Function at 0x10002899
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], esi
call fcn.100023c6
test eax, eax
je 0x10002af1
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x10002ae6
mov eax, dword [edi + 0x3c]
mov ecx, esi
add eax, 0xf8
push eax
push dword [ebp + 0xc]
call fcn.100023c6
test eax, eax
je 0x10002af1
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
jne 0x10002ae6
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x10002ae6
test byte [ebx + 0x38], 1
jne 0x10002ae6
movzx eax, word [ebx + 0x14]
movzx edi, word [ebx + 6]
add eax, 0x24
test edi, edi
je 0x10002947
mov ecx, dword [ebp - 4]
lea edx, [eax + ebx]
cmp dword [edx + 4], 0
mov eax, dword [ebx + 0x38]
cmovne eax, dword [edx + 4]
add eax, dword [edx]
lea edx, [edx + 0x28]
cmp eax, ecx
cmovbe eax, ecx
mov ecx, eax
sub edi, 1
jne 0x10002928
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
dec eax
add eax, ecx
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
and eax, edx
and edi, edx
cmp edi, eax
jne 0x10002ae6
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100029a5
push 4
push 0x3000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100029a5
push 0xe
jmp 0x10002aeb
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jne 0x100029ce
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1000299e
mov dword [edi + 4], ecx
mov ecx, esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push dword [ebp + 0xc]
call fcn.100023c6
test eax, eax
je 0x10002ac6
push 4
push 0x1000
push dword [ebx + 0x54]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.10002c2e
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push edi
add eax, esi
mov esi, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, esi
push edx
call fcn.100023e4
test eax, eax
je 0x10002ac6
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
sub eax, dword [ebx + 0x34]
je 0x10002a6e
push eax
push edi
mov ecx, esi
call fcn.10002b74
jmp 0x10002a71
xor eax, eax
inc eax
push edi
mov ecx, esi
mov dword [edi + 0x18], eax
call fcn.10002267
test eax, eax
je 0x10002ac6
push edi
mov ecx, esi
call fcn.1000259d
test eax, eax
je 0x10002ac6
push edi
mov ecx, esi
call fcn.100024c9
test eax, eax
je 0x10002ac6
mov eax, dword [edi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x10002ade
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [edi + 0x14], 0
je 0x10002ad9
push 0
push 1
push 0x10000000
call eax
test eax, eax
jne 0x10002ad0
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov ecx, esi
call fcn.100026cc
jmp 0x10002af1
mov dword [edi + 0x10], 1
jmp 0x10002ae2
mov dword [edi + 0x2c], eax
jmp 0x10002ae2
and dword [edi + 0x2c], 0
mov eax, edi
jmp 0x10002af3
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18