Function at 0x10001f01
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
push 0x40
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], esi
call fcn.10001a1f
test eax, eax
je 0x10002149
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10001f3e
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10001f55
mov eax, dword [edi + 0x3c]
mov ecx, esi
add eax, 0xf8
push eax
push dword [ebp + 0xc]
call fcn.10001a1f
test eax, eax
jne 0x10001f5c
xor eax, eax
jmp 0x10002148
push ebx
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x10001f7a
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10002145
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x10001f6a
test byte [ebx + 0x38], 1
jne 0x10001f6a
movzx edi, word [ebx + 6]
movzx eax, word [ebx + 0x14]
test edi, edi
je 0x10001fbd
mov ecx, dword [ebp - 4]
lea edx, [ebx + 0x24]
add edx, eax
cmp dword [edx + 4], 0
mov eax, dword [edx]
jne 0x10001fac
add eax, dword [ebx + 0x38]
jmp 0x10001faf
add eax, dword [edx + 4]
cmp eax, ecx
cmova ecx, eax
add edx, 0x28
dec edi
jne 0x10001f9f
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
dec eax
add eax, ecx
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
and eax, edx
and edi, edx
cmp edi, eax
jne 0x10001f6a
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10002017
push 4
push 0x3000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10002017
push 0xe
jmp 0x10001f6f
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jne 0x10002040
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10002010
mov dword [edi + 4], ecx
mov ecx, esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push dword [ebp + 0xc]
call fcn.10001a1f
test eax, eax
je 0x1000213d
push 4
push 0x1000
push dword [ebx + 0x54]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.1000229d
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push edi
add eax, esi
mov esi, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, esi
push edx
call fcn.10001a3d
test eax, eax
je 0x1000213d
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
sub eax, dword [ebx + 0x34]
je 0x100020e6
push eax
push edi
mov ecx, esi
call fcn.100021dc
xor ebx, ebx
mov dword [edi + 0x18], eax
inc ebx
jmp 0x100020ec
xor ebx, ebx
inc ebx
mov dword [edi + 0x18], ebx
push edi
mov ecx, esi
call fcn.100018cc
test eax, eax
je 0x1000213d
push edi
mov ecx, esi
call fcn.10001bfc
test eax, eax
je 0x1000213d
push edi
mov ecx, esi
call fcn.10001b21
test eax, eax
je 0x1000213d
mov eax, dword [edi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x1000215a
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [edi + 0x14], 0
je 0x10002155
push 0
push ebx
push 0x10000000
call eax
test eax, eax
jne 0x10002150
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov ecx, esi
call fcn.10001d36
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov dword [edi + 0x10], ebx
jmp 0x1000215e
mov dword [edi + 0x2c], eax
jmp 0x1000215e
and dword [edi + 0x2c], 0
mov eax, edi
jmp 0x10002147