Function at 0x417eb0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c950
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x55c640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x90], eax
push 0x20000
mov dword [ebp - 4], 0
push 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x71], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, str.UPDATE_USERS_
mov dword [ebp - 0x7c], eax
lea ecx, [edi + 1]
lea ecx, [ecx]
mov al, byte [edi]
inc edi
test al, al
jne 0x417f30
lea eax, [ebp - 0x70]
sub edi, ecx
push eax
mov dword [ebp - 0x88], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
push 0
push 0x410
movdqu xmmword [ebp - 0x4c], xmm0
movq qword [ebp - 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x78], eax
test eax, eax
je 0x418211
mov esi, dword [ebp - 0x68]
mov dword [ebp - 0x8c], esi
cmp esi, dword [ebp - 0x64]
ja 0x41820a
push 0x1c
lea ecx, [ebp - 0x4c]
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test eax, eax
je 0x418207
mov eax, dword [ebp - 0x40]
mov ecx, esi
mov edx, eax
mov dword [ebp - 0x80], esi
shr edx, 0x11
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x84], 0
test edx, edx
je 0x4181e7
lea eax, [ebp - 0x30]
push eax
push 0x20000
push dword [ebp - 0x7c]
push ecx
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4181b9
mov esi, dword [ebp - 0x7c]
xor eax, eax
mov edx, esi
sub edx, edi
add edx, dword [ebp - 0x30]
cmp esi, edx
jae 0x418009
mov cl, byte [esi]
cmp cl, byte [eax + str.UPDATE_USERS_]
jne 0x418002
inc eax
cmp eax, edi
je 0x41800b
jmp 0x418004
xor eax, eax
inc esi
cmp esi, edx
jb 0x417ff1
xor esi, esi
test esi, esi
je 0x4181b9
add esi, dword [ebp - 0x90]
push 0x32
push esi
push dword [ebp - 0x94]
call fcn.00489260
add esp, 0xc
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
push 0
push 0x32
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00450fd0
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
push 0x32
cmovae eax, dword [ebp - 0x2c]
push esi
push eax
call fcn.00489260
add esp, 0xc
lea eax, [ebp - 0xb8]
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xa0]
push dword [ebp - 0x9c]
push eax
call fcn.0044bca0
mov esi, eax
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x4180ee
cmp dword [ebp - 0x18], 0x10
jb 0x418098
push dword [ebp - 0x2c]
call fcn.00485250
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
cmp dword [esi + 0x14], 0x10
jae 0x4180c6
mov eax, dword [esi + 0x10]
inc eax
je 0x4180d1
push eax
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.00485d50
add esp, 0xc
jmp 0x4180d1
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov dword [esi], 0
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x18], eax
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp dword [ebp - 0xa4], 0x10
jb 0x418105
push dword [ebp - 0xb8]
call fcn.00485250
add esp, 4
cmp dword [ebp - 0x18], 0x10
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
lea edx, [ebp + 0x1c]
cmovae ecx, dword [ebp - 0x2c]
mov esi, edi
cmp dword [ebp + 0x30], 0x10
mov eax, dword [ebp + 0x2c]
cmovae edx, dword [ebp + 0x1c]
cmp eax, edi
cmovb esi, eax
test esi, esi
je 0x418184
sub esi, 4
jb 0x418142
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x418147
add edx, 4
add ecx, 4
sub esi, 4
jae 0x418131
cmp esi, 0xfffffffc
je 0x41817b
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x418174
cmp esi, 0xfffffffd
je 0x41817b
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x418174
cmp esi, 0xfffffffe
je 0x41817b
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x418174
cmp esi, 0xffffffff
je 0x41817b
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x41817b
sbb eax, eax
or eax, 1
jmp 0x41817d
xor eax, eax
test eax, eax
jne 0x418197
mov eax, dword [ebp + 0x2c]
cmp eax, edi
jae 0x41818d
or eax, 0xffffffff
jmp 0x418195
xor eax, eax
cmp dword [ebp + 0x2c], edi
setne al
test eax, eax
sete al
test al, al
jne 0x4181f1
mov byte [ebp - 4], al
cmp dword [ebp - 0x18], 0x10
jb 0x4181b3
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00485250
add esp, 4
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x80]
inc eax
add ecx, 0x20000
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], ecx
cmp eax, dword [ebp - 0x98]
jb 0x417fc3
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x8c]
add esi, eax
mov eax, dword [ebp - 0x78]
jmp 0x417f79
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 0x71], 1
jb 0x418207
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00485250
add esp, 4
mov eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x41821f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 0x30], 0x10
jb 0x418230
push dword [ebp + 0x1c]
call fcn.00485250
add esp, 4
mov al, byte [ebp - 0x71]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00484516
mov esp, ebp
pop ebp
ret