Function at 0x417e40
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x417ed1
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x4366a0]
xor eax, 0x800
mov dword [0x436680], eax
mov ecx, dword [0x436684]
neg ecx
cmp ecx, dword [0x436690]
jle 0x417ea6
mov edx, dword [0x436680]
neg edx
add edx, dword [0x436690]
and edx, dword [0x4366a0]
or edx, dword [0x43667c]
mov dword [0x43667c], edx
jmp 0x417eca
mov eax, dword [0x436680]
imul eax, eax, 0x6652
mov ecx, dword [0x436684]
sub ecx, 0x280c
and eax, ecx
add eax, dword [0x436688]
mov dword [0x436688], eax
xor eax, eax
jmp 0x418617
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
cmp dword [ecx], 0x4550
je 0x417f4c
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [0x436688], 0x3254
mov edx, dword [0x43667c]
neg edx
cmp edx, 0x3a15
je 0x417f2d
mov eax, dword [0x436698]
not eax
imul eax, eax, 0x7ef4
imul eax, eax, 0x5a60
or eax, dword [0x43669c]
mov dword [0x43669c], eax
jmp 0x417f45
mov ecx, dword [0x436698]
mov edx, dword [0x436684]
lea eax, [edx + ecx + 0x7ef4]
mov dword [0x4366a0], eax
xor eax, eax
jmp 0x418617
mov ecx, dword [ebp - 0x3c]
movzx edx, word [ecx + 4]
cmp edx, 0x14c
je 0x417f6d
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x418617
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x38]
and ecx, 1
je 0x417f8a
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x418617
push 4
push 0x3000
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x50]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x43669c]
add eax, 1
mov dword [0x43669c], eax
mov ecx, dword [0x43669c]
xor ecx, 0x6652
and ecx, dword [0x436694]
mov dword [0x436694], ecx
cmp dword [0x436680], 0x500e
jle 0x418000
mov edx, dword [0x436690]
add edx, 1
mov dword [0x436690], edx
mov eax, dword [0x436690]
add eax, 0x280c
imul eax, dword [0x43668c]
mov dword [0x43668c], eax
jmp 0x418021
mov ecx, dword [0x4366a0]
add ecx, 1
mov dword [0x4366a0], ecx
mov edx, dword [0x4366a0]
add edx, 0x4bc
mov dword [0x436694], edx
cmp dword [ebp - 0xc], 0
jne 0x418055
push 4
push 0x3000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x50]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418055
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x418617
mov dword [0x43667c], 0xb660
mov edx, dword [0x436688]
cmp edx, dword [0x436690]
jne 0x418087
mov eax, dword [0x43669c]
not eax
and eax, dword [0x436688]
or eax, dword [0x436684]
mov dword [0x436684], eax
jmp 0x4180c7
mov ecx, dword [0x436690]
sub ecx, 1
mov dword [0x436690], ecx
mov edx, dword [0x43668c]
add edx, 1
mov dword [0x43668c], edx
mov eax, dword [0x436690]
add eax, dword [0x436688]
add eax, dword [0x43668c]
xor eax, dword [0x436684]
add eax, dword [0x436690]
mov dword [0x436690], eax
mov ecx, dword [0x436698]
add ecx, 0x3a15
and ecx, dword [0x43669c]
mov dword [0x43669c], ecx
cmp dword [0x436694], 0x5a60
jl 0x4180ff
mov edx, dword [0x43667c]
imul edx, edx, 0x3a15
mov dword [0x4366a0], edx
jmp 0x41810e
mov eax, dword [0x436690]
or eax, 0x2255
mov dword [0x436698], eax
mov ecx, dword [0x436698]
add ecx, dword [0x436690]
and ecx, 0x7fdd
and ecx, dword [0x43669c]
mov dword [0x43669c], ecx
mov edx, dword [0x436690]
cmp edx, dword [0x4366a0]
jle 0x418157
mov eax, dword [0x436680]
imul eax, dword [0x43667c]
xor eax, 0x198b
xor eax, 0x3a15
mov dword [0x43669c], eax
jmp 0x418177
mov ecx, dword [0x43668c]
not ecx
sub ecx, dword [0x43668c]
or ecx, dword [0x436688]
xor ecx, dword [0x43667c]
mov dword [0x43667c], ecx
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4181b1
push 0x8000
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x418617
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x3c]
movzx eax, word [edx + 0x16]
and eax, 0x2000
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x20], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x24], ecx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp + 0x18]
mov dword [edx + 0x28], eax
mov ecx, dword [0x43668c]
sub ecx, 1
mov dword [0x43668c], ecx
mov edx, dword [0x4366a0]
mov eax, dword [0x43668c]
lea ecx, [eax + edx + 0x280c]
mov dword [0x43669c], ecx
mov edx, dword [0x43668c]
neg edx
cmp dword [0x436684], edx
jge 0x418253
mov eax, dword [0x436694]
add eax, 1
mov dword [0x436694], eax
mov ecx, 0x55ee3fc
sub ecx, dword [0x436694]
and ecx, dword [0x436694]
mov dword [0x436688], ecx
jmp 0x418283
mov edx, dword [0x4366a0]
sub edx, 1
mov dword [0x4366a0], edx
mov eax, dword [0x4366a0]
xor eax, 0x5a60
mov ecx, dword [0x43667c]
not ecx
or ecx, eax
imul ecx, dword [0x436684]
mov dword [0x436684], ecx
mov edx, dword [0x436690]
neg edx
mov eax, 0x2255
sub eax, edx
or eax, dword [0x4366a0]
add eax, dword [0x436684]
mov dword [0x436684], eax
cmp dword [0x436698], 0x69f2
jge 0x4182d3
mov ecx, dword [0x436698]
sub ecx, dword [0x436688]
xor ecx, 0x198b
mov edx, dword [0x436694]
not edx
xor ecx, edx
mov dword [0x436690], ecx
jmp 0x4182dd
mov dword [0x436688], 0x40d5
mov dword [0x4366a0], 0xb0
mov eax, dword [0x436694]
not eax
cmp dword [0x43668c], eax
jl 0x418335
mov ecx, dword [0x4366a0]
add ecx, 1
mov dword [0x4366a0], ecx
mov edx, dword [0x436698]
not edx
mov eax, dword [0x436688]
neg eax
imul eax, edx
mov ecx, dword [0x436680]
neg ecx
sub ecx, dword [0x4366a0]
and ecx, eax
and ecx, dword [0x436690]
mov dword [0x436690], ecx
jmp 0x418353
mov edx, dword [0x43667c]
and edx, dword [0x436698]
xor edx, dword [0x43667c]
xor edx, dword [0x4366a0]
mov dword [0x4366a0], edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 0x30], edx
push 4
push 0x1000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0041c210
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov eax, dword [ebp - 0x34]
mov dword [eax], edx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004168d0
add esp, 0xc
test eax, eax
jne 0x4183d3
jmp 0x418609
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0xc]
sub edx, dword [ecx + 0x34]
mov dword [ebp - 0x38], edx
je 0x4183f9
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00417360
add esp, 8
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x18], eax
jmp 0x418403
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x18], 1
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00417600
add esp, 4
test eax, eax
jne 0x41841d
jmp 0x418609
mov edx, dword [ebp - 0x34]
push edx
call fcn.00416f20
add esp, 4
test eax, eax
jne 0x418437
jmp 0x418609
mov eax, dword [0x436698]
imul eax, eax, 0x280c
mov dword [0x43667c], eax
mov ecx, dword [0x4366a0]
cmp ecx, dword [0x436698]
jge 0x418486
mov edx, dword [0x436698]
sub edx, 1
mov dword [0x436698], edx
mov eax, 0x3a15
sub eax, dword [0x436698]
mov ecx, dword [0x436680]
neg ecx
add eax, ecx
xor eax, dword [0x436688]
mov dword [0x436688], eax
jmp 0x41849a
mov edx, dword [0x436688]
not edx
or edx, dword [0x436680]
mov dword [0x436684], edx
mov eax, dword [0x43667c]
sub eax, 1
mov dword [0x43667c], eax
mov ecx, dword [0x43667c]
imul ecx, ecx, 0x2255
mov edx, dword [0x436694]
neg edx
and ecx, edx
mov dword [0x436690], ecx
mov eax, dword [0x436680]
not eax
cmp dword [0x436684], eax
jg 0x4184f2
mov ecx, 0x83b0
sub ecx, dword [0x43667c]
or ecx, dword [0x436680]
imul ecx, dword [0x436684]
mov dword [0x436684], ecx
jmp 0x418511
mov edx, dword [0x436688]
add edx, 1
mov dword [0x436688], edx
mov eax, dword [0x436688]
and eax, dword [0x4366a0]
mov dword [0x43667c], eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00417200
add esp, 4
test eax, eax
jne 0x41852b
jmp 0x418609
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
cmp dword [eax + 0x28], 0
je 0x418595
mov ecx, dword [ebp - 0x34]
cmp dword [ecx + 0x14], 0
je 0x418582
mov edx, dword [ebp - 0x34]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x44], ecx
push 0
push 1
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 0x44]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x418576
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x418609
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x10], 1
jmp 0x418593
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x28]
mov ecx, dword [ebp - 0x34]
mov dword [ecx + 0x2c], eax
jmp 0x41859f
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x2c], 0
mov eax, dword [0x4366a0]
xor eax, 0x800
mov dword [0x436680], eax
mov ecx, dword [0x436684]
neg ecx
cmp ecx, dword [0x436690]
jle 0x4185e0
mov edx, dword [0x436680]
neg edx
add edx, dword [0x436690]
and edx, dword [0x4366a0]
or edx, dword [0x43667c]
mov dword [0x43667c], edx
jmp 0x418604
mov eax, dword [0x436680]
imul eax, eax, 0x6652
mov ecx, dword [0x436684]
sub ecx, 0x280c
and eax, ecx
add eax, dword [0x436688]
mov dword [0x436688], eax
mov eax, dword [ebp - 0x34]
jmp 0x418617
mov edx, dword [ebp - 0x34]
push edx
call fcn.00418620
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret