Function at 0x401a7f
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc8
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
mov edx, dword [ecx + 0x18]
mov esi, ecx
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
mov eax, dword [ecx + 0x10]
mov dword [esp], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 8]
mov dword [esp + 4], eax
mov dword [esp + 0x14], ecx
call fcn.004030b8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [esp + 0xb0]
mov edx, str.Dumping_PID___Name:___s___Window:___s___Path:__s__n
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x401648
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov dword [ecx], eax
lea ecx, [esp + 0x28]
mov dword [ecx + 4], edi
mov dword [ecx], ebx
push 0xc
call fcn.004033c0
pop ecx
test ax, ax
jne 0x401bda
lea eax, [esp + 0x20]
mov ecx, ebp
mov edx, 0x4052d8
mov ebp, eax
push eax
call fcn.00403715
pop ecx
test ax, ax
jne 0x401bda
lea ecx, [esp + 0x78]
lea edx, [0x40514d]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
push 9
call fcn.004033c0
pop ecx
test ax, ax
jne 0x401bda
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
push ebp
call fcn.00403776
pop ecx
test ax, ax
jne 0x401bda
lea ecx, [esp + 0x30]
lea edx, [0x40515a]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
push 0xc
call fcn.004033c0
pop ecx
test ax, ax
jne 0x401bda
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push ebp
call fcn.00403776
pop ecx
test ax, ax
jne 0x401bda
lea ecx, [esp + 0x44]
lea edx, [0x40516a]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
push 0xa
call fcn.004033c0
pop ecx
test ax, ax
jne 0x401bda
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
push ebp
push 0x4052d8
call fcn.004037d7
pop ecx
pop edx
test ax, ax
jne 0x401bda
lea ecx, [esp + 0x8c]
lea edx, [0x405177]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
push 2
call fcn.004033c0
pop ecx
call fcn.004030c3
push dword [esi]
push 0
push 0x418
call sub.KERNEL32.dll_OpenProcess
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
cmove edi, eax
push 6
pop ebx
cmovne ebx, eax
test ebx, ebx
jne 0x40203c
lea esi, [esp + 0x8c]
mov dword [esp + 8], 0
push esi
call sub.KERNEL32.dll_GetSystemInfo
mov ecx, dword [0x4050dc]
lea edx, [esp + 0x3c]
mov eax, dword [0x4050d8]
mov ebp, dword [esi + 8]
xor ebx, ebx
mov dword [esp + 4], 0xaaaaaaaa
mov dword [esp], edi
mov dword [edx - 0xc], 0xaaaaaaaa
and dword [edx - 8], 0
and dword [edx - 4], 0
mov dword [edx + 4], ecx
mov ecx, dword [esi + 0xc]
mov dword [edx], eax
mov dword [esp + 0x10], ecx
cmp ebp, dword [esp + 0x10]
jae 0x401df6
push 0x20
lea eax, [esp + 0x48]
push eax
push ebp
push edi
call sub.KERNEL32.dll_VirtualQueryEx
test eax, eax
je 0x401ea6
cmp dword [esp + 0x58], 0x1000
jne 0x401cb3
cmp dword [esp + 0x60], 0x20000
jne 0x401cb3
mov eax, dword [esp + 0x5c]
mov ecx, 0x105
and eax, ecx
cmp eax, 4
jne 0x401cb3
mov edi, dword [esp + 8]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x54]
lea esi, [ebx + 1]
cmp edi, ebx
jbe 0x401cba
mov edi, dword [esp]
jmp 0x401ddc
mov esi, ebx
jmp 0x401deb
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edx, esi
call fcn.004036fd
cmp edi, eax
jae 0x401dd1
test edi, edi
mov edi, dword [esp]
mov ecx, eax
mov dword [esp + 0x1c], eax
je 0x401d3a
cmp ecx, 0x20000000
setae byte [esp + 0x28]
jae 0x401d3a
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 8]
lea edi, [ecx*8]
mov ecx, dword [0x4050d8]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 4]
lea eax, [eax*8]
push dword [esp + 0xd8]
push edi
mov edi, dword [esp + 8]
push 2
push eax
mov eax, dword [esp + 0x28]
call dword [eax + 4]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
add esp, 0x10
test al, 1
jne 0x401dc3
mov eax, dword [esp + 0xd8]
cmp ecx, 0x20000000
mov edx, ecx
setae cl
setae byte [esp + 0x28]
test cl, cl
jne 0x402049
lea edx, [edx*8]
test edx, edx
push 0xfffffffffffffffc
pop ecx
je 0x401d84
mov ecx, dword [0x4050d8]
push eax
push 2
mov eax, dword [0x4050dc]
call dword [eax]
add esp, 8
mov ecx, eax
test eax, eax
je 0x402049
lea eax, [ebx*8]
mov dword [esp + 0x18], ecx
push eax
push dword [esp + 8]
push ecx
call fcn.00404354
add esp, 0xc
mov edx, dword [esp + 4]
lea ecx, [esp + 0x3c]
push dword [esp + 8]
call fcn.004032c9
pop eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 4], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x14]
jmp 0x401ddc
mov edi, dword [esp]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov dword [esp + 0x34], esi
mov dword [eax + ebx*8 + 4], edx
mov dword [eax + ebx*8], ecx
add ebp, dword [esp + 0x54]
mov ebx, esi
jmp 0x401c54
lea esi, [esp + 0x30]
mov eax, dword [esi + 0x10]
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
movsd qword [esp + 0x64], xmm0
movsd qword [esp + 0x6c], xmm1
mov dword [esp + 0x74], eax
movsd qword [esp + 0xb4], xmm0
movsd qword [esp + 0xbc], xmm1
mov dword [esp + 0xc4], eax
mov ebp, dword [esp + 0x68]
call fcn.004030b8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, esi
mov edx, str.Found__memory_maps_n
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0x401648
mov edi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x78]
mov dword [esi + 4], edi
mov dword [esi], ebx
push 6
call fcn.004033c0
pop ecx
test ax, ax
jne 0x401f1a
push 0x20
pop esi
push 0x64
pop ecx
mov eax, ebp
cmp eax, 0x64
jb 0x401ec0
xor edx, edx
div ecx
movzx edx, word [edx + edx + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0x8b], dx
add esi, 0xfffffffe
jmp 0x401e88
push 5
pop ecx
lea edi, [esp + 0x78]
mov esi, 0x40507c
mov bx, 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp]
jmp 0x402036
cmp eax, 9
ja 0x401ed0
or al, 0x30
mov byte [esp + esi + 0x8c], al
jmp 0x401ee1
movzx eax, word [eax + eax + str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899]
mov word [esp + esi + 0x8b], ax
dec esi
lea ecx, [esp + esi + 0x8c]
push 0x21
pop edx
lea eax, [esp + 0x78]
sub edx, esi
push eax
push 0x4052d8
call fcn.004037d7
pop ecx
pop edx
test ax, ax
jne 0x401f1a
lea ecx, [esp + 0x44]
lea edx, [0x405182]
mov dword [ecx], ebx
mov dword [ecx + 4], edi
push 0xd
call fcn.004033c0
pop ecx
call fcn.004030c3
mov eax, dword [esp + 0x64]
mov edi, dword [esp]
sub ebp, 1
jb 0x40201d
mov esi, dword [eax + 4]
cmp esi, 0x400000
ja 0x401ffa
mov edi, dword [eax]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x8c]
mov edx, 0x4050d8
push esi
call fcn.00403f0a
pop eax
movzx ebx, word [esp + 0x94]
test bx, bx
jne 0x40202a
mov eax, dword [esp + 0x90]
mov ebx, dword [esp + 0x8c]
and dword [esp + 0x44], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x44]
push eax
push esi
push ebx
push edi
push dword [esp + 0x10]
call sub.KERNEL32.dll_ReadProcessMemory
mov ecx, dword [esp + 0x44]
test eax, eax
je 0x401fc8
cmp ecx, esi
jne 0x401fc8
mov edx, ebx
xor ecx, ecx
push 0
push esi
push 0
push edi
call fcn.00401672
add esp, 0x10
mov edx, ebx
mov ebx, eax
test ax, ax
jne 0x401fdf
test byte [section..data], 1
mov eax, edx
jne 0x402002
xor ebx, ebx
mov edx, eax
jmp 0x401fdf
mov edx, ebx
cmp ecx, esi
push 0xa
pop ebx
mov ecx, 0
cmove ebx, ecx
test eax, eax
push 9
pop eax
cmove ebx, eax
mov ecx, 0x4050d8
push dword [esp + 4]
call fcn.00401a54
pop eax
mov edi, dword [esp]
mov eax, dword [esp + 0x10]
test bx, bx
jne 0x40202d
add eax, 8
jmp 0x401f26
push 4
pop ecx
mov ebx, eax
mov edx, eax
push 0
push esi
push 0
push edi
call fcn.00401672
mov edx, ebx
add esp, 0x10
mov ebx, eax
jmp 0x401fdf
lea ecx, [esp + 0x64]
call fcn.0040204e
xor ebx, ebx
jmp 0x402036
mov edi, dword [esp]
lea ecx, [esp + 0x64]
call fcn.0040204e
push edi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
add esp, 0xc8
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
inc ebx
jmp 0x402036