Function at 0x1001c720
Capabilities:
Get system information on windows
Link many functions at runtime
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov ebx, edx
mov edx, ecx
push esi
xor esi, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edx
push edi
cmp ebx, 0x40
jae 0x1001c774
mov eax, dword [0x1003bc80]
test eax, eax
jne 0x1001c767
push str.RtlSetLastWin32Error
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003bc80], eax
test eax, eax
je 0x1001c94d
push 0xd
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [edx], ax
je 0x1001c7bb
mov eax, dword [0x1003bc80]
test eax, eax
jne 0x1001c7ab
push str.RtlSetLastWin32Error
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003bc80], eax
test eax, eax
je 0x1001c94d
push 0xc1
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edx + 0x3c]
mov dword [ebp - 0x20], ecx
lea eax, [ecx + 0xf8]
cmp ebx, eax
jb 0x1001c73a
cmp dword [ecx + edx], 0x4550
lea edi, [ecx + edx]
mov dword [ebp - 0x1c], edi
jne 0x1001c77e
mov eax, 0x14c
cmp word [edi + 4], ax
jne 0x1001c77e
mov ecx, dword [edi + 0x38]
test cl, 1
jne 0x1001c77e
movzx edx, word [edi + 0x14]
movzx ebx, word [edi + 6]
add edx, 0x24
test ebx, ebx
je 0x1001c81f
add edx, edi
mov eax, dword [edx + 4]
lea edx, [edx + 0x28]
test eax, eax
cmovne ecx, eax
add ecx, dword [edx - 0x28]
cmp ecx, esi
cmovbe ecx, esi
mov esi, ecx
mov ecx, dword [edi + 0x38]
sub ebx, 1
jne 0x1001c802
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [ebp - 0x54]
lea edx, [ecx - 1]
lea ebx, [ecx - 1]
not edx
add ebx, dword [edi + 0x50]
lea eax, [ecx - 1]
add eax, esi
and ebx, edx
and eax, edx
cmp ebx, eax
jne 0x1001c77e
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push ebx
push dword [edi + 0x34]
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x1001c874
push 4
push 0x3000
push ebx
push eax
call esi
mov dword [ebp - 8], eax
test eax, eax
je 0x1001c89e
push 0x38
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 8]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
jne 0x1001c8d8
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x1003bc80]
test eax, eax
jne 0x1001c8cb
push str.RtlSetLastWin32Error
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003bc80], eax
test eax, eax
je 0x1001c94d
push 0xe
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx + 4], ecx
movzx eax, word [edi + 0x16]
shr eax, 0xd
and eax, 1
mov dword [ebx + 0x1c], 0x1001c6a0
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x20], 0x1001c6c0
mov dword [ebx + 0x24], 0x1001c6e0
mov dword [ebx + 0x28], 0x1001c6f0
mov dword [ebx + 0x2c], 0x1001c710
mov eax, dword [ebp - 0x54]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x54]
cmp dword [ebp - 0x18], eax
jae 0x1001c956
mov eax, dword [0x1003bc80]
test eax, eax
jne 0x1001c942
push str.RtlSetLastWin32Error
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003bc80], eax
test eax, eax
je 0x1001c946
push 0xd
call eax
mov ecx, ebx
call fcn.1001cdd0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 4
push 0x1000
push eax
push ecx
call esi
push dword [edi + 0x54]
mov esi, eax
push dword [ebp - 4]
push esi
call fcn.10021000
mov eax, dword [ebp - 4]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], 0
mov eax, dword [eax + 0x3c]
add eax, esi
xor esi, esi
mov dword [ebx], eax
mov dword [eax + 0x34], ecx
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ebp - 0xc], edx
movzx eax, word [ecx + 0x14]
add eax, 0x24
cmp si, word [ecx + 6]
jae 0x1001ca50
lea edi, [eax + ecx]
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x1001c9ec
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov esi, dword [eax + ecx + 0x38]
test esi, esi
jle 0x1001ca35
mov eax, dword [edi]
push 4
push 0x1000
add eax, edx
push esi
push eax
mov eax, dword [ebx + 0x1c]
call eax
add esp, 0x10
test eax, eax
je 0x1001c946
mov eax, dword [edi]
add eax, dword [ebp - 0xc]
push esi
push 0
push eax
mov dword [edi - 4], eax
call fcn.1001fb10
jmp 0x1001ca2f
mov eax, dword [edi + 8]
add eax, ecx
cmp dword [ebp - 0x18], eax
jb 0x1001c919
mov eax, dword [edi]
push 4
push 0x1000
add eax, edx
push ecx
push eax
mov eax, dword [ebx + 0x1c]
call eax
add esp, 0x10
test eax, eax
je 0x1001c946
push dword [edi + 4]
mov eax, dword [edi + 8]
mov esi, dword [edi]
add eax, dword [ebp - 4]
add esi, dword [ebp - 0xc]
push eax
push esi
call fcn.10021000
mov dword [edi - 4], esi
mov edx, dword [ebp - 0xc]
add esp, 0xc
mov ecx, dword [ebx]
add edi, 0x28
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
movzx eax, word [ecx + 6]
cmp esi, eax
jl 0x1001c9a7
mov edi, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x34]
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x1c], eax
je 0x1001cadd
cmp dword [ecx + 0xa4], 0
jne 0x1001ca6c
xor eax, eax
jmp 0x1001cae2
mov edx, dword [ebx + 4]
mov edi, dword [ecx + 0xa0]
add edi, edx
mov dword [ebp - 0x18], edx
mov eax, dword [edi]
test eax, eax
je 0x1001cadd
mov ecx, dword [edi + 4]
add eax, edx
mov dword [ebp - 0x20], eax
lea edx, [edi + 8]
xor esi, esi
lea eax, [ecx - 8]
test eax, 0xfffffffe
jbe 0x1001cace
mov ebx, dword [ebp - 0x20]
nop word [eax + eax]
movzx eax, word [edx]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x1001cabe
mov ecx, dword [ebp - 0x1c]
and eax, 0xfff
add dword [eax + ebx], ecx
mov ecx, dword [edi + 4]
inc esi
add edx, 2
lea eax, [ecx - 8]
shr eax, 1
cmp esi, eax
jb 0x1001caa0
mov eax, dword [edi + ecx]
add edi, ecx
mov edx, dword [ebp - 0x18]
test eax, eax
jne 0x1001ca80
mov ebx, dword [ebp - 0x10]
mov eax, 1
mov ecx, ebx
mov dword [ebx + 0x18], eax
call fcn.1001c4d0
test eax, eax
je 0x1001c946
mov edi, dword [ebx]
mov ecx, dword [ebx + 0x34]
neg ecx
movzx esi, word [edi + 0x14]
add esi, edi
mov eax, dword [esi + 0x20]
and ecx, eax
mov edx, dword [esi + 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], ecx
test edx, edx
jne 0x1001cb2c
mov eax, dword [esi + 0x3c]
test al, 0x40
je 0x1001cb25
mov edx, dword [edi + 0x20]
jmp 0x1001cb2c
test al, al
jns 0x1001cb2c
mov edx, dword [edi + 0x24]
mov ecx, dword [esi + 0x3c]
mov eax, 1
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
cmp ax, word [edi + 6]
jae 0x1001cc15
lea eax, [esi + 0x64]
mov dword [ebp - 4], eax
nop dword [eax + eax]
mov esi, dword [eax - 0x1c]
mov dword [ebp - 0x18], esi
mov esi, dword [ebx + 0x34]
mov ebx, dword [eax - 0x14]
neg esi
and esi, dword [ebp - 0x18]
test ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0x10]
jne 0x1001cb93
test byte [eax], 0x40
je 0x1001cb85
mov ebx, dword [edi + 0x20]
jmp 0x1001cb8d
test byte [eax], 0x80
je 0x1001cb93
mov ebx, dword [edi + 0x24]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], esi
je 0x1001cbd3
mov eax, dword [ebp - 0x14]
add eax, edx
cmp eax, esi
ja 0x1001cbd0
lea edx, [ebp - 0x34]
mov ecx, ebx
call fcn.1001c430
test eax, eax
je 0x1001c946
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov edi, dword [ebx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x34], eax
mov eax, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
jmp 0x1001cbf3
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, ecx
and eax, edx
or ecx, edx
bt eax, 0x19
jb 0x1001cbe7
and ecx, 0xfdffffff
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 0x20]
add eax, 0x28
mov dword [ebp - 4], eax
inc esi
movzx eax, word [edi + 6]
cmp esi, eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x20], esi
jl 0x1001cb60
lea edx, [ebp - 0x34]
mov dword [ebp - 0x24], 1
mov ecx, ebx
call fcn.1001c430
test eax, eax
je 0x1001c946
mov edx, dword [ebx]
mov ecx, edx
mov esi, dword [edx + 0xc0]
test esi, esi
je 0x1001cc63
mov edi, dword [ebx + 4]
mov esi, dword [edi + esi + 0xc]
test esi, esi
je 0x1001cc63
mov eax, dword [esi]
test eax, eax
je 0x1001cc63
nop dword [eax]
push 0
push 1
push edi
call eax
mov eax, dword [esi + 4]
lea esi, [esi + 4]
test eax, eax
jne 0x1001cc50
mov ecx, dword [ebx]
mov eax, dword [ecx + 0x28]
test eax, eax
je 0x1001cce0
mov ecx, dword [ebp - 8]
add eax, ecx
cmp dword [ebx + 0x14], 0
je 0x1001ccd4
push 0
push 1
push ecx
call eax
test eax, eax
jne 0x1001ccc4
mov eax, dword [0x1003bc80]
test eax, eax
jne 0x1001ccad
push str.RtlSetLastWin32Error
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003bc80], eax
test eax, eax
je 0x1001c946
push 0x45a
call eax
mov ecx, ebx
call fcn.1001cdd0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [ebx + 0x10], 1
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov dword [ebx + 0x30], eax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov dword [ebx + 0x30], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret