Function at 0x40e320
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov dword [0x46eca0], 0x4658a0
mov dword [0x46ec9c], edx
call fcn.0040e720
push 0x2c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.00422e10
add esp, 0xc
mov dword [0x46eca8], 0x11000
lea eax, [esp + 0x20]
mov dword [0x46ecac], 0xffffffff
mov ebx, 1
mov dword [0x46ecb0], 0x10000
mov dword [0x46ecb4], 0x10000
push 0
push 0x2c
push eax
push 0
mov dword [0x46ecb8], 0xffff
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp dword [0x46dac0], 0x3e
movzx eax, word [esp + 0x28]
mov word [0x46eca8], ax
movsx eax, byte [esp + 0x48]
mov word [0x46ecaa], ax
mov eax, dword [esp + 0x2c]
mov dword [0x46ecac], eax
mov eax, dword [esp + 0x38]
mov dword [0x46ecb0], eax
mov eax, dword [esp + 0x40]
mov dword [0x46ecb4], eax
mov eax, dword [esp + 0x44]
mov dword [0x46ecb8], eax
jb 0x40e405
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46eca4], eax
jmp 0x40e40a
mov eax, dword [0x46eca4]
test eax, eax
jne 0x40e44b
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x46eca4], eax
test eax, eax
je 0x40e6e9
push 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x46efc4
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
nop
test eax, eax
js 0x40e6e9
mov ax, bx
cmp ax, word [0x46ecaa]
sbb eax, eax
and eax, 0xfa0
mov dword [0x46dfcc], eax
mov eax, 0x46f438
test al, 7
jne 0x40e6de
mov eax, 0x46f420
xorps xmm0, xmm0
movlpd qword [0x46f438], xmm0
test al, 7
jne 0x40e6de
lea eax, [esp + 0x20]
movq qword [0x46f420], xmm0
mov edx, eax
mov dword [0x46f428], 0
mov ecx, 0x28
mov dword [0x46f42c], 0x200
mov dword [0x46f430], 0x38
movups xmmword [esp + 0x20], xmm0
mov dword [0x46ec88], eax
movups xmmword [esp + 0x30], xmm0
mov dword [0x46f020], eax
movq qword [esp + 0x40], xmm0
call fcn.00405ce0
mov esi, eax
mov edx, ebx
xor eax, eax
mov word [esi], ax
lock xadd dword [0x46ec8c], edx
inc edx
dec dl
mov dword [esi + 8], eax
movzx eax, dl
mov ecx, 0x28
mov byte [esi + 2], dl
mov dword [esi + 0xc], str.Type
mov dword [0x46ec88], esi
mov dword [eax*4 + 0x46f020], esi
movzx eax, dl
mov edx, esi
mov word [esi - 8], ax
mov dword [esi + 4], ebx
call fcn.00405ce0
mov edx, eax
mov ecx, ebx
xor eax, eax
mov word [edx], ax
lock xadd dword [0x46ec8c], ecx
inc ecx
dec cl
mov dword [edx + 4], eax
mov dword [edx + 8], eax
movzx eax, cl
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Alloc
mov dword [0x46ec84], edx
mov dword [eax*4 + 0x46f020], edx
call fcn.00407820
mov dword [0x46ee14], eax
nop dword [eax]
cmp eax, 0xffffffff
je 0x40e6e9
call fcn.004061e0
test al, al
je 0x40e6e9
cmp byte [0x7ffe03c4], bl
jne 0x40e5b4
mov eax, dword [0x7ffe03c0]
dec eax
cmp eax, 0x1f
ja 0x40e5b4
mov byte [0x46ecbc], bl
jmp 0x40e6b6
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea edx, [esp + 0x18]
call fcn.004112e0
test eax, eax
js 0x40e6af
mov ebp, dword [esp + 0x14]
xor eax, eax
movzx ebx, word [ebp + 0xa]
mov dword [esp + 0x14], ebx
movzx edi, bx
cmp ax, bx
jae 0x40e69b
mov si, word [esp + 0x18]
lea ecx, [ebp + 0x21]
mov edx, edi
movzx eax, byte ds:[ecx]
lea ecx, [ecx + 0x2c]
add si, ax
sub edx, 1
jne 0x40e5f6
cmp ebx, 1
jbe 0x40e69b
lea eax, ds:[edi + edi]
push eax
push 4
lfence
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea edx, [ebp + 0x21]
mov dword [0x46ecc4], ebx
xor ecx, ecx
movzx eax, si
lea edx, [edx + 0x2c]
mov dword [esp + 0x18], eax
lea ecx, [ecx + 2]
movzx eax, byte [edx - 0x2c]
mov word [ecx + ebx - 2], ax
sub edi, 1
je 0x40e656
mov ebx, dword [0x46ecc4]
jmp 0x40e633
push ebp
push 0
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x18]
test ax, ax
je 0x40e6aa
mov word [0x46ecbe], ax
mov eax, dword [esp + 0x14]
mov word [0x46ecc0], ax
xor eax, eax
mov byte [0x46ecbc], 0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00421161
add esp, 0x4c
ret
push ebp
push 0
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, 1
mov byte [0x46ecbc], 1
mov ax, word [0x46ecaa]
mov word [0x46ecbe], ax
xor eax, eax
mov word [0x46ecc0], bx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00421161
add esp, 0x4c
ret
push 0x80000002
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [esp + 0x54]
mov eax, 0xc0000001
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421161
add esp, 0x4c
ret