Function at 0x417600
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c856
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x55c640]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf8], edx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xf0], esi
push ecx
push 0
push 0x410
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x417871
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp word [ebp - 0x88], 9
mov edx, 0x20
mov ecx, 0x10
mov dword [ebp - 0xec], 0x70
cmove ecx, edx
mov edx, 0x40
cmove edx, dword [ebp - 0xec]
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xe0], edx
lea eax, [ecx + 8]
push eax
mov dword [ebp - 0xe8], eax
call fcn.004863cc
push dword [ebp - 0xe8]
mov dword [ebp - 0xe4], eax
push 0
push eax
call fcn.00489f10
mov eax, dword [ebp - 0xe0]
add eax, 0x10
push eax
mov dword [ebp - 0xec], eax
call fcn.004863cc
push dword [ebp - 0xe8]
mov dword [ebp - 0xd8], eax
push 0
push dword [ebp - 0xe4]
call fcn.00489f10
add esp, 0x20
cmp dword [ebp - 0x1c], 0
je 0x41782c
push 0x30
lea eax, [ebp - 0xd4]
push 0
push eax
call fcn.00489f10
add esp, 0xc
push str.NtWow64QueryInformationProcess64
push 0x541000
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x30
lea ecx, [ebp - 0xd4]
push ecx
push 0
push edi
call eax
test eax, eax
jne 0x41786a
push str.NtWow64ReadVirtualMemory64
push 0x541000
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push dword [ebp - 0xe8]
mov dword [ebp - 0xf4], eax
push dword [ebp - 0xe4]
push dword [ebp - 0xc8]
push dword [ebp - 0xcc]
push edi
call eax
test eax, eax
jne 0x4178cb
mov ecx, dword [ebp - 0xdc]
push eax
push eax
push dword [ebp - 0xec]
mov eax, dword [ebp - 0xe4]
push dword [ebp - 0xd8]
mov eax, dword [eax + ecx]
cdq
push edx
push eax
push edi
call dword [ebp - 0xf4]
test eax, eax
jne 0x4178cb
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xe0]
movzx esi, word [eax + ecx + 2]
push esi
call fcn.004863cc
add esp, 4
mov ecx, eax
mov eax, esi
mov dword [ebp - 0xdc], ecx
cdq
push 0
push edx
push eax
mov eax, dword [ebp - 0xd8]
push ecx
mov ecx, dword [ebp - 0xe0]
push dword [eax + ecx + 0xc]
push dword [eax + ecx + 8]
push edi
call dword [ebp - 0xf4]
test eax, eax
je 0x41793e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xf0]
push str.failed
call fcn.0044b8a0
jmp 0x417a79
xorps xmm0, xmm0
push str.NtQueryInformationProcess
push 0x541000
movdqu xmmword [ebp - 0xa0], xmm0
movq qword [ebp - 0x90], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0x18
lea ecx, [ebp - 0xa0]
push ecx
push 0
push edi
call eax
test eax, eax
jne 0x417884
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
push str.failed
mov ecx, esi
call fcn.004511b0
jmp 0x417a79
push 0
push dword [ebp - 0xe8]
push dword [ebp - 0xe4]
push dword [ebp - 0x9c]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4178cb
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0xdc]
push 0
push dword [ebp - 0xec]
push dword [ebp - 0xd8]
push dword [eax + ecx]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x4178e3
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
push str.failed
call fcn.0044b8a0
jmp 0x417a79
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xe0]
movzx esi, word [eax + ecx + 2]
push esi
call fcn.004863cc
mov ecx, dword [ebp - 0xe0]
add esp, 4
mov dword [ebp - 0xdc], eax
push 0
push esi
push eax
mov eax, dword [ebp - 0xd8]
push dword [eax + ecx + 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x41793e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xf0]
push str.failed
call fcn.0044b8a0
jmp 0x417a79
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x110]
call fcn.0044c580
lea edx, [ebp - 0x110]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.00468940
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 3
call fcn.0040a970
lea ecx, [ebp - 0x64]
call fcn.0040af00
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0044b6f0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.0040af00
push dword [ebp - 0x3c]
cmp dword [ebp - 0x38], 0x10
lea eax, [ebp - 0x4c]
push 0
cmovae eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
push eax
call fcn.00451530
push eax
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x64]
call fcn.0044bca0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x34]
call fcn.00457540
add esp, 4
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 7
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
push 1
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], 0x22
push eax
lea ecx, [ebp - 0x34]
call fcn.00451530
test eax, eax
jne 0x417a1f
push dword [ebp - 0x24]
lea eax, [ebp - 0xa0]
push 1
push eax
lea ecx, [ebp - 0x34]
call fcn.0044bca0
push eax
lea ecx, [ebp - 0x34]
call fcn.0044b810
lea ecx, [ebp - 0xa0]
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
mov ecx, dword [ebp - 0xf0]
lea eax, [ebp - 0x34]
cmp ecx, eax
je 0x417a36
push 0xffffffffffffffff
push 0
push eax
call fcn.00451080
mov ecx, edi
call fcn.00416040
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00407c10
mov ecx, dword [ebp - 0xf8]
push eax
call fcn.0044b810
lea ecx, [ebp - 0xa0]
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
lea ecx, [ebp - 0x34]
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
lea ecx, [ebp - 0x4c]
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
lea ecx, [ebp - 0x64]
call sym.Dayz_updater.exe_public:_void___thiscall_pbo::signature::destructor_void_
cmp dword [ebp + 0x20], 0x10
jb 0x417a8a
push dword [ebp + 0xc]
call fcn.00485250
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00484516
mov esp, ebp
pop ebp
ret