Function at 0x10048fc
Capabilities:
Check os version
Enumerate process modules
Get file version info
Get memory capacity
Get system information on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2188
call fcn.010081f0
mov eax, dword [0x100b048]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
lea eax, [ebp - 0x114c]
push eax
push 2
lea eax, [ebp - 0x1150]
push eax
push edi
mov word [ebp - 0x1150], 0xfeff
mov dword [ebp - 0x1158], esi
call ebx
xor eax, eax
push 0x7fe
mov word [ebp - 0xa04], ax
lea eax, [ebp - 0xa02]
push esi
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
mov esi, 0xfe
push esi
push eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x102]
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x204], ax
xor esi, esi
lea eax, [ebp - 0x202]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0x24
push 0x80
lea eax, [ebp - 0x104]
push eax
push 0x10018e8
push esi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
test eax, eax
je 0x1004a32
push 0x80
lea eax, [ebp - 0x204]
push eax
push 0x1001900
push esi
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
test eax, eax
je 0x1004a32
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x1001918
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1004a0d
push esi
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x1001964
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1004a5b
push esi
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
push 0x80
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1004ae5
lea eax, [ebp - 0x104]
push eax
push 0x100197c
lea eax, [ebp - 0xa04]
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1004ac0
push esi
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
mov esi, 0x11c
xor eax, eax
push esi
push eax
lea eax, [ebp - 0x1148]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1148]
push eax
mov dword [ebp - 0x1148], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1004b78
lea eax, [ebp - 0x1134]
push eax
push dword [ebp - 0x113c]
lea eax, [ebp - 0xa04]
push dword [ebp - 0x1140]
push dword [ebp - 0x1144]
push 0x10019a8
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x1c
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x1004b51
push esi
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
jmp 0x1004b7a
xor esi, esi
lea eax, [ebp - 0x1188]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [ebp - 0x1188]
test eax, eax
je 0x1004bb7
cmp eax, 6
je 0x1004bb0
cmp eax, 9
lea eax, [ebp - 0x104]
je 0x1004ba9
push 0x1001a14
jmp 0x1004bc2
push 0x10019f4
jmp 0x1004bc2
push 0x1001a00
jmp 0x1004bbc
push 0x1001a0c
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.01002c9c
lea eax, [ebp - 0x115c]
mov dword [ebp - 0x115c], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x115c], 0
mov eax, 0x1001a28
jne 0x1004bfc
mov eax, 0x10017b8
cmp dword [ebp - 0x1174], 1
mov ecx, 0x1001a40
ja 0x1004c0f
mov ecx, 0x1001a58
push eax
push ecx
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x1174]
lea eax, [ebp - 0xa04]
push 0x1001a6c
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x1c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1158]
jne 0x1004c40
xor eax, eax
push eax
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
lea eax, [ebp - 0x102c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x101c]
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x1018]
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x1024]
shr eax, 0x14
push eax
mov eax, dword [ebp - 0x1020]
shr eax, 0x14
push eax
push dword [ebp - 0x1028]
lea eax, [ebp - 0xa04]
push 0x1001aa8
push 0x400
push eax
call fcn.01004e69
lea ecx, [ebp - 0xa04]
add esp, 0x20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1158]
jne 0x1004cc8
xor eax, eax
push eax
sub ecx, edx
lea eax, [ebp - 0x114c]
push eax
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0xa04]
push eax
push edi
call ebx
xor eax, eax
mov dword [ebp - 0x1154], eax
invalid
invalid
lodsb al, byte [esi]