Function at 0x1002bd70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080f58
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x10098070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.10044c50
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74], eax
jmp 0x1002bdbe
mov ecx, dword [ebp - 0x74]
add ecx, 0x2f
mov dword [ebp - 0x74], ecx
mov edx, dword [ebp + 8]
add edx, 0x1432
cmp dword [ebp - 0x74], edx
ja 0x1002c387
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x7cb2
ja 0x1002bedb
cmp dword [ebp - 0x5c], 0x7cb2
je 0x1002c1ce
cmp dword [ebp - 0x5c], 0x5fd4
ja 0x1002be74
cmp dword [ebp - 0x5c], 0x5fd4
je 0x1002c1e3
cmp dword [ebp - 0x5c], 0x51e7
ja 0x1002be48
cmp dword [ebp - 0x5c], 0x51e7
je 0x1002c27f
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x60], ecx
sub dword [ebp - 0x60], 0xb73
je 0x1002c1fe
sub dword [ebp - 0x60], 0x2f
je 0x1002c0bb
sub dword [ebp - 0x60], 0x2f
je 0x1002c11a
jmp case.0x1002bf3e.1
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x64], edx
sub dword [ebp - 0x64], 0x5f47
je 0x1002bf87
sub dword [ebp - 0x64], 0x2f
je 0x1002bfab
sub dword [ebp - 0x64], 0x2f
je 0x1002c12c
jmp case.0x1002bf3e.1
cmp dword [ebp - 0x5c], 0x7c25
ja 0x1002beb9
cmp dword [ebp - 0x5c], 0x7c25
je 0x1002c0f1
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x68], eax
sub dword [ebp - 0x68], 0x6003
je 0x1002c312
sub dword [ebp - 0x68], 0x2f
je 0x1002c068
sub dword [ebp - 0x68], 0x1bc4
je 0x1002bf45
jmp case.0x1002bf3e.1
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x6c], ecx
sub dword [ebp - 0x6c], 0x7c54
je 0x1002bfa2
sub dword [ebp - 0x6c], 0x2f
je 0x1002c193
jmp case.0x1002bf3e.1
cmp dword [ebp - 0x5c], 0x7dfb
ja 0x1002bf1b
cmp dword [ebp - 0x5c], 0x7dfb
je 0x1002c19d
mov edx, dword [ebp - 0x5c]
sub edx, 0x7ce1
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x5c], 0xeb
ja case.0x1002bf3e.1
mov eax, dword [ebp - 0x5c]
movzx ecx, byte [eax + 0x1002c3e0]
jmp dword [ecx*4 + 0x1002c3c4]
mov edx, dword [ebp - 0x5c]
sub edx, 0x7e2a
mov dword [ebp - 0x5c], edx
cmp dword [ebp - 0x5c], 0xeb
ja case.0x1002bf3e.1
mov eax, dword [ebp - 0x5c]
movzx ecx, byte [eax + 0x1002c4e8]
jmp dword [ecx*4 + 0x1002c4cc]
push ebx
push esi
push edi
push ebp
mov ebp, edx
jmp case.0x1002bf3e.1
call fcn.1001f300
mov edx, ebp
mov eax, ebx
jmp case.0x1002bf3e.1
je case.0x1002bf3e.188
jmp case.0x1002bf3e.1
je case.0x1002bf14.0
mov dl, 3
mov eax, ebx
jmp case.0x1002bf3e.1
test ebp, ebp
jmp case.0x1002bf3e.1
call fcn.100451a0
jmp case.0x1002bf14.47
mov dword [ebp - 0xc8], 0x104
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0x88], edx
jmp case.0x1002bf3e.1
mov edx, esi
mov eax, edi
jmp case.0x1002bf3e.1
mov dword [ebp - 0x78], 0x616c
jmp 0x1002bfbd
mov eax, dword [ebp - 0x78]
add eax, 2
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x616c
ja 0x1002c032
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0xcc], ecx
cmp dword [ebp - 0xcc], 0x616c
je 0x1002bfdd
jmp 0x1002c030
mov edx, dword [ebp - 0x88]
push edx
lea ecx, [ebp - 0x28]
call fcn.1005b0f0
lea ecx, [ebp - 0x28]
call fcn.1005ad60
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.1005b190
push eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1002c02b
mov edx, dword [ebp - 0x88]
add edx, 0x104
mov dword [ebp - 0x88], edx
jmp 0x1002c030
jmp 0x1002c12c
jmp 0x1002bfb4
mov eax, 1
test eax, eax
jne 0x1002bfab
jmp case.0x1002bf3e.1
je 0x1002c11a
mov eax, dword [edi + 8]
cmp byte [eax + 0x4d1], 0
jmp case.0x1002bf3e.1
call fcn.10003180
jmp case.0x1002bf14.0
mov ecx, dword [ebp - 0x94]
push ecx
mov edx, dword [ebp - 0x80]
add edx, 1
push edx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005af40
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x34
call fcn.1005b530
lea ecx, [ebp - 0x40]
call fcn.10044c70
jmp case.0x1002bf3e.1
dec esi
cmp esi, 0xffffffff
jne 0x1002c1fe
pop ebp
pop edi
pop esi
pop ebx
ret
mov edx, dword [0x1009a120]
mov dword [ebp - 0xa8], edx
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], eax
mov dword [0x1009a120], 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x9c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp case.0x1002bf3e.1
mov edi, eax
mov eax, dword [edi + 0x10]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x1002c2bd
jmp case.0x1002bf3e.1
mov dl, 4
mov eax, ebx
call fcn.100353b0
mov edx, ebp
mov eax, ebx
jmp case.0x1002bf3e.1
mov edx, dword [ebp - 0x9c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1002bf3e.1
mov dword [ebp - 0x74], 0x5fa5
push 0xffffffffffffffff
push 0x1008f19c
lea ecx, [ebp - 0x28]
call fcn.1005afc0
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffff
jne 0x1002c18e
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x8c], edx
jmp 0x1002c252
jmp case.0x1002bf3e.1
call fcn.100020a0
jmp case.0x1002bf3e.1
je case.0x1002bf3e.141
jmp case.0x1002bf3e.1
mov edx, ebx
mov eax, edi
call fcn.10049fc0
jmp case.0x1002bf3e.1
cmp byte [ebx + 0x3c], 0
jmp case.0x1002bf3e.1
jne 0x1002c0f1
cmp byte [ebx + 0x45], 0
jmp case.0x1002bf3e.1
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x1002c312
cmp byte [ebx + 0x44], 0
jmp case.0x1002bf3e.1
mov dword [ebp - 0xb0], 0xffffffff
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x94], eax
jmp case.0x1002bf3e.1
mov ecx, dword [0x1009a130]
mov dword [ebp - 0xb4], ecx
mov edx, dword [ebp - 0xb4]
push edx
push 0x4367
call fcn.10003a60
add esp, 8
mov eax, dword [0x1009a130]
mov dword [ebp - 0xb8], eax
push 0x2db9
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.10007910
add esp, 8
cmp dword [0x1009a120], 0
jne 0x1002c27a
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
jmp 0x1002c2c9
jmp case.0x1002bf3e.1
mov dword [ebp - 0x7c], 0xe2d
jmp 0x1002c291
mov ecx, dword [ebp - 0x7c]
add ecx, 0x43
mov dword [ebp - 0x7c], ecx
cmp dword [ebp - 0x7c], 0xe70
ja 0x1002c312
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x70], eax
sub dword [ebp - 0x70], 0xe2d
je 0x1002c2f4
sub dword [ebp - 0x70], 0x43
je 0x1002c2bd
jmp 0x1002c30d
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x98], edx
jmp 0x1002c393
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x84], ecx
jmp 0x1002c288
push 0xffffffffffffffff
push 0x2e
lea ecx, [ebp - 0x28]
call fcn.1005af80
mov dword [ebp - 0xc0], eax
mov edx, dword [ebp - 0xc0]
mov dword [ebp - 0xa4], edx
cmp dword [ebp - 0xa4], 0xffffffff
je 0x1002c34d
mov eax, dword [ebp - 0x80]
add eax, 1
mov ecx, dword [ebp - 0xa4]
sub ecx, eax
mov dword [ebp - 0x94], ecx
mov edx, dword [ebp - 0x80]
add edx, 1
push edx
push 0
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.1005af40
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
push ecx
mov ecx, dword [ebp + 0xc]
add ecx, 0x1c
call fcn.1005b530
lea ecx, [ebp - 0x58]
call fcn.10044c70
jmp 0x1002bdb5
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x98], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10044c70
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100685c5
mov esp, ebp
pop ebp
ret