Function at 0x40e760
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x46a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [0x46bcf0], 0x463540
mov dword [0x46bcec], edx
call fcn.0040eb60
push 0x2c
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00421e90
add esp, 0xc
lea eax, [ebp - 0x38]
push 0
push 0x2c
push eax
push 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x40e7c4
mov esi, 0x10000
mov dword [ebp - 0x30], 0x1000
mov cl, 1
or edx, 0xffffffff
mov edi, esi
lea ebx, [esi - 1]
jmp 0x40e7d3
mov cl, byte [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
cmp dword [0x46aad0], 0x3e
mov ax, word [ebp - 0x30]
mov word [0x46bcf8], ax
movsx ax, cl
mov dword [0x46bcfc], edx
mov dword [0x46bd00], esi
mov word [0x46bcfa], ax
mov dword [0x46bd04], edi
mov dword [0x46bd08], ebx
jb 0x40e824
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46bcf4], eax
jmp 0x40e829
mov eax, dword [0x46bcf4]
test eax, eax
jne 0x40e869
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46bcf4], eax
test eax, eax
je 0x40eb46
push 4
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x46c008
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
lea ecx, [ecx]
test eax, eax
js 0x40eb46
mov ax, 1
cmp ax, word [0x46bcfa]
sbb eax, eax
and eax, 0xfa0
mov dword [0x46afdc], eax
mov eax, 0x46c478
test al, 7
jne 0x40eb38
mov eax, 0x46c460
mov dword [0x46c478], 0
mov dword [0x46c47c], 0
test al, 7
jne 0x40eb38
xor eax, eax
mov dword [0x46c46c], 0x200
mov dword [0x46c460], eax
mov ecx, 0x28
mov dword [0x46c464], eax
mov dword [0x46c468], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x38]
mov edx, eax
mov dword [0x46c470], 0x38
mov dword [0x46bcd8], eax
mov dword [0x46c060], eax
call fcn.00405c60
mov esi, eax
mov edx, 1
xor eax, eax
mov word [esi], ax
lock xadd dword [0x46bcdc], edx
inc edx
dec dl
mov dword [esi + 8], eax
movzx eax, dl
mov ecx, 0x28
mov byte [esi + 2], dl
mov dword [esi + 0xc], str.Type
mov dword [0x46bcd8], esi
mov dword [eax*4 + 0x46c060], esi
movzx eax, dl
mov edx, esi
mov word [esi - 8], ax
mov dword [esi + 4], 1
call fcn.00405c60
mov edx, eax
mov esi, 1
xor eax, eax
mov ecx, esi
mov word [edx], ax
lock xadd dword [0x46bcdc], ecx
inc ecx
dec cl
mov dword [edx + 4], eax
mov dword [edx + 8], eax
movzx eax, cl
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Alloc
mov dword [0x46bcd4], edx
mov dword [eax*4 + 0x46c060], edx
call fcn.00407760
mov dword [0x46be64], eax
lea ebx, [ebx]
cmp eax, 0xffffffff
je 0x40eb46
call fcn.00406160
test al, al
je 0x40eb46
cmp byte [0x7ffe03c4], 1
jne 0x40ea17
mov eax, dword [0x7ffe03c0]
dec eax
cmp eax, 0x1f
ja 0x40ea17
mov ax, word [0x46bcfa]
mov word [0x46bd0e], ax
xor eax, eax
mov word [0x46bd10], si
mov byte [0x46bd0c], 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420226
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], 0
push eax
lea edx, [ebp - 0x3c]
call fcn.00411520
test eax, eax
js 0x40eb09
mov ebx, dword [ebp - 0x3c]
xor ecx, ecx
mov dword [ebp - 0x40], ebx
movzx eax, word [ebx + 0xa]
mov dword [ebp - 0x3c], eax
movzx edi, ax
cmp cx, ax
jae 0x40eafa
mov si, word [ebp - 0x44]
lea ecx, [ebx + 0x21]
mov edx, edi
movzx eax, byte ds:[ecx]
lea ecx, [ecx + 0x2c]
add si, ax
sub edx, 1
jne 0x40ea56
cmp word [ebp - 0x3c], 1
jbe 0x40eafa
lea eax, ds:[edi + edi]
push eax
push 4
lfence
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, dword [ebp - 0x40]
mov ebx, eax
xor ecx, ecx
mov dword [0x46bd14], ebx
add edx, 0x21
movzx eax, si
lea edx, [edx + 0x2c]
mov dword [ebp - 0x44], eax
lea ecx, [ecx + 2]
movzx eax, byte [edx - 0x2c]
mov word [ecx + ebx - 2], ax
sub edi, 1
je 0x40eab8
mov ebx, dword [0x46bd14]
jmp 0x40ea96
push dword [ebp - 0x40]
push 0
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x44]
test ax, ax
je 0x40eb09
mov word [0x46bd0e], ax
mov eax, dword [ebp - 0x3c]
mov word [0x46bd10], ax
xor eax, eax
mov byte [0x46bd0c], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420226
mov esp, ebp
pop ebp
ret
push ebx
push 0
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ax, word [0x46bcfa]
mov word [0x46bd0e], ax
mov eax, 1
mov word [0x46bd10], ax
mov byte [0x46bd0c], al
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420226
mov esp, ebp
pop ebp
ret
push 0x80000002
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [ebp - 4]
mov eax, 0xc0000001
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420226
mov esp, ebp
pop ebp
ret