Function at 0x409a70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c160
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x77a1d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
xor edi, edi
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], edi
cmp dword [ebx + 0xc], edi
jne 0x409b4e
mov esi, dword [ebp + 8]
lea eax, [ebx + 0x18]
push eax
push esi
call fcn.00409870
test eax, eax
jne 0x409adc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push edi
push 0x20000080
push 4
push edi
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x409b19
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
je 0x409b19
push 0x46f3ac
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], edi
call fcn.00446e48
mov edx, dword [ebx + 8]
push edi
push edi
push edi
push 4
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebx + 0xc], eax
cmp eax, edi
jne 0x409b41
push 0x46f3ac
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], edi
call fcn.00446e48
mov ecx, dword [ebx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 8], edi
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
cmp dword [ebp + 0x1c], eax
jb 0x409b68
ja 0x409ac6
cmp dword [ebp + 0x18], ecx
ja 0x409ac6
mov esi, dword [0x77b57c]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], eax
cmp esi, edi
jne 0x409b89
push 0x77b560
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [0x77b57c]
cmp dword [ebp - 0x30], edi
jg 0x409b9a
jl 0x409b95
cmp dword [ebp - 0x34], esi
jae 0x409b9a
mov esi, dword [ebp - 0x34]
xor edi, edi
mov eax, dword [ebp + 0x14]
cmp eax, edi
jb 0x409bc7
ja 0x409ba8
cmp dword [ebp + 0x10], esi
jbe 0x409bc7
mov edx, esi
add edx, dword [ebp + 0x10]
push edi
mov ecx, edi
push esi
adc ecx, eax
push ecx
push edx
call fcn.00446de0
push edi
push esi
push edx
push eax
call fcn.00446cf0
mov esi, eax
mov edi, edx
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
cmp eax, edi
jb 0x409c09
ja 0x409bdd
cmp dword [ebp + 0x18], esi
jb 0x409c09
mov edx, dword [ebp + 0x18]
push edi
push esi
push eax
push edx
call fcn.00446ea0
push edi
push esi
push edx
push eax
mov dword [ebp + 0x18], ecx
call fcn.00446cf0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x1c], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
mov dword [ebp + 0x18], eax
jmp 0x409c12
mov ecx, dword [ebp + 0x18]
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0x1c], eax
push 0
push 2
push edi
lea edx, [esi + esi]
push esi
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 0
call fcn.00446cf0
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
add eax, esi
adc edx, edi
cmp edx, dword [ebx + 0x1c]
jb 0x409c48
ja 0x409c40
cmp eax, dword [ebx + 0x18]
jbe 0x409c48
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x409c5d
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebx + 0x10], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebx + 0xc]
push eax
push esi
push edi
push 2
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor esi, esi
mov dword [ebx + 0x10], eax
cmp eax, esi
jne 0x409c89
push 0x46f3ac
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], esi
call fcn.00446e48
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebx + 0x1c]
push edx
mov edx, dword [ebx + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push 2
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.00409940
test eax, eax
jne 0x409cf7
push 0x46f3ac
lea edx, [ebp - 0x28]
push edx
mov dword [ebp - 0x28], esi
call fcn.00446e48
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0xc]
xor edi, edi
cmp eax, edi
je 0x409cda
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
mov eax, dword [esi + 8]
cmp eax, edi
je 0x409ceb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, 0x409cf7
ret
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18