Function at 0x42b315
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x475280]
xor eax, esp
mov dword [esp + 0x480], eax
push ebx
push esi
xor eax, eax
mov dword [esp + 0x20], edx
push edi
push 8
pop edi
push eax
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov esi, ecx
mov dword [esp + 0x54], 0x11
mov byte [esp + 0x58], al
mov dword [esp + 0x5c], 0x12
mov byte [esp + 0x60], al
mov dword [esp + 0x64], edi
mov byte [esp + 0x68], al
mov dword [esp + 0x6c], 9
mov byte [esp + 0x70], al
mov dword [esp + 0x74], 0x1c
mov byte [esp + 0x78], al
mov dword [esp + 0x2c], eax
call fcn.0042fd2c
mov ebx, dword [esp + 0x10]
mov eax, ebx
and eax, edi
mov dword [esp + 0x14], eax
jne 0x42b3c6
push 5
lea edx, [esp + 0x54]
mov ecx, ebx
call fcn.0043f9fc
mov edi, eax
test edi, edi
jns 0x42b3bc
push edi
push 0x3aa
mov ecx, 0x40610c
call fcn.0043f87d
jmp 0x42b3c8
mov dword [esp + 0x28], 1
jmp 0x42b3c8
xor edi, edi
mov eax, ebx
and eax, 0x1000000
mov dword [esp + 0x18], eax
je 0x42b416
test ebx, 0x8000000
je 0x42b416
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x10]
and dword [esp + 0x10], 0
push eax
push ecx
mov edx, dword [edx]
mov ecx, esi
call fcn.0043e989
test eax, eax
jns 0x42b40b
push eax
push 0x3c0
mov ecx, 0x40610c
call fcn.0043f87d
jmp 0x42b416
mov edx, dword [esp + 0x10]
mov ecx, esi
call fcn.00430836
test edi, edi
js 0x42b735
push 9
pop ecx
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
xor edx, edx
mov ecx, esi
call fcn.004303c6
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
mov ecx, ebx
and ecx, 0x8000000
mov dword [esp + 0x10], ecx
je 0x42b49e
test eax, eax
jne 0x42b563
xor edi, edi
test esi, esi
je 0x42b460
mov edi, dword [esi + 0x2c]
push ecx
push 0
push 0
mov edx, 0x9478
mov ecx, esi
call fcn.00429ea7
mov ecx, dword [0x475b9c]
mov eax, dword [0x475b98]
push ecx
push eax
push ecx
push eax
push 0
push edi
mov ecx, esi
call fcn.00428d71
xor edx, edx
mov ecx, esi
push 1
inc edx
call fcn.00430552
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x42b563
cmp dword [esp + 0x18], eax
jne 0x42b563
test ecx, ecx
jne 0x42b563
mov ecx, esi
call fcn.00430616
test eax, eax
jne 0x42b563
push 0x410
push eax
lea eax, [esp + 0x80]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0x208
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.0042fd0f
lea edx, [esp + 0x7c]
mov ecx, eax
call fcn.00428cbb
mov edx, 0x405fd0
lea ecx, [esp + 0x78]
call fcn.00423aa7
mov edi, eax
test edi, edi
je 0x42b563
push 0
push 0x20020
push edi
mov edx, 0x405ff8
mov ecx, esi
call fcn.0043fb81
test eax, eax
je 0x42b553
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x18]
and dword [esp + 0x18], 0
push edi
mov ecx, dword [eax]
call fcn.00438a7b
test eax, eax
je 0x42b54c
mov edx, dword [esp + 0x18]
mov ecx, esi
call fcn.0043062c
mov ecx, edi
call fcn.0043e3cc
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
mov ecx, esi
push ebx
push eax
push eax
push dword [eax]
mov edx, dword [eax]
call fcn.0042d54f
mov edi, eax
test edi, edi
js 0x42b6b4
mov ecx, esi
call fcn.0042fecf
test eax, eax
je 0x42b597
mov edx, dword [esp + 0x40]
mov ecx, esi
call fcn.0043c854
mov edi, eax
test edi, edi
js 0x42b6b4
cmp dword [esp + 0x10], 0
jne 0x42b5eb
xor eax, eax
test esi, esi
je 0x42b5af
mov eax, dword [esi + 0x28]
push ecx
push eax
push 0
mov edx, 0x947b
mov ecx, esi
call fcn.00429ea7
push ecx
push 0
push 0
mov edx, 0x947c
mov ecx, esi
call fcn.00429ea7
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42b6b4
push ecx
push eax
push eax
mov edx, 0x9478
mov ecx, esi
call fcn.00429ea7
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x42b6b4
mov ecx, 0x9000000
mov eax, ebx
and eax, ecx
cmp eax, ecx
je 0x42b6b4
xor edx, edx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
call fcn.0043021a
test eax, eax
je 0x42b64a
lea eax, [esp + 0x18]
mov edx, 0x43f2c0
push eax
push 2
mov ecx, esi
call fcn.0043133a
test eax, eax
jns 0x42b642
xor edx, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edx
jmp 0x42b64a
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [0x475b9c]
mov eax, dword [0x475b98]
push ecx
push eax
push ecx
push eax
push edi
push edx
mov ecx, esi
call fcn.00428d71
xor edx, edx
mov ecx, esi
push 1
inc edx
call fcn.00430552
mov ecx, esi
call fcn.0042fe97
mov edx, dword [esp + 0x40]
neg eax
mov ecx, esi
sbb eax, eax
neg eax
push eax
call fcn.0042e0cb
mov edi, eax
test edi, edi
jns 0x42b695
push edi
push 0x44f
jmp 0x42b6a8
mov ecx, esi
call fcn.00430399
mov edi, eax
test edi, edi
jns 0x42b6c7
push edi
push 0x455
mov ecx, 0x40610c
call fcn.0043f87d
jmp 0x42b6c7
cmp dword [esp + 0x10], 0
je 0x42b6c7
xor edx, edx
mov ecx, esi
push 0
inc edx
call fcn.00430552
mov ecx, esi
call fcn.0043c81d
test edi, edi
js 0x42b6e6
mov eax, dword [esp + 0x24]
mov ecx, esi
push ebx
push eax
push eax
push dword [eax]
mov edx, dword [eax]
call fcn.0042e1b3
mov edi, eax
xor edx, edx
mov ecx, esi
push 0
inc edx
call fcn.00430552
xor edx, edx
mov ecx, esi
call fcn.004303c6
test edi, edi
js 0x42b735
cmp dword [esp + 0x14], edx
jne 0x42b715
push ecx
push edx
push 0x64
mov edx, 0x9478
mov ecx, esi
call fcn.00429ea7
cmp dword [esp + 0x10], 0
jne 0x42b735
xor eax, eax
test esi, esi
je 0x42b725
mov eax, dword [esi + 0x28]
push ecx
push eax
push 0
mov edx, 0x947c
mov ecx, esi
call fcn.00429ea7
cmp dword [esp + 0x28], 0
je 0x42b750
test ebx, 0x20000
jne 0x42b750
push 5
pop edx
lea ecx, [esp + 0x50]
call fcn.0043fb23
mov ecx, dword [esp + 0x48c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00471d10
mov esp, ebp
pop ebp
ret