Function at 0x10006a10
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x358
push ebx
push ebp
push esi
mov dword [esp + 0x14], ecx
push edi
xor ebp, ebp
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 0x44], ebp
rep stosd dword es:[edi], eax
mov ecx, 6
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebp
mov byte [esp + 0x168], al
rep stosd dword es:[edi], eax
mov ecx, 0x7f
lea edi, [esp + 0x169]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.MirMemSearch.
mov dword [esp + 0x14], ebp
stosb byte es:[edi], al
call fcn.100078f0
mov edi, dword [esp + 0x378]
mov ebx, dword [esp + 0x37c]
add esp, 4
cmp edi, ebp
jne 0x10006ad6
cmp ebx, ebp
jne 0x10006ad6
push 0x10016624
call fcn.100078f0
mov esi, dword [esp + 0x374]
add esp, 4
cmp dword [esi], 0
je 0x10006e41
mov eax, dword [esi]
mov ecx, eax
mov edi, dword [eax + 4]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi], edi
test edi, edi
jne 0x10006ab1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x358
ret 0x18
mov esi, dword [esp + 0x370]
cmp ebx, 0xffffffff
jne 0x10006b4e
cmp dword [esi], 0
je 0x10006b4e
mov ebx, dword [esp + 0x380]
mov edi, ebx
and edi, 0xff
push edi
push 0x100165fc
call fcn.100078f0
mov esi, dword [esi]
add esp, 8
test esi, esi
je 0x10006e41
mov edx, dword [esi]
inc ebp
push edx
push ebp
push 0x100165dc
call fcn.100078f0
mov esi, dword [esi + 4]
add esp, 0xc
test bl, bl
je 0x10006b2f
cmp edi, ebp
jbe 0x10006e41
cmp ebp, 0x100
je 0x10006e41
test esi, esi
jne 0x10006b0e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x358
ret 0x18
test edi, edi
je 0x10006e41
test ebx, ebx
je 0x10006e41
cmp dword [esi], 0
jne 0x10006d92
push ebx
push 0x100165a4
call fcn.100078f0
add esp, 8
lea eax, [esp + 0x44]
mov dword [esp + 0x20], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor esi, esi
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push 0x1c
push ecx
mov eax, dword [edx + 0xbb0]
push esi
push eax
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov eax, dword [esp + 0x34]
cmp eax, 0x1000
jne 0x10006d74
test byte [esp + 0x38], 0xe4
je 0x10006d89
mov eax, dword [esp + 0x30]
cmp ebx, eax
ja 0x10006d89
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov eax, dword [esp + 0x34]
add esp, 4
mov ecx, eax
shr ecx, 0xc
push eax
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x170]
add eax, ecx
mov dword [esp + 0x24], ebp
push eax
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push ecx
push 0x10016560
push edx
call esi
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
add esp, 0x1c
xor edi, edi
push edi
push eax
mov eax, dword [edx + 0xbb0]
push ebp
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10006d12
mov ebp, dword [esp + 0x30]
xor esi, esi
mov ecx, ebp
sub ecx, ebx
je 0x10006cc0
xor ecx, ecx
test ebx, ebx
jbe 0x10006c7b
mov eax, dword [esp + 0x374]
mov edx, dword [esp + 0x1c]
sub edx, eax
add edx, esi
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x37c]
test edx, edx
je 0x10006c6a
mov dl, byte [esp + 0x380]
cmp byte [eax], dl
je 0x10006c75
mov edx, dword [esp + 0x40]
mov dl, byte [edx + eax]
cmp dl, byte [eax]
jne 0x10006c7b
inc ecx
inc eax
cmp ecx, ebx
jb 0x10006c54
cmp ecx, ebx
jne 0x10006cb3
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add ecx, esi
mov dword [eax + 4], 0
mov dword [eax], ecx
lea ecx, [eax + 4]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
add esp, 4
inc ecx
mov dword [edx], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
inc edi
mov eax, ebp
inc esi
sub eax, ebx
cmp esi, eax
jb 0x10006c3b
mov ecx, dword [esp + 0x10]
sub ebp, ebx
push ecx
push edi
push ebp
lea edx, [esp + 0x74]
push 0x1001653c
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x7c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x168]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x10006d58
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x6c]
push 0x1001652c
push eax
call esi
lea edi, [esp + 0x74]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x168]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x14]
add esp, 4
add esi, eax
jmp 0x10006b86
cmp eax, 0x10000
jne 0x10006d89
cmp dword [esp + 0x30], 0x8000000
ja 0x10006e33
add esi, dword [esp + 0x30]
jmp 0x10006b86
push 0x10016504
call fcn.100078f0
push ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov eax, dword [esp + 0x378]
add esp, 8
mov dword [esp + 0x14], 0
mov esi, dword [eax]
test esi, esi
je 0x10006e26
jmp 0x10006dc5
mov edi, dword [esp + 0x374]
mov edx, dword [esp + 0x18]
mov ecx, dword [esi]
push 0
push ebx
mov eax, dword [edx + 0xbb0]
push ebp
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10006e1b
xor ecx, ecx
test ebx, ebx
jbe 0x10006e17
mov edx, dword [esp + 0x374]
mov eax, edi
mov edi, ebp
sub edi, edx
mov edx, dword [esp + 0x37c]
test edx, edx
je 0x10006e0a
mov dl, byte [esp + 0x380]
cmp byte [eax], dl
je 0x10006e11
mov dl, byte [edi + eax]
cmp dl, byte [eax]
jne 0x10006e50
inc ecx
inc eax
cmp ecx, ebx
jb 0x10006df4
inc dword [esp + 0x10]
mov dword [esp + 0x14], esi
mov esi, dword [esi + 4]
test esi, esi
jne 0x10006dbe
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebp, dword [esp + 0x14]
add esp, 4
push ebp
push 0x100164e4
call fcn.100078f0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x358
ret 0x18
cmp ecx, ebx
jae 0x10006e17
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x10006e77
mov edi, dword [esp + 0x370]
push esi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi], ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [edi]
add esp, 4
jmp 0x10006e22
mov edx, dword [esi + 4]
push esi
mov dword [edi + 4], edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [edi + 4]
add esp, 4
jmp 0x10006e22