Function at 0x10001a07
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebp, ecx
cmp dword [0x10009eac], 0
jne 0x10001a3f
mov eax, dword [0x10009ea4]
test eax, eax
jne 0x10001a35
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 4]
mov dword [0x10009ea4], eax
mov dword [0x10009eac], eax
mov dword [0x10009eb0], eax
cmp dword [0x10009eb4], 0
jne 0x10001a6e
mov eax, dword [0x10009ea8]
test eax, eax
jne 0x10001a64
lea esi, [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x1c]
mov dword [0x10009ea8], eax
mov dword [0x10009eb4], eax
mov dword [0x10009eb8], eax
cmp dword [0x10009ebc], 0
jne 0x10001a88
xor ecx, ecx
xor edx, edx
call fcn.10001d9d
test eax, eax
je 0x10001d10
test ebp, ebp
js 0x10001bd0
mov ecx, dword [0x10009ebc]
mov eax, dword [ecx]
mov ebx, dword [ecx + 4]
lea edx, [eax + ebp]
sub edx, ebx
test edx, edx
jle 0x10001c57
mov edi, dword [0x10009eb0]
add edx, edi
dec edx
neg edi
and edi, edx
lea edx, [ebx + edi]
mov esi, dword [ecx + 8]
sub edx, esi
mov dword [esp + 0x10], edx
test edx, edx
jle 0x10001c83
sub esi, ebx
test esi, esi
jle 0x10001af2
push 4
push 0x1000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x10009ebc]
cmp eax, dword [ecx + 4]
jne 0x10001d10
add eax, esi
mov dword [ecx + 4], eax
mov dword [esp + 0xc], edi
dec dword [esp + 0x10]
mov dword [esp], ebp
lea esi, [ebp - 1]
mov bl, 1
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, dword [0x10009eb8]
mov eax, dword [esp + 0x10]
add eax, edi
neg edi
and edi, eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x14], eax
push 0x1c
lea ecx, [esp + 0x18]
push ecx
push eax
call ebp
test eax, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
je 0x10001b84
xor ebx, ebx
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x24], 0x10000
jne 0x10001b5d
mov eax, ecx
xor edx, edx
div dword [0x10009eb4]
mov eax, dword [esp + 0x20]
test edx, edx
jne 0x10001b61
cmp eax, edi
jb 0x10001b61
jmp 0x10001b9b
mov eax, dword [esp + 0x20]
mov edi, dword [0x10009eb8]
lea edx, [esi + edi]
neg edi
and edi, edx
add ecx, eax
mov dword [esp + 0x14], ecx
push 0x1c
lea eax, [esp + 0x18]
push eax
push ecx
call ebp
mov bl, 1
test eax, eax
jne 0x10001b37
test byte [esp + 4], 1
jne 0x10001d10
cmp dword [esp + 8], 0
setne bl
mov ecx, dword [esp + 0x14]
push 1
push 0x2000
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10001d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x1e7
jne 0x10001d10
mov ecx, dword [0x10009ebc]
xor ebx, ebx
jmp 0x10001b08
mov esi, ebp
neg esi
mov edi, dword [0x10009ebc]
mov eax, dword [edi]
mov ebx, dword [edi + 8]
lea edx, [eax + ebp]
mov ecx, dword [edi + 0xc]
mov dword [esp], ebp
mov ebp, ebx
sub ebp, ecx
cmp edx, ebp
jae 0x10001c5b
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x10001d10
mov ebx, dword [0x10009ebc]
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0x14
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x10001d10
add esi, ebp
sub esi, dword [esp + 4]
mov dword [0x10009ebc], edi
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov edx, eax
sub edx, esi
mov ecx, dword [edi + 0xc]
mov ebp, ebx
sub ebp, ecx
cmp edx, ebp
jb 0x10001bf0
mov dword [esp + 8], ebx
mov ebx, esi
neg ebx
jmp 0x10001c62
mov esi, ebp
jmp 0x10001ca8
mov dword [esp + 8], ebx
mov ebx, dword [esp]
neg ecx
mov dword [esp + 4], edi
mov edi, dword [edi + 4]
mov ebp, edi
sub ebp, edx
mov edx, dword [0x10009eb0]
cmp ebp, edx
jge 0x10001cb0
mov edx, dword [esp + 8]
mov ebp, dword [esp + 4]
jmp 0x10001ce4
mov esi, ebp
push 4
push 0x1000
push edi
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x10009ebc]
cmp eax, dword [ecx + 4]
jne 0x10001d10
add eax, edi
mov dword [ecx + 4], eax
mov eax, dword [ecx]
add eax, esi
mov dword [ecx], eax
sub eax, ebp
jmp 0x10001d13
neg edx
and ebp, edx
sub edi, ebp
push 0x4000
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x10001d10
mov ebp, dword [0x10009ebc]
add esi, edi
mov ebx, dword [ebp]
sub ebx, esi
mov edx, dword [ebp + 8]
mov dword [ebp + 4], edi
mov dword [ebp], edi
xor ecx, ecx
sub ecx, dword [ebp + 0xc]
mov eax, edi
add ecx, edx
add ebx, eax
cmp ecx, ebx
seta al
cmp ebx, edi
seta dl
or dl, al
xor eax, eax
dec eax
test dl, dl
cmove ecx, ebx
mov dword [ebp], ecx
cmove eax, ebx
jmp 0x10001d13
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10001d1b
cmp eax, ecx
je 0x10001d1b
xor eax, eax
dec eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebp, dword [esp]
mov esi, ebp
test bl, 1
jne 0x10001d53
mov ecx, dword [0x10009ebc]
mov edx, dword [ecx]
mov ebp, dword [ecx + 4]
mov esi, edx
sub esi, ebp
add esi, dword [esp]
mov dword [ecx], ebp
add edx, dword [esp]
mov ecx, dword [0x10009eb0]
not ebp
add ebp, ecx
add ebp, edx
neg ecx
and ecx, ebp
mov dword [esp + 0xc], ecx
mov ebp, dword [esp]
mov ecx, eax
mov edx, edi
call fcn.10001d9d
test eax, eax
je 0x10001d8a
xor bl, 1
test bl, 1
jne 0x10001d8a
mov ecx, dword [0x10009ebc]
mov eax, dword [ecx]
add eax, esi
mov edx, dword [ecx + 4]
mov edi, dword [0x10009eb0]
not edx
add edx, eax
add edx, edi
neg edi
and edi, edx
jmp 0x10001c85
test eax, eax
je 0x10001d10
mov ecx, dword [0x10009ebc]
mov edi, dword [esp + 0xc]
jmp 0x10001c85