Function at 0x4942e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb7d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x60], 0
movdqu xmmword [ebp - 0x5c], xmm0
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [edi + 4], eax
lea eax, [ebp - 0x60]
mov dword [edi], vtable.blackbone::Native.0
push eax
mov dword [edi + 8], 0
mov word [edi + 0xc], 0
mov byte [edi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp byte [ebp + 0xc], 0
mov eax, dword [ebp - 0x5c]
mov dword [edi + 0x10], eax
je 0x494359
mov word [edi + 0xc], 0x101
mov dword [edi + 8], 0
mov byte [edi + 0xe], 1
jmp 0x4943ce
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_IsWow64Process]
push eax
call esi
lea eax, [ebp + 8]
push eax
push dword [edi + 4]
call esi
mov edx, dword [ebp + 0xc]
cmp edx, 1
mov ecx, dword [ebp + 8]
sete al
cmp ecx, 1
mov byte [edi + 0xc], al
sete al
mov byte [edi + 0xd], al
cmp edx, 1
jne 0x4943b6
cmp ecx, edx
jne 0x4943ad
mov dword [edi + 8], 0
jmp 0x4943ce
mov dword [edi + 8], 2
jmp 0x4943ce
test edx, edx
jne 0x4943c7
test ecx, ecx
jne 0x4943c7
mov dword [edi + 8], 1
jmp 0x4943ce
mov dword [edi + 8], 3
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x536448
call esi
push str.kernel32.dll
mov dword [ebp + 0xc], eax
call esi
push 0x19
push 0x53645c
lea ecx, [ebp - 0x24]
mov dword [ebp + 8], eax
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
mov esi, dword [ebp + 0xc]
mov edx, esi
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x494435
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x17
push 0x5364b0
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x49447f
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x18
push 0x536494
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x4944c9
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x11
push str.NtDuplicateObject
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x494513
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0xd
push str.NtQueryObject
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x49455d
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0xe
push str.NtQuerySection
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x4945a7
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x1a
push str.RtlCreateActivationContext
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x4945f1
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x14
push 0x53652c
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x49463b
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x10
push 0x536518
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x494685
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x13
push str.NtLockVirtualMemory
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x4946cf
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x15
push 0x536544
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov dword [ebp - 4], 0xa
lea ecx, [ebp - 0x24]
mov esi, dword [ebp + 8]
mov edx, esi
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x49471c
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x15
push 0x536584
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x24], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 0xb
lea ecx, [ebp - 0x24]
call fcn.00485160
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0x10
jb 0x494766
push dword [ebp - 0x24]
call fcn.004cd56c
add esp, 4
push 0x12
push str.Wow64SuspendThread
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x3c], 0
call fcn.004762c0
mov edx, esi
mov dword [ebp - 4], 0xc
lea ecx, [ebp - 0x3c]
call fcn.00485160
cmp dword [ebp - 0x28], 0x10
jb 0x4947a9
push dword [ebp - 0x3c]
call fcn.004cd56c
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 8