Function at 0x10003e1b
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], esi
call fcn.10003948
test eax, eax
je 0x10004073
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x10004068
mov eax, dword [edi + 0x3c]
mov ecx, esi
add eax, 0xf8
push eax
push dword [ebp + 0xc]
call fcn.10003948
test eax, eax
je 0x10004073
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
jne 0x10004068
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x10004068
test byte [ebx + 0x38], 1
jne 0x10004068
movzx eax, word [ebx + 0x14]
movzx edi, word [ebx + 6]
add eax, 0x24
test edi, edi
je 0x10003ec9
mov ecx, dword [ebp - 4]
lea edx, [eax + ebx]
cmp dword [edx + 4], 0
mov eax, dword [ebx + 0x38]
cmovne eax, dword [edx + 4]
add eax, dword [edx]
lea edx, [edx + 0x28]
cmp eax, ecx
cmovbe eax, ecx
mov ecx, eax
sub edi, 1
jne 0x10003eaa
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
dec eax
add eax, ecx
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
and eax, edx
and edi, edx
cmp edi, eax
jne 0x10004068
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10003f27
push 4
push 0x3000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10003f27
push 0xe
jmp 0x1000406d
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jne 0x10003f50
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10003f20
mov dword [edi + 4], ecx
mov ecx, esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push dword [ebp + 0xc]
call fcn.10003948
test eax, eax
je 0x10004048
push 4
push 0x1000
push dword [ebx + 0x54]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.100041b0
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push edi
add eax, esi
mov esi, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, esi
push edx
call fcn.10003966
test eax, eax
je 0x10004048
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
sub eax, dword [ebx + 0x34]
je 0x10003ff0
push eax
push edi
mov ecx, esi
call fcn.100040f6
jmp 0x10003ff3
xor eax, eax
inc eax
push edi
mov ecx, esi
mov dword [edi + 0x18], eax
call fcn.100037e9
test eax, eax
je 0x10004048
push edi
mov ecx, esi
call fcn.10003b1f
test eax, eax
je 0x10004048
push edi
mov ecx, esi
call fcn.10003a4b
test eax, eax
je 0x10004048
mov eax, dword [edi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x10004060
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [edi + 0x14], 0
je 0x1000405b
push 0
push 1
push 0x10000000
call eax
test eax, eax
jne 0x10004052
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov ecx, esi
call fcn.10003c4e
jmp 0x10004073
mov dword [edi + 0x10], 1
jmp 0x10004064
mov dword [edi + 0x2c], eax
jmp 0x10004064
and dword [edi + 0x2c], 0
mov eax, edi
jmp 0x10004075
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18