Function at 0x6c99d6a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x30
cmp eax, 8
jbe 0x6c99d880
cmp eax, 0xf
ja 0x6c99d7a3
mov ebx, 0xffffffb0
mov ebp, 0x10
cmp edx, ebx
jae 0x6c99d7d5
lea esi, [edx + 0xb]
mov eax, 0x10
and esi, 0xfffffff8
cmp edx, 0xa
cmovbe esi, eax
lea eax, [ebp + esi + 0xc]
mov dword [esp], eax
call fcn.6c99b740
mov ebx, eax
test eax, eax
je 0x6c99d7d5
mov ecx, dword [0x6ca3e8b0]
lea eax, [eax - 8]
mov dword [esp + 8], eax
test ecx, ecx
je 0x6c99d8d0
mov eax, dword [0x6ca3e894]
and eax, 2
mov dword [esp + 4], eax
je 0x6c99d74a
mov edi, 1
jmp 0x6c99d730
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
xor eax, eax
lock cmpxchg dword [0x6ca3e898], edi
test eax, eax
jne 0x6c99d720
mov eax, dword [0x6ca3e894]
and eax, 2
mov dword [esp + 4], eax
mov eax, ebx
xor edx, edx
div ebp
test edx, edx
jne 0x6c99d830
mov edx, dword [esp + 8]
mov ecx, dword [ebx - 4]
mov edi, ebx
xor ebx, ebx
mov eax, ecx
and eax, 1
mov dword [esp + 8], eax
jne 0x6c99d7e1
xor ebp, ebp
test byte [edx], 1
je 0x6c99d7e1
mov eax, dword [esp + 4]
test eax, eax
jne 0x6c99d81a
test ebx, ebx
je 0x6c99d78d
mov dword [esp], ebx
call fcn.6c99ce10
test ebp, ebp
je 0x6c99d799
mov dword [esp], ebp
call fcn.6c99ce10
add esp, 0x30
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [eax - 1]
test ecx, eax
je 0x6c99d96a
cmp eax, 0x10
je 0x6c99d6b9
mov ebp, 0x10
lea esi, [esi]
add ebp, ebp
cmp eax, ebp
ja 0x6c99d7c0
mov ebx, 0xffffffc0
sub ebx, ebp
cmp edx, ebx
jb 0x6c99d6cb
add esp, 0x30
xor edi, edi
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
and ecx, 0xfffffffc
lea eax, [esi + 0x10]
xor ebp, ebp
cmp ecx, eax
jbe 0x6c99d775
mov eax, dword [esp + 8]
lea ebp, [edx + esi]
add ebp, 8
or eax, esi
or eax, 2
mov dword [edx + 4], eax
mov eax, ecx
sub eax, esi
or eax, 3
mov dword [ebp - 4], eax
mov eax, dword [esp + 4]
or dword [edx + ecx + 4], 1
test eax, eax
je 0x6c99d781
xor eax, eax
xchg dword [0x6ca3e898], eax
jmp 0x6c99d781
mov eax, ebp
lea edx, [ebx + ebp - 1]
mov ecx, dword [esp + 8]
neg eax
and edx, eax
sub edx, 8
mov eax, edx
sub eax, ecx
cmp eax, 0xf
ja 0x6c99d850
add edx, ebp
mov eax, edx
sub eax, ecx
mov ecx, dword [ebx - 4]
lea edi, [edx + 8]
mov ebp, ecx
and ebp, 0xfffffffc
sub ebp, eax
and ecx, 1
jne 0x6c99d894
mov ecx, dword [ebx - 8]
test cl, 1
je 0x6c99d894
add eax, ecx
mov ecx, ebp
xor ebx, ebx
or ecx, 2
mov dword [edx], eax
mov dword [edx + 4], ecx
jmp 0x6c99d763
mov dword [esp], edx
call fcn.6c99b740
add esp, 0x30
mov edi, eax
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
ret
mov ecx, dword [edx + 4]
and ecx, 1
or ecx, ebp
or ecx, 2
mov dword [edx + 4], ecx
or dword [edx + ebp + 4], 1
mov ecx, dword [ebx - 4]
and ecx, 1
or ecx, eax
or ecx, 2
mov dword [ebx - 4], ecx
mov ecx, dword [esp + 8]
or dword [ecx + eax + 4], 1
mov ecx, dword [edx + 4]
jmp 0x6c99d763
mov dword [0x6ca3e8b8], 0x40000
mov edi, 1
mov dword [0x6ca3e8bc], 0x200000
mov dword [0x6ca3e8c0], 7
jmp 0x6c99d905
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
xor eax, eax
lock cmpxchg dword [0x6ca3e8c4], edi
test eax, eax
jne 0x6c99d8f5
mov edx, dword [0x6ca3e8ac]
test edx, edx
jne 0x6c99d93b
mov eax, dword [0x6ca3e8c0]
mov dword [0x6ca3e8ac], 0x58585858
mov dword [0x6ca3e898], 0
mov dword [0x6ca3e894], eax
xor eax, eax
xchg dword [0x6ca3e8c4], eax
lea eax, [esp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
sub esp, 4
mov eax, dword [esp + 0x10]
mov dword [0x6ca3e8b0], eax
mov eax, dword [esp + 0x28]
mov dword [0x6ca3e8b4], eax
jmp 0x6c99d707
mov ebx, 0xffffffc0
mov ebp, eax
sub ebx, eax
jmp 0x6c99d6c3