Function at 0x100270cd
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x10038269
call fcn.10001a8f
sub esp, 0x2cc
mov eax, dword [0x1003b164]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov ecx, 0x96
lea edi, [ebp - 0x268]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2a8]
xor esi, esi
call fcn.1002bc21
push 0x1003b870
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
test eax, eax
jne 0x10027203
push 0x1f4
mov ecx, 0x1003bea0
call fcn.1000179c
mov eax, dword [0x1003bea0]
mov ecx, 0x1003bea0
call dword [eax]
mov dword [0x1003bec0], ebx
mov dword [0x1003bed0], ebx
mov dword [0x1003bed4], 0x7530
mov dword [0x1003bed8], 0x3e8
mov dword [0x1003bedc], ebx
call fcn.10026274
push 0x1003bedc
call fcn.10023f47
add eax, 0x288
push eax
call fcn.10026984
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [ebp - 0x2a8]
call fcn.1002bc86
mov esi, eax
cmp esi, ebx
jge 0x1002722d
push ebx
mov dword [ebp - 0x28c], 0xc00012d3
mov dword [ebp - 0x278], 1
push 0xb5
lea eax, [ebp - 0x294]
push 0x10004cc0
push eax
mov dword [ebp - 0x294], esi
mov word [ebp - 0x290], 0x63
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x284], ebx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x27c], ebx
call fcn.1002a981
add esp, 0x10
cmp esi, ebx
je 0x10027203
call fcn.10026789
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.1002bc39
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.10023cf0
leave
ret 4
xor edi, edi
inc edi
push edi
push 0xf001f
push dword [0x10005460]
lea ecx, [ebp - 0x2a8]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
jge 0x10027268
push ebx
mov dword [ebp - 0x28c], 0xc00012d3
push 0xbc
mov dword [ebp - 0x278], edi
jmp 0x100271bf
push edi
push 0xf001f
push dword [0x10005470]
lea ecx, [ebp - 0x2a8]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
jge 0x10027297
push ebx
mov dword [ebp - 0x28c], 0xc00012d3
push 0xc3
jmp 0x1002725d
push edi
push 0x20005
push dword [0x10005450]
lea ecx, [ebp - 0x2a8]
call fcn.1002c0fc
mov esi, eax
cmp esi, ebx
jge 0x100272c6
push ebx
mov dword [ebp - 0x28c], 0xc00012d3
push 0xca
jmp 0x1002725d
mov eax, 0x1000
push eax
push eax
lea ecx, [ebp - 0x2a8]
call fcn.1002bd39
mov esi, eax
cmp esi, ebx
jge 0x100272f3
push ebx
mov dword [ebp - 0x28c], 0xc00012d3
push 0xd1
jmp 0x1002725d
mov eax, dword [ebp - 0x2a8]
push 0x10004b70
push dword [ebp - 0x2d4]
mov dword [ebp - 0x2b0], eax
push ebx
push 0x8000004
lea eax, [ebp - 0x2b4]
push eax
push 0xffffffffffffffff
mov dword [ebp - 0x2b4], 0xc
mov dword [ebp - 0x2ac], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1003bee0], eax
jne 0x1002735b
call esi
cmp eax, 5
jne 0x1002735b
push 0x10004b70
push ebx
push 0x3001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [0x1003bee0], eax
cmp dword [0x1003bee0], ebx
jne 0x10027394
call esi
test eax, eax
jg 0x10027382
call esi
mov esi, eax
push ebx
push 0xef
mov dword [ebp - 0x28c], 0xc00012d4
jmp 0x1002725d
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x1002736d
call esi
push dword [ebp - 0x2d4]
cmp eax, 0xb7
push ebx
push ebx
push 0xf001f
push dword [0x1003bee0]
sete byte [ebp - 0x271]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, ebx
mov dword [0x1003bee4], eax
jne 0x100273e8
call esi
test eax, eax
jg 0x100273d6
call esi
mov esi, eax
push ebx
push 0x101
jmp 0x10027373
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x100273ce
cmp dword [ebp + 8], ebx
je 0x100273ff
cmp byte [ebp - 0x271], bl
je 0x100273ff
mov esi, 0x80110475
jmp 0x100271fe
push edi
push edi
lea eax, [ebp - 0x270]
push eax
call fcn.10023f47
add eax, 0x288
push eax
call fcn.1002470d
mov esi, eax
cmp esi, ebx
jl 0x100271fe
cmp esi, edi
jne 0x10027428
xor esi, esi
mov edi, dword [0x1003bee4]
xor eax, eax
push 6
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [0x1003bee4]
mov dword [eax], 0x62646772
mov eax, dword [0x1003bee4]
xor edi, edi
inc edi
mov word [eax + 4], di
mov eax, dword [0x1003bee4]
mov word [eax + 6], bx
mov eax, dword [ebp - 0x268]
mov ecx, dword [0x1003bee4]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x264]
mov ecx, dword [0x1003bee4]
mov dword [ecx + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x1003bee4]
push ebx
push edi
mov dword [ecx + 0xc], eax
mov eax, dword [0x1003bee4]
push ebx
mov dword [0x1003bee8], edi
push ebx
mov dword [eax + 8], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push edi
push edi
push ebx
mov dword [0x1003be94], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x1003be98], eax
mov eax, dword [0x1003bea0]
mov ecx, 0x1003bea0
call dword [eax + 4]
call fcn.10026231
jmp 0x100271fa