Function at 0x4f9750
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x638e5e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
push esi
push edi
mov eax, dword [0x6a6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], edi
push 0x11
push 2
push 2
push dword [ebx + 8]
call fcn.005d2ec0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0xb1], xmm0
movups xmmword [edi + 0xc1], xmm0
movq qword [edi + 0xd1], xmm0
mov dword [edi + 0xd9], 0
mov word [edi + 0x109], ax
mov dword [edi + 0x10b], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
mov dword [edi], vtable.CRRSheetEmulator.0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov dword [edi + 0x10f], eax
mov dword [edi + 0x113], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x2c]
mov dword [edi + 0x127], eax
push ecx
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [edi + 0x117], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x11b], ecx
mov ecx, dword [ebp - 0x28]
mov dword [edi + 0x11f], eax
mov dword [edi + 0x123], ecx
mov dword [edi + 0x143], 0
mov dword [edi + 0x15b], 0
mov dword [edi + 0x15f], 0
mov byte [edi + 0x163], 0
mov dword [edi + 0x164], 0
mov dword [edi + 0x168], 0
mov dword [edi + 0x16c], 0
mov dword [edi + 0x170], 0
mov dword [edi + 0x174], 0
mov dword [edi + 0x178], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x180], edi
mov dword [edi + 0x184], 0
mov dword [edi + 0x18c], 0
mov dword [edi + 0x190], 0
mov byte [edi + 0x194], 0
mov dword [edi + 0x195], 0
mov dword [edi + 0x199], 0
mov dword [edi + 0x19d], 0
mov dword [edi + 0x1a1], 0
mov dword [edi + 0x1a5], 0
mov dword [edi + 0x1a9], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x1b1], edi
mov dword [edi + 0x1b5], 1
mov dword [edi + 0x1bd], 0
mov dword [edi + 0x1c1], 0
mov byte [edi + 0x1c5], 0
mov dword [edi + 0x1c6], 0
mov dword [edi + 0x1ca], 0
mov dword [edi + 0x1ce], 0
mov dword [edi + 0x1d2], 0
mov dword [edi + 0x1d6], 0
mov dword [edi + 0x1da], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x1e2], edi
mov dword [edi + 0x1e6], 2
mov dword [edi + 0x1ee], 0
mov dword [edi + 0x1f2], 0
mov byte [edi + 0x1f6], 0
mov dword [edi + 0x1f7], 0
mov dword [edi + 0x1fb], 0
mov dword [edi + 0x1ff], 0
mov dword [edi + 0x203], 0
mov dword [edi + 0x207], 0
mov dword [edi + 0x20b], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x213], edi
mov dword [edi + 0x217], 3
mov dword [edi + 0x21f], 0
mov dword [edi + 0x223], 0
mov byte [edi + 0x227], 0
mov dword [edi + 0x228], 0
mov dword [edi + 0x22c], 0
mov dword [edi + 0x230], 0
mov dword [edi + 0x234], 0
mov dword [edi + 0x238], 0
mov dword [edi + 0x23c], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x244], edi
mov dword [edi + 0x248], 4
mov dword [edi + 0x250], 0
mov dword [edi + 0x254], 0
mov byte [edi + 0x258], 0
mov dword [edi + 0x259], 0
mov dword [edi + 0x25d], 0
mov dword [edi + 0x261], 0
mov dword [edi + 0x265], 0
mov dword [edi + 0x269], 0
mov dword [edi + 0x26d], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x275], edi
mov dword [edi + 0x279], 0xa
mov dword [edi + 0x281], 0
mov dword [edi + 0x285], 0
mov byte [edi + 0x289], 0
mov dword [edi + 0x28a], 0
mov dword [edi + 0x28e], 0
mov dword [edi + 0x292], 0
mov dword [edi + 0x296], 0
mov dword [edi + 0x29a], 0
mov dword [edi + 0x29e], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x2a6], edi
mov dword [edi + 0x2aa], 0xb
mov dword [edi + 0x2b2], 0
mov dword [edi + 0x2b6], 0
mov byte [edi + 0x2ba], 0
mov dword [edi + 0x2bb], 0
mov dword [edi + 0x2bf], 0
mov dword [edi + 0x2c3], 0
mov dword [edi + 0x2c7], 0
mov dword [edi + 0x2cb], 0
mov dword [edi + 0x2cf], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x2d7], edi
mov dword [edi + 0x2db], 0xc
mov dword [edi + 0x2e3], 0
mov dword [edi + 0x2e7], 0
mov byte [edi + 0x2eb], 0
mov dword [edi + 0x2ec], 0
mov dword [edi + 0x2f0], 0
mov dword [edi + 0x2f4], 0
mov dword [edi + 0x2f8], 0
mov dword [edi + 0x2fc], 0
mov dword [edi + 0x300], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x308], edi
mov dword [edi + 0x30c], 0x64
mov dword [edi + 0x314], 0
mov dword [edi + 0x318], 0
mov byte [edi + 0x31c], 0
mov dword [edi + 0x31d], 0
mov dword [edi + 0x321], 0
mov dword [edi + 0x325], 0
mov dword [edi + 0x329], 0
mov dword [edi + 0x32d], 0
mov dword [edi + 0x331], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x339], edi
mov dword [edi + 0x33d], 0x14
mov dword [edi + 0x345], 0
mov dword [edi + 0x349], 0
mov byte [edi + 0x34d], 0
mov dword [edi + 0x34e], 0
mov dword [edi + 0x352], 0
mov dword [edi + 0x356], 0
mov dword [edi + 0x35a], 0
mov dword [edi + 0x35e], 0
mov dword [edi + 0x362], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x36a], edi
mov dword [edi + 0x36e], 0x6e
mov dword [edi + 0x376], 0
mov dword [edi + 0x37a], 0
mov byte [edi + 0x37e], 0
mov dword [edi + 0x37f], 0
mov dword [edi + 0x383], 0
mov dword [edi + 0x387], 0
mov dword [edi + 0x38b], 0
mov dword [edi + 0x38f], 0
mov dword [edi + 0x393], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x39b], edi
mov dword [edi + 0x39f], 0x78
mov dword [edi + 0x3a7], 0
mov dword [edi + 0x3ab], 0
mov byte [edi + 0x3af], 0
mov dword [edi + 0x3b0], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov dword [edi + 0x3c0], 0
mov dword [edi + 0x3c4], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x3cc], edi
mov dword [edi + 0x3d0], 0x82
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov byte [edi + 0x3e0], 0
mov dword [edi + 0x3e1], 0
mov dword [edi + 0x3e5], 0
mov dword [edi + 0x3e9], 0
mov dword [edi + 0x3ed], 0
mov dword [edi + 0x3f1], 0
mov dword [edi + 0x3f5], 0
mov dword [edi + method.CMaaSockTimerT_class_CFtpServerData_.virtual_0], vtable.CMaaSockTimerT_class_CRRSheetEmulator_.0
mov dword [edi + 0x3fd], edi
mov dword [edi + 0x401], 0x12c
mov dword [edi + 0x409], 0
mov dword [edi + 0x40d], 0
mov byte [edi + 0x411], 0
mov dword [edi + 0x412], 0
mov dword [edi + 0x416], 0
mov dword [edi + 0x41a], 0
mov dword [edi + 0x41e], 0
mov dword [edi + 0x422], 0
mov dword [edi + 0x426], 0
mov dword [edi + 0x405], 0x667a70
mov dword [edi + 0x42e], edi
mov dword [edi + 0x432], 0x132
mov dword [edi + 0x43a], 0
mov dword [edi + 0x43e], 0
mov byte [edi + 0x442], 0
mov dword [edi + 0x443], 0
mov dword [edi + 0x447], 0
mov dword [edi + 0x44b], 0
mov dword [edi + 0x44f], 0
mov dword [edi + 0x453], 0
mov dword [edi + 0x457], 0
mov dword [edi + 0x436], 0x667a70
mov dword [edi + 0x45f], edi
mov dword [edi + 0x463], 0x12d
mov dword [edi + 0x46b], 0
mov dword [edi + 0x46f], 0
mov byte [edi + 0x473], 0
mov dword [edi + 0x474], 0
mov dword [edi + 0x478], 0
mov dword [edi + 0x47c], 0
mov dword [edi + 0x480], 0
mov dword [edi + 0x484], 0
mov dword [edi + 0x488], 0
mov dword [edi + 0x467], 0x667a70
mov dword [edi + 0x490], edi
mov dword [edi + 0x494], 0x12e
push 0
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [edi + 0x498]
push 0
push 0x326
call fcn.0040a300
lea eax, [edi + 0x4bd]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
call fcn.005a45d0
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x4fa035
mov dword [esi], 1
xor eax, eax
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
mov word [esi + 0x10], ax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4fa03a
cmp dword [esi + 0xc], eax
jne 0x4fa03a
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4fa045
lock inc dword [esi]
mov eax, esi
jmp 0x4fa047
xor eax, eax
push 0x6aefbc
mov byte [ebp - 4], 0x15
lea ecx, [edi + 0x4c1]
push 0
mov dword [edi + 0x4bd], eax
call fcn.005bb690
test esi, esi
je 0x4fa079
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
jne 0x4fa079
push ecx
mov ecx, esi
call fcn.005a47b0
mov dword [edi + 0x4c9], 0
mov dword [edi + 0x4cd], 0
mov dword [edi + 0x4d1], 0
push fcn.004250c0
push fcn.00406030
push 0x700
push 4
lea eax, [edi + 0x10ef]
mov byte [ebp - 4], 0x1a
push eax
mov byte [edi + 0x4d6], 0
call fcn.00606f18
push fcn.004250c0
push fcn.00406030
push 0x700
push 4
lea eax, [edi + 0x30ef]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00606f18
lea eax, [edi + 0x498]
mov byte [ebp - 4], 0x1c
mov esi, 0x6ac8f0
mov edi, eax
push 0
push esi
push esi
mov ecx, edi
call fcn.00408c20
add esi, 4
cmp esi, 0x6ad304
jl 0x4fa0f1
mov edi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [edi + 0x12b], xmm0
movsd qword [edi + 0x13b], xmm0
mov dword [edi + 0x147], 0
mov dword [edi + 0x14b], 0
mov dword [edi + 0x14f], 0
mov dword [edi + 0x153], 0
mov byte [edi + 0x4d5], 0
mov dword [edi + 0x10e7], 0
mov dword [edi + 0x10eb], 0
mov dword [edi + 0x10df], 0
mov dword [edi + 0x10e3], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x4cf3], eax
test eax, eax
jne 0x4fa190
mov dword [edi + 0x4cf3], 0xffffffff
or eax, 0xffffffff
push 0
mov dword [edi + 0x4cef], eax
mov dword [edi + 0x4cf7], 0
call fcn.0060cd03
add esp, 4
mov dword [edi + 0x4cfb], eax
mov ecx, edi
mov dword [edi + 0x4cff], edx
call fcn.005d3170
mov dword [edi + 0x4d7], 0
mov byte [ebp - 4], 0x1c
mov esi, dword [0x6ac16c]
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x4fa1eb
mov dword [esi + 8], 0
jmp 0x4fa1ef
test eax, eax
jne 0x4fa1f8
inc dword [esi + 0xc]
inc dword [esi + 8]
inc dword [esi + 4]
mov eax, dword [0x6ac684]
test eax, eax
je 0x4fa3ac
push 0
lea edx, [eax + 0x347]
mov eax, dword [0x6aefe8]
push ecx
mov ecx, esp
test eax, eax
je 0x4fa21e
lock inc dword [eax]
jmp 0x4fa220
xor eax, eax
mov dword [ecx], eax
mov eax, dword [0x6aefd8]
push ecx
mov ecx, esp
test eax, eax
je 0x4fa233
lock inc dword [eax]
jmp 0x4fa235
xor eax, eax
mov dword [ecx], eax
mov eax, dword [0x6aefbc]
push ecx
mov ecx, esp
test eax, eax
je 0x4fa248
lock inc dword [eax]
jmp 0x4fa24a
xor eax, eax
mov dword [ecx], eax
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, edx
call fcn.005c0e30
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi + 0x4c9]
je 0x4fa28d
test eax, eax
je 0x4fa26d
lock inc dword [eax]
mov eax, dword [ebp - 0x18]
mov ecx, dword [edi + 0x4c9]
mov dword [edi + 0x4c9], eax
test ecx, ecx
je 0x4fa28d
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
jne 0x4fa28d
push ecx
call fcn.005a47b0
mov byte [ebp - 4], 0x1e
mov ecx, dword [0x6ac16c]
call fcn.005e0810
call fcn.005a45d0
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
je 0x4fa2d8
mov dword [esi], 1
xor eax, eax
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
mov word [esi + 0x10], ax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4fa2dd
cmp dword [esi + 0xc], eax
jne 0x4fa2dd
push ecx
mov ecx, esi
call fcn.005a47b0
xor esi, esi
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x4fa2e9
lock inc dword [esi]
mov dword [ebp - 0x48], esi
jmp 0x4fa2f0
mov dword [ebp - 0x48], 0
push 0x6aefbc
push 0
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x22
call fcn.005bb690
test esi, esi
je 0x4fa319
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
jne 0x4fa319
push ecx
mov ecx, esi
call fcn.005a47b0
mov dword [ebp - 0x20], 0
lea esi, [edi + 0x498]
mov byte [ebp - 4], 0x25
mov ecx, esi
call fcn.00574b50
push 0x1f11
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push esi
push ecx
mov ecx, esp
test eax, eax
je 0x4fa352
lock inc dword [eax]
jmp 0x4fa354
xor eax, eax
mov dword [ecx], eax
lea ecx, [ebp - 0x48]
call fcn.005c18d0
test al, al
je 0x4fa371
lea eax, [ebp - 0x48]
push eax
lea ecx, [edi + 0x4bd]
call fcn.005c1590
mov ecx, dword [ebp - 0x20]
or esi, 0xffffffff
test ecx, ecx
je 0x4fa38a
mov eax, esi
lock xadd dword [ecx], eax
dec eax
jne 0x4fa38a
push ecx
call fcn.005a47b0
lea ecx, [ebp - 0x48]
call fcn.005c0900
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4fa3bb
lock xadd dword [ecx], esi
dec esi
jne 0x4fa3bb
push ecx
call fcn.005a47b0
jmp 0x4fa3bb
mov byte [ebp - 4], 0x1c
mov ecx, dword [0x6ac16c]
call fcn.005e0810
push 0x74
call fcn.00606edf
add esp, 4
mov dword [ebp - 0x38], eax
push 0
mov ecx, eax
mov byte [ebp - 4], 0x27
call fcn.0050e570
mov byte [ebp - 4], 0x1c
mov dword [edi + 0x4db], eax
test eax, eax
je 0x4fa603
push 0x400
lea eax, [edi + 0x4df]
push 0
push eax
call fcn.00608810
add esp, 0xc
lea eax, [edi + 0x8df]
push 0x800
push 0
push eax
call fcn.00608810
add edi, 0x2cef
mov eax, 0xf4240
mov ecx, 0x100
add esp, 0xc
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0x14]
push dword [edi + 4]
lea ecx, [edi + 0x157]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x188]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x1b9]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x1ea]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x21b]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x24c]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x27d]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x2ae]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x310]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x2df]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x341]
call fcn.005d7c00
push dword [edi + 4]
lea ecx, [edi + 0x372]
call fcn.005d7c00
mov eax, edi
lea ecx, [edi + 0x3a3]
push dword [eax + 4]
call fcn.005d7c00
mov ecx, edi
push dword [ecx + 4]
lea ecx, [ecx + 0x3d4]
call fcn.005d7c00
mov ecx, edi
push dword [ecx + 4]
lea ecx, [ecx + 0x405]
call fcn.005d7c00
mov ecx, edi
push dword [ecx + 4]
lea ecx, [ecx + 0x436]
call fcn.005d7c00
mov ecx, edi
push dword [ecx + 4]
lea ecx, [ecx + 0x467]
call fcn.005d7c00
push 1
mov ecx, edi
push 0
push 0x186a0
lea ecx, [ecx + 0x27d]
call fcn.0041b220
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
call fcn.005e1d80
mov eax, 0xf4240
lea ecx, [edi + 0x2df]
sub eax, dword [ebp - 0x20]
push 1
cdq
push edx
push eax
call fcn.0041b220
push 1
mov esi, edi
push 0
push 0x2dc6c0
lea ecx, [esi + 0x310]
call fcn.0041b220
push 1
push 0
push 0x3938700
lea ecx, [esi + 0x1ea]
call fcn.0041b220
push 1
push 0
push 0x989680
lea ecx, [edi + 0x3a3]
call fcn.0041b220
push 1
push 0
push 0xe4e1c0
lea ecx, [esi + 0x3d4]
call fcn.0041b220
push 1
push 0
push 0xe4e1c0
lea ecx, [esi + 0x405]
call fcn.0041b220
push 1
push 0
push 0xf4240
lea ecx, [esi + 0x436]
call fcn.0041b220
push 1
push 0
push 0xf4240
lea ecx, [esi + 0x467]
call fcn.0041b220
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push dword [0x6ac5ac]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x6a3c10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push eax
call fcn.006089ec
int3