Function at 0xc642de
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
mov esi, 0xd313ac
push edi
mov ecx, esi
call fcn.00c6a961
lea eax, [ebp - 0x148]
mov byte [0xd313de], 0
push eax
mov dword [ebp - 0x148], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x144]
mov ecx, esi
mov dword [0xd313a0], eax
mov eax, dword [ebp - 0x140]
mov dword [0xd313a4], eax
mov eax, dword [ebp - 0x13c]
mov dword [0xd313a8], eax
lea eax, [ebp - 0x134]
push eax
call fcn.00c66b57
xor eax, eax
or ecx, 0xffffffff
cmp dword [0xd313b0], eax
ja 0xca3617
mov eax, ecx
cmp eax, ecx
jne 0xca3656
push ecx
mov esi, 0xd313ac
push 0
mov ecx, esi
call fcn.00c693b2
push 0xcfcb64
mov ecx, esi
call fcn.00c637a0
mov eax, dword [0xd313a0]
xor edx, edx
mov word [0xd313d9], dx
mov dword [0xd313bc], edx
mov dword [0xd313c0], edx
mov dword [0xd313c4], edx
mov dword [0xd313c8], edx
mov dword [0xd313cc], edx
mov dword [0xd313d0], edx
mov dword [0xd313d4], edx
mov byte [0xd313d8], dl
push 1
pop ecx
sub eax, 5
je 0xca37df
sub eax, ecx
jne 0xca365d
mov eax, dword [0xd313a4]
mov byte [0xd313bd], cl
mov byte [0xd313bf], cl
test eax, eax
je 0xca3726
cmp eax, ecx
je 0xca374d
cmp eax, 2
jne 0xca3791
mov byte [0xd313c7], cl
mov byte [0xd313c5], cl
mov byte [0xd313c1], cl
mov byte [0xd313c9], cl
cmp byte [ebp - 0x2e], cl
jne 0xca3780
mov byte [0xd313c8], cl
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
xor edx, edx
inc edx
cmp dword [ebp - 4], edx
jne 0xc64494
mov byte [0xd313da], dl
push 9
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
test dl, dl
je 0xca3824
push 0xcfcbe0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0xc6449c
push str.GetNativeSystemInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0xc6449c
lea ecx, [ebp - 0x2c]
push ecx
call eax
test esi, esi
je 0xc64481
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ax, word [ebp - 0x2c]
pop edi
mov word [0xd313dc], ax
mov eax, 0xd313a0
pop esi
leave
ret
mov dl, byte [0xd313da]
jmp 0xc6443d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0xc64476
mov esi, dword [0xd313ac]
xor edi, edi
push 0x20
xor edx, edx
movzx esi, word [esi + eax*2]
mov dword [ebp - 8], esi
pop esi
cmp word [ebp - 8], si
jne 0xca3632
inc edx
movzx esi, word [edi*2 + 0xcfcb66]
inc edi
test si, si
jne 0xca362b
test edx, edx
je 0xc64355
inc eax
cmp eax, dword [0xd313b0]
jb 0xca3617
jmp 0xc64353
mov ecx, eax
jmp 0xc6435d
sub eax, 4
jne 0xc6441b
mov byte [0xd313bd], cl
mov byte [0xd313bf], cl
mov byte [0xd313cb], cl
mov byte [0xd313c9], cl
mov byte [0xd313c7], cl
mov byte [0xd313c5], cl
mov byte [0xd313c1], cl
mov byte [0xd313cd], cl
mov byte [0xd313cf], cl
mov byte [0xd313d1], cl
cmp dword [0xd313a4], edx
jne 0xc6441b
cmp byte [ebp - 0x2e], cl
jne 0xca36db
cmp dword [ebp - 0x13c], 0x55ec
jae 0xca36ca
mov byte [0xd313d0], cl
jmp 0xc6441b
mov byte [0xd313d3], cl
mov byte [0xd313d2], cl
jmp 0xc6441b
cmp dword [ebp - 0x13c], 0x44ff
jae 0xca36f8
mov byte [0xd313d5], cl
mov byte [0xd313d4], cl
jmp 0xc6441b
cmp dword [ebp - 0x13c], 0x4f7c
jae 0xca3715
mov byte [0xd313d7], cl
mov byte [0xd313d6], cl
jmp 0xc6441b
mov byte [0xd313d9], cl
mov byte [0xd313d8], cl
jmp 0xc6441b
mov byte [0xd313c1], cl
cmp byte [ebp - 0x2e], cl
jne 0xca373c
mov byte [0xd313c0], cl
jmp 0xc6441b
mov byte [0xd313c3], cl
mov byte [0xd313c2], cl
jmp 0xc6441b
mov byte [0xd313c1], cl
mov byte [0xd313c3], cl
mov byte [0xd313c5], cl
cmp byte [ebp - 0x2e], cl
jne 0xca376f
mov byte [0xd313c4], cl
jmp 0xc6441b
mov byte [0xd313c7], cl
mov byte [0xd313c6], cl
jmp 0xc6441b
mov byte [0xd313cb], cl
mov byte [0xd313ca], cl
jmp 0xc6441b
cmp eax, 3
jne 0xc6441b
mov byte [0xd313cb], cl
mov byte [0xd313c9], cl
mov byte [0xd313c7], cl
mov byte [0xd313c5], cl
mov byte [0xd313c1], cl
mov byte [0xd313cd], cl
cmp byte [ebp - 0x2e], cl
jne 0xca37ce
mov byte [0xd313cc], cl
jmp 0xc6441b
mov byte [0xd313cf], cl
mov byte [0xd313ce], cl
jmp 0xc6441b
mov eax, dword [0xd313a4]
cmp eax, ecx
jne 0xca3806
mov byte [0xd313bd], cl
mov byte [0xd313bc], cl
mov al, byte [ebp - 0x30]
shr al, 6
and al, cl
mov byte [0xd313de], al
jmp 0xc6441b
cmp eax, 2
jne 0xca37f4
mov byte [0xd313bd], cl
mov byte [0xd313bf], cl
cmp byte [ebp - 0x2e], cl
je 0xca37ee
mov byte [0xd313be], cl
jmp 0xca37f4
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0xc64481