Function at 0x46d140
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x501814]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x46d3b6
xorps xmm0, xmm0
mov dword [ebp - 8], 0
lea eax, [ebp - 0x28]
push eax
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push pe_nt_image_headers32
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004a6d90
add esp, 0xc
mov dword [ebp - 0x260], 0x11c
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46d3b6
mov eax, dword [ebp - 0x258]
movzx ecx, word [ebp - 0x14c]
mov esi, dword [ebp - 0x25c]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x254]
push ebx
mov dword [ebp - 0x270], eax
movzx eax, word [ebp - 0x14a]
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0x268], esi
push 0x100
lea eax, [ebp - 0x130]
mov dword [ebp - 0x274], ecx
push 0
push eax
mov dword [ebp - 0x144], 0x11c
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
call fcn.004a6d90
add esp, 0xc
mov dword [ebp - 0x2c], 0x10000
xor eax, eax
mov dword [ebp - 0x30], eax
push 1
push 0x80
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
push edx
push eax
push 0x80
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
push str.wintrust.dll
sete byte [ebp - 0x278]
cmp word [ebp - 0x28], 9
sete byte [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x46d2b2
push str.CryptCATAdminAcquireContext2
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
mov esi, dword [ebp - 0x268]
setne byte [ebp - 0x264]
jmp 0x46d2b9
mov byte [ebp - 0x264], 0
pop ebx
test esi, esi
je 0x46d3b6
xorps xmm0, xmm0
lea ecx, [ebp - 0x1c]
push 0
push 0x1331
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call fcn.00494be0
push esi
push 0x1000337
lea ecx, [ebp - 0x1c]
call fcn.004951f0
test eax, eax
je 0x46d3ae
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x1c]
push 0x1000338
call fcn.004951f0
test eax, eax
je 0x46d3ae
push dword [ebp - 0x270]
lea ecx, [ebp - 0x1c]
push 0x1000339
call fcn.004951f0
test eax, eax
je 0x46d3ae
push dword [ebp - 0x274]
lea ecx, [ebp - 0x1c]
push 0x100033a
call fcn.004951f0
test eax, eax
je 0x46d3ae
push dword [ebp - 0x278]
lea ecx, [ebp - 0x1c]
push 0xb00033b
call fcn.00494c80
test eax, eax
je 0x46d3ae
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x1c]
push 0xb00033c
call fcn.00494c80
test eax, eax
je 0x46d3ae
push dword [ebp - 0x264]
lea ecx, [ebp - 0x1c]
push 0xb00039f
call fcn.00494c80
test eax, eax
je 0x46d3ae
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00495110
test eax, eax
je 0x46d3ae
lea ecx, [ebp - 0x1c]
call fcn.00494c10
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a559d
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.00494c10
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.004a559d
mov esp, ebp
pop ebp
ret