Function at 0x518370
Capabilities:
Access peb ldr_data
Get process heap flags
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov eax, dword [0x85011c]
mov dword [ebp - 0x38], 0xffffffff
test eax, eax
je 0x5187b0
lea eax, [ebp - 0x30]
lea edi, [ebp - 0x34]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], 0xdeadbeef
sub esp, 4
shl eax, 5
mov dword [ebp - 0x3c], eax
mov ebx, dword fs:[0x18]
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xdeadbeef
mov dword [esp], 0
call dword [0x85011c]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10d0
xor eax, eax
mov ecx, dword [ebx + 0x34]
test esi, esi
jne 0x518410
xor eax, eax
cmp ecx, 0x3e6
sete al
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5efc10
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10d1
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Got_unexpected_size__lu._n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
mov dword [ebp - 0x34], 0xdeadbeef
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xdeadbeef
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x85011c]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10d6
xor eax, eax
mov ecx, dword [ebx + 0x34]
test esi, esi
jne 0x5184bf
xor eax, eax
cmp ecx, 6
sete al
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5efc10
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10d7
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Got_unexpected_size__lu._n
test eax, eax
mov dword [esp + 8], eax
sete al
movzx eax, al
mov dword [esp], eax
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
mov dword [ebp - 0x34], 0xdeadbeef
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x85011c]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10dc
xor eax, eax
mov ecx, dword [ebx + 0x34]
test esi, esi
jne 0x51856d
xor eax, eax
cmp ecx, 0x7a
sete al
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], 0x5efc10
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10dd
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Got_unexpected_size__lu._n
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x3c]
cmp eax, edx
sete al
movzx eax, al
mov dword [esp], eax
mov ebx, dword fs:[0x18]
call fcn.0050e8b0
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], 0
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
mov esi, eax
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x38]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], 0xaf
call dword [0x850140]
sub esp, 0x18
mov dword [ebp - 0x44], eax
call fcn.0057d110
mov ecx, dword [ebp - 0x44]
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10e3
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], str.Got_unexpected_status__lx._n
call fcn.0050e8b0
mov dword [ebp - 0x34], 0xdeadbeef
mov dword [ebx + 0x34], 0xdeadbeef
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [0x85011c]
sub esp, 0x14
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10e8
xor eax, eax
mov ecx, dword [ebx + 0x34]
test edi, edi
jne 0x5187a0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp], eax
mov dword [esp + 4], 0x5efc10
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10e9
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], str.Got_unexpected_size__lu._n
mov dword [esp + 8], eax
mov edi, dword [ebp - 0x3c]
cmp eax, edi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.0050e8b0
call fcn.0057d110
mov dword [eax], 0x5eee7f
mov dword [eax + 4], 0x10eb
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
mov dword [esp + 4], str.Info_does_not_match_NtQuerySystemInformationEx__._n
test eax, eax
sete al
movzx eax, al
mov dword [esp], eax
mov edi, dword fs:[0x18]
call fcn.0050e8b0
mov dword [esp + 8], esi
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x40]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call ebx
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
cmp ecx, 0xdeadbeef
sete al
jmp 0x5186c2
mov eax, 0x10bf
call fcn.0050dc60
mov dword [esp], str.GetSystemCpuSetInformation___is_not_supported._n
call fcn.0050e770
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret