Function at 0x47f520
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x58a014]
xor eax, ebp
mov dword [esp + 0xe8], eax
mov dword [ecx + 8], ebx
mov eax, dword [0x59f79c]
mov ecx, dword [0x58e4fc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x47f858
mov ecx, dword [0x59f798]
test ecx, ecx
je 0x47f5b1
lea edi, [esp + 0x10]
mov dword [edi], 0xffffffff
call dword [section..00cfg]
push edi
push ebx
call ecx
test eax, eax
je 0x47f59f
cmp dword [esp + 0x10], 0
setne byte [esi + 0x89]
je 0x47f5b8
mov byte [esi + 0x88], 0
jmp 0x47f60e
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x47f693
mov byte [esi + 0x89], 0
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov dword [edi + 0x20], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [edi], 9
sete byte [esi + 0x88]
jne 0x47f60e
push 2
call fcn.00495280
add esp, 4
test al, al
jne 0x47f65c
xor ebx, ebx
mov ecx, dword [esp + 0xe8]
xor ecx, ebp
call fcn.004babe3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esi + 0x20]
lea ecx, [esi + 0x18]
push eax
push ecx
push esi
push 0
push ebx
call fcn.00536070
add esp, 0x14
test al, al
jne 0x47f6cd
push 2
call fcn.00495280
add esp, 4
test al, al
je 0x47f5f2
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x21f
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0043f9d0
lea eax, [esp + 0x48]
push 0x21
push str.GetProcessBasicInformation_failed
jmp 0x47f67e
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x211
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0043f9d0
lea eax, [esp + 0x48]
push 0x32
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.004e90c0
add esp, 0xc
mov ecx, esi
call fcn.0043fe10
jmp 0x47f5f2
call fcn.00502ea0
lea edi, [esp + 0x40]
mov ecx, edi
push eax
push 2
push 0x4c
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.00502fe0
lea eax, [esp + 0x48]
push 0xe
push 0x580aa1
push eax
call fcn.004e90c0
add esp, 0xc
mov ecx, edi
call fcn.00503040
jmp 0x47f5b1
cmp byte [esi + 0x88], 0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
jne 0x47f6e7
push esi
push ecx
push eax
push ebx
call fcn.00536820
jmp 0x47f6f0
push esi
push ecx
push eax
push ebx
call fcn.00536260
add esp, 0x10
test al, al
je 0x47f746
movzx eax, byte [esi + 0x88]
push esi
push eax
push ebx
call fcn.0047f1e0
add esp, 0xc
test al, al
jne 0x47f77f
push 2
call fcn.00495280
add esp, 4
test al, al
je 0x47f5f2
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x22d
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0043f9d0
lea eax, [esp + 0x48]
push 0x15
push str.ReadMemoryInfo_failed
jmp 0x47f67e
push 2
call fcn.00495280
add esp, 4
test al, al
je 0x47f5f2
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x228
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0043f9d0
lea eax, [esp + 0x48]
push 0x16
push str.ReadProcessData_failed
jmp 0x47f67e
xor eax, eax
lea ecx, [esp + 0x40]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x24], eax
pxor xmm0, xmm0
movdqu xmmword [ecx + 0x14], xmm0
movdqu xmmword [ecx + 4], xmm0
mov eax, 0x2c
mov dword [ecx], eax
push eax
push ecx
push ebx
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x47f7f9
cmp byte [esi + 0x4c], 0
mov eax, dword [esp + 0x68]
jne 0x47f7ba
mov byte [esi + 0x4c], 1
mov dword [esi + 0x50], eax
cmp byte [esi + 0x58], 0
mov eax, dword [esp + 0x64]
jne 0x47f7cb
mov byte [esi + 0x58], 1
mov dword [esi + 0x5c], eax
cmp byte [esi + 0x64], 0
mov eax, dword [esp + 0x4c]
jne 0x47f7dc
mov byte [esi + 0x64], 1
mov dword [esi + 0x68], eax
cmp byte [esi + 0x70], 0
jne 0x47f7f2
mov eax, dword [esp + 0x48]
mov dword [esi + 0x74], eax
mov byte [esi + 0x70], 1
jmp 0x47f7f9
mov eax, dword [esp + 0x48]
mov dword [esi + 0x74], eax
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqu xmmword [eax + 0x1c], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
mov ecx, dword [esi + 8]
mov edx, 3
push edi
push 0x2c
push eax
call fcn.00536e60
add esp, 0xc
test eax, eax
js 0x47f851
cmp byte [esi + 0x7c], 0
je 0x47f843
mov eax, dword [esp + 0x14]
mov dword [esi + 0x80], eax
jmp 0x47f851
mov eax, dword [esp + 0x14]
mov dword [esi + 0x80], eax
mov byte [esi + 0x7c], 1
mov bl, 1
jmp 0x47f5f4
push 0x59f79c
call fcn.004ba267
add esp, 4
cmp dword [0x59f79c], 0xffffffff
jne 0x47f566
push 0
push str.::IsWow64Process
push 0x572e16
call fcn.0047efb0
add esp, 0xc
mov dword [0x59f798], eax
push 0x59f79c
call fcn.004ba2dd
add esp, 4
jmp 0x47f566