [eax]
lea eax, [ebp - 8]
push eax
call dword [0x406118]
test eax, eax
jl 0x4034ca
movzx eax, word [ebp - 6]
movzx ecx, word [ebp - 8]
sub eax, ecx
cmp eax, 0x50
jb 0x4034ca
lea eax, [ebp - 0x40]
push eax
push esi
call fcn.0040303b
movzx eax, byte [0x41e20f]
push eax
movzx eax, byte [0x41e20e]
push eax
movzx eax, byte [0x41e20d]
push eax
movzx eax, byte [0x41e20c]
push eax
movzx eax, byte [0x41e20b]
push eax
movzx eax, byte [0x41e20a]
push eax
movzx eax, byte [0x41e209]
push eax
movzx eax, byte [0x41e208]
push eax
movzx eax, word [0x41e206]
push eax
movzx eax, word [0x41e204]
push eax
movzx eax, word [ebp - 8]
push dword [0x41e200]
add eax, dword [ebp - 4]
push 0x41c7f0
push eax
call dword [0x406178]
add esp, 0x34
push ebx
push ebx
push 0x21
push 3
push 7
lea eax, [ebp - 0x40]
mov dword [ebp - 0x50], eax
xor eax, eax
push 6
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], 0x41c854
mov dword [ebp - 0x54], 0x40
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
lea esi, [ebp - 0x88]
xor edi, edi
call fcn.00402ca4
push eax
push 0x120116
lea eax, [ebp - 0x5c]
push eax
call dword [0x406128]
test eax, eax
jl 0x4034c6
push dword [ebp + 0xc]
lea esi, [ebp - 0x60]
mov dword [ebp - 0x20], 0x1f01ff
call fcn.004031a4
push dword [ebp - 0x5c]
mov edi, eax
call dword [0x4061c4]
mov eax, edi
jmp 0x4034cc
xor eax, eax
lea esp, [ebp - 0x98]
pop edi
pop esi
pop ebx
leave
ret 8