Function at 0x10001780
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x10006040]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x48]
mov dword [esp + 0xc], esi
cmp esi, dword [esp + 0x4c]
jae 0x10001b6a
push 0x1c
lea eax, [esp + 0x28]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x10001b56
cmp dword [esp + 0x34], 0x1000
jne 0x10001b41
test byte [esp + 0x38], 4
je 0x10001b41
mov eax, dword [esp + 0x30]
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x68], 0
xor edi, edi
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x6c], ecx
test eax, eax
je 0x10001852
push eax
lea ecx, [esp + 0x68]
call fcn.10002430
push dword [esp + 0x10]
mov esi, dword [esp + 0x68]
push edi
push esi
mov dword [esp + 0x14], esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], ecx
lea edi, [esi + eax]
mov dword [esp + 0x68], edi
lea ecx, [esp + 0x98]
push ecx
push eax
push esi
push dword [esp + 0x18]
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10001b4b
mov ecx, dword [esp + 0x98]
mov edx, edi
sub edx, esi
cmp ecx, edx
jae 0x10001886
lea edi, [esi + ecx]
jmp 0x100018c9
jbe 0x100018c9
mov eax, dword [esp + 0x14]
sub eax, esi
cmp ecx, eax
jbe 0x100018b3
push ecx
push ecx
lea ecx, [esp + 0x6c]
call fcn.100024d0
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x14], eax
mov dword [esp + 8], esi
jmp 0x100018c9
sub ecx, edx
push ecx
push 0
push edi
mov dword [esp + 0x24], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, dword [esp + 0x18]
cmp esi, edi
je 0x10001af7
xor esi, esi
sub edi, dword [esp + 8]
mov dword [esp + 0xc], edi
je 0x10001af3
mov ecx, dword [0x100064a4]
mov edx, dword [0x100064a0]
sub ecx, edx
lea eax, [ecx + esi]
cmp eax, edi
ja 0x10001aea
mov eax, dword [esp + 8]
add eax, esi
mov dword [esp + 0x18], eax
mov edi, eax
sub ecx, 4
jb 0x10001921
nop dword [eax + eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10001926
add edx, 4
add edi, 4
sub ecx, 4
jae 0x10001910
cmp ecx, 0xfffffffc
je 0x1000195a
mov al, byte [edx]
cmp al, byte [edi]
jne 0x10001953
cmp ecx, 0xfffffffd
je 0x1000195a
mov al, byte [edx + 1]
cmp al, byte [edi + 1]
jne 0x10001953
cmp ecx, 0xfffffffe
je 0x1000195a
mov al, byte [edx + 2]
cmp al, byte [edi + 2]
jne 0x10001953
cmp ecx, 0xffffffff
je 0x1000195a
mov al, byte [edx + 3]
cmp al, byte [edi + 3]
je 0x1000195a
sbb eax, eax
or eax, 1
jmp 0x1000195c
xor eax, eax
mov edi, dword [esp + 0xc]
test eax, eax
jne 0x10001aea
mov eax, dword [esp + 8]
cmp esi, edi
jae 0x1000197b
cmp byte [eax + esi], 0
je 0x1000197b
inc esi
cmp esi, edi
jb 0x10001970
lea ecx, [eax + esi]
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x18]
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
mov dword [esp + 0x84], 0xf
cmp eax, ecx
jne 0x100019ae
mov byte [esp + 0x70], 0
jmp 0x10001aa7
sub ecx, eax
mov dword [esp + 0x10], ecx
cmp ecx, 0x7fffffff
ja 0x10001b84
mov eax, 0xf
cmp ecx, eax
jbe 0x10001a78
mov edi, ecx
or edi, eax
cmp edi, 0x7fffffff
jbe 0x100019ec
mov edi, closesocket
mov ecx, connect
mov dword [esp + 0x1c], edi
add ecx, 0x23
jmp 0x10001a29
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
mov dword [esp + 0x1c], edi
lea eax, [edi + 1]
test eax, eax
jne 0x10001a17
xor edx, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x70], edx
mov eax, edi
mov dword [esp + 0x84], edi
jmp 0x10001a7c
cmp eax, 0x1000
jb 0x10001a58
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x10001b89
push ecx
call fcn.10002b84
add esp, 4
test eax, eax
je 0x10001b7e
mov ecx, dword [esp + 0x10]
lea edx, [eax + 0x23]
and edx, 0xffffffe0
mov dword [edx - 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x70], edx
mov dword [esp + 0x84], edi
jmp 0x10001a7c
push eax
call fcn.10002b84
mov ecx, dword [esp + 0x14]
mov edx, eax
mov eax, dword [esp + 0x20]
add esp, 4
mov dword [esp + 0x70], edx
mov dword [esp + 0x84], edi
jmp 0x10001a7c
mov edx, dword [esp + 0x70]
push ecx
push dword [esp + 0x1c]
cmp eax, 0xf
lea edi, [esp + 0x78]
cmova edi, edx
push edi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [esp + 0x80], eax
mov byte [edi + eax], 0
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0x70]
call fcn.100013d0
mov ecx, dword [esp + 0x84]
dec esi
cmp ecx, 0xf
jbe 0x10001aea
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001ae0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001b7e
push ecx
push edx
call fcn.10002ece
add esp, 8
inc esi
cmp esi, edi
jb 0x100018e1
mov esi, dword [esp + 8]
test esi, esi
je 0x10001b3d
mov ecx, dword [esp + 0x14]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x10001b1b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001b7e
push ecx
push esi
call fcn.10002ece
add esp, 8
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
add esi, dword [esp + 0x30]
jmp 0x10001b5c
cmp esi, edi
cmovne edi, esi
mov dword [esp + 0x68], edi
jmp 0x10001af7
add esi, 0x1000
mov dword [esp + 0xc], esi
cmp esi, dword [esp + 0x4c]
jb 0x100017c0
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
xor ecx, esp
call fcn.10002976
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10001280
call fcn.100011e0
int3