Function at 0x1003c7ea
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0x18], 0
push ebx
mov bl, byte [ebp + 8]
push esi
mov esi, eax
mov eax, dword [ebp + 8]
setne byte [ebp - 3]
shr eax, 1
and bl, 1
and al, 1
push edi
mov byte [ebp - 4], al
jne 0x1003c832
cmp byte [ebp - 3], 0
jne 0x1003c832
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
lea eax, [eax*4 - 0x27]
mov byte [ebp - 1], 1
cmp dword [ebp + 0xc], eax
jb 0x1003c836
mov byte [ebp - 1], 0
test esi, esi
jne 0x1003c84d
push 1
call sym.CoreFoundation.dll__CFGetTSD
pop ecx
test eax, eax
jne 0x1003c84b
mov eax, dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
mov esi, eax
cmp esi, dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
je 0x1003c869
cmp esi, dword [sym.CoreFoundation.dll_kCFAllocatorMalloc]
je 0x1003c869
mov byte [ebp - 2], 1
cmp esi, dword [sym.CoreFoundation.dll_kCFAllocatorMallocZone]
jne 0x1003c86d
mov byte [ebp - 2], 0
cmp byte [ebp - 1], 0
push 0x10
pop edi
mov eax, edi
je 0x1003c87e
mov eax, dword [ebp + 0xc]
add eax, 0x1f
push 0
push eax
push dword [0x1017b160]
push esi
call sym.CoreFoundation.dll__CFRuntimeCreateInstance
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1003c89d
xor eax, eax
jmp 0x1003c9c9
and dword [esi + 8], 0
cmp byte [ebp - 2], 0
sete al
dec al
and al, 8
cmp byte [ebp - 1], 0
sete cl
dec cl
and cl, 4
or al, cl
xor al, byte [esi + 4]
and al, 0x3f
xor byte [esi + 4], al
mov al, byte [esi + 4]
test bl, bl
je 0x1003c8d6
cmp byte [ebp - 4], 0
je 0x1003c8d6
mov dword [esi + 0xc], edi
or al, 3
jmp 0x1003c8e0
mov ecx, dword [ebp + 0xc]
and al, 0xfd
mov dword [esi + 0xc], ecx
or al, 1
cmp byte [ebp - 3], 0
mov byte [esi + 4], al
je 0x1003c906
mov eax, dword [ebp + 0x10]
push dword [ebp + 0x18]
mov dword [esi + 0x14], eax
call sym.CoreFoundation.dll_CFRetain
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
pop ecx
mov dword [esi + 8], eax
jmp 0x1003c9bc
test bl, bl
je 0x1003c920
cmp byte [ebp - 4], 0
jne 0x1003c920
push 6
call sym.CoreFoundation.dll__CFExecutableLinkedOnOrAfter
pop ecx
mov byte [ebp + 0x18], 1
test al, al
je 0x1003c924
mov byte [ebp + 0x18], 0
cmp byte [ebp - 1], 0
jne 0x1003c963
push dword [ebp + 0x18]
mov edi, dword [esi + 0xc]
mov ecx, esi
call fcn.1003b8d4
mov dword [esi + 0x14], eax
cmp byte [sym.CoreFoundation.dll___CFOASafe], 0
pop ecx
je 0x1003c951
push str.CFData__store_
push eax
call sym.CoreFoundation.dll___CFSetLastAllocationEventName
pop ecx
pop ecx
cmp dword [esi + 0x14], 0
jne 0x1003c992
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
jmp 0x1003c896
cmp dword [ebp + 0x14], 0
jne 0x1003c98e
test bl, bl
jne 0x1003c98e
and byte [esi + 4], 0xfb
and dword [esi + 0x14], 0
mov al, byte [esi + 4]
cmp byte [0x101695e3], bl
jne 0x1003c98e
lea ecx, [esi + 0x27]
and ecx, 0xfffffff0
or al, 4
mov dword [esi + 0x14], ecx
mov byte [esi + 4], al
mov byte [ebp + 0x18], 1
cmp byte [ebp + 0x18], 0
push dword [ebp + 0x14]
sete al
push dword [ebp + 0x10]
shl al, 6
xor al, byte [esi + 4]
xor ecx, ecx
and al, 0x40
xor byte [esi + 4], al
push ecx
xor eax, eax
push eax
push esi
mov dword [esi + 0x10], ecx
call sym.CoreFoundation.dll_CFDataReplaceBytes
add esp, 0x14
mov al, byte [esi + 4]
xor al, byte [ebp + 8]
and al, 3
xor byte [esi + 4], al
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret