Function at 0x100fad0
Capabilities:
Get system information on windows

Disassembly:
push 0x294
push 0x10014d0
call fcn.0100ce54
mov eax, dword [0x106000c]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x130], eax
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x124], edi
lea ecx, [ebp - 0x11c]
call fcn.0101b206
xor esi, esi
mov dword [ebp - 0x128], esi
cmp byte [ebx + 0x105], 0
jne 0x100fb35
mov dword [edi], 9
jmp 0x100fcfa
push esi
push 0x2c
lea eax, [ebp - 0x16c]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x100fcfa
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x150]
xor edx, edx
div dword [ebp - 0x164]
mov edi, eax
mov eax, dword [ebp - 0x160]
xor ecx, ecx
cmp ecx, esi
ja 0x100fb7a
jb 0x100fb76
cmp eax, edi
jae 0x100fb7a
mov edi, eax
mov esi, ecx
push ecx
push 0x138
lea eax, [ebp - 0x2a4]
push eax
push 2
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x100fcfa
mov eax, dword [ebp - 0x278]
xor ecx, ecx
cmp ecx, esi
ja 0x100fbad
jb 0x100fba9
cmp eax, edi
jae 0x100fbad
mov edi, eax
mov esi, ecx
mov eax, 0x2000000
xor edx, edx
div dword [ebp - 0x164]
xor ecx, ecx
sub edi, eax
sbb esi, ecx
mov ecx, esi
shrd edi, ecx, 1
shr ecx, 1
mov eax, 0x4000000
xor edx, edx
mov esi, dword [ebp - 0x164]
div esi
xor edx, edx
cmp ecx, edx
ja 0x100fbea
jb 0x100fbe3
cmp edi, eax
ja 0x100fbea
mov eax, 0x400000
jmp 0x100fbef
mov eax, 0x10000000
xor edx, edx
div esi
xor edx, edx
cmp ecx, edx
jb 0x100fc03
ja 0x100fbff
cmp edi, eax
jb 0x100fc03
mov edi, eax
mov ecx, edx
push ecx
push edi
push 0
push esi
call sub.ntdll.dll__allmul
mov esi, eax
mov edi, edx
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
push 0
push eax
push edi
push esi
call sub.ntdll.dll__aulldiv
mov edi, eax
test edi, edi
je 0x100fc6a
push 0xf0
call fcn.01013e0e
pop ecx
test eax, eax
je 0x100fc42
mov ecx, eax
call fcn.0101e6e3
mov esi, eax
jmp 0x100fc4f
and dword [ebp - 0x128], 0
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x100fc7c
push edi
push ebx
mov ecx, esi
call fcn.0101e9a4
test al, al
je 0x100fc70
push esi
mov ecx, ebx
call fcn.010100f0
jmp 0x100fc7c
mov esi, dword [ebp - 0x128]
test esi, esi
je 0x100fc7c
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push dword [ebp - 0x138]
call fcn.0100f8c8
mov esi, eax
test esi, esi
jl 0x100fde0
push dword [ebp - 0x138]
call fcn.0100f936
test al, al
je 0x100fd0e
lea eax, [ebp - 0x11d]
push eax
lea eax, [ebx + 8]
push eax
call fcn.0100f9d4
test al, al
je 0x100fccb
cmp byte [ebp - 0x11d], 0
je 0x100fd0e
mov eax, dword [ebp - 0x124]
mov dword [eax], 6
jmp 0x100fcfa
mov esi, dword [ebp - 0x130]
mov eax, dword [esi]
push 3
push 1
push 0x75c8
mov ecx, esi
call dword [eax + 0xc]
push 0x10011dc
push esi
call fcn.0100d58b
pop ecx
pop ecx
mov eax, dword [ebp - 0x124]
mov dword [eax], 4
xor bl, bl
lea ecx, [ebp - 0x11c]
call fcn.0101b6c9
mov al, bl
jmp 0x100fdf9
push 1
mov edi, dword [ebp - 0x130]
push edi
push ebx
lea ecx, [ebp - 0x11c]
call fcn.0101dcc0
test al, al
jne 0x100fd4b
push 0
push edi
push ebx
lea ecx, [ebp - 0x11c]
call fcn.0101dcc0
test al, al
jne 0x100fd4b
mov eax, dword [ebp - 0x124]
mov dword [eax], 4
jmp 0x100fdec
push edi
lea ecx, [ebp - 0x11c]
call fcn.0101ca3f
test al, al
je 0x100fcee
lea eax, [ebp - 0x13c]
push eax
push 0x80000003
call dword [sym.imp.ntdll.dll_NtSetThreadExecutionState]
mov dword [ebp - 0x134], eax
and dword [ebp - 4], 0
push dword [ebp - 0x124]
push dword [ebp + 0x18]
push edi
push dword [ebp - 0x140]
lea eax, [ebp - 0x11c]
push eax
push ebx
call dword [esi*8 + 0x1060024]
mov bl, al
mov byte [ebp - 0x129], bl
push dword [ebp - 0x13c]
push dword [ebp - 0x134]
call fcn.010125a4
jmp 0x100fdd7
or dword [ebp - 4], 0xffffffff
jmp 0x100fcfc
mov eax, dword [ebp - 0x124]
mov dword [eax], 1
lea ecx, [ebp - 0x11c]
call fcn.0101b6c9
xor al, al
mov ecx, dword [ebp - 0x1c]
call fcn.0105f135
call fcn.0100ce8f
ret 0x18