Function at 0x61037b60
Capabilities:
Get system information on windows
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0x48]
push edi
push esi
push ebx
sub esp, 0x1cc
mov edi, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetSystemInfo
xor eax, eax
sub esp, 4
mov dword [ebp - 0x17c], eax
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], 0x61037720
mov eax, dword [ebp - 0x17c]
lea edx, [ebp - 0x148]
mov dword [esp], edx
mov dword [esp + 8], eax
call fcn.6108c610
mov dword [esp + 0xc], 1
lea ecx, [ebp - 0x16c]
lea eax, [ebp - 0x148]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call fcn.610f48e8
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x610388ed
call sub.KERNEL32.dll_GetCurrentThread
movzx ecx, byte [ebp - 0x17c]
mov edx, 1
mov dword [esp], eax
shl edx, cl
mov dword [esp + 4], edx
call sub.KERNEL32.dll_SetThreadAffinityMask
mov dword [ebp - 0x178], eax
sub esp, 8
test eax, eax
jne 0x61037c26
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x610388c4
xor eax, eax
call fcn.61055610
pushfd
pop eax
mov edx, eax
xor eax, 0x40000
push eax
popfd
pushfd
pop eax
push edx
popfd
xor eax, edx
test eax, 0x40000
jne 0x61038080
mov eax, dword [0x610f08a0]
test eax, eax
jne 0x61038056
mov dword [esp], edi
mov eax, dword [ebp - 0x17c]
lea esi, [ebp - 0x174]
mov dword [esp + 4], 0x61037750
mov dword [esp + 8], eax
call fcn.6108c610
mov dword [esp + 0xc], esi
add edi, eax
lea edx, [ebp - 0x170]
mov dword [esp + 0x14], edx
mov eax, 0x100
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x16c]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x61037766
mov dword [esp], eax
call fcn.610f4938
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x61037ccd
cmp eax, 0xea
jne 0x6103804d
mov eax, dword [ebp - 0x174]
cmp eax, 1
jne 0x61038025
mov dword [esp], edi
lea eax, [ebp - 0x148]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x61037777
call fcn.6108c610
mov dword [esp + 0xc], esi
add edi, eax
mov ecx, 0x100
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x170]
mov dword [esp + 0x14], edx
lea ecx, [ebp - 0x148]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6103778d
mov dword [esp], eax
call fcn.610f4938
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x61037d4d
cmp eax, 0xea
jne 0x61038044
mov eax, dword [ebp - 0x174]
cmp eax, 1
jne 0x61038025
mov dword [esp], edi
lea eax, [ebp - 0x148]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x61037798
call fcn.6108c610
add edi, eax
mov eax, dword [0x61148914]
movzx eax, byte [eax + 0xc]
and eax, 1
test al, al
jne 0x61037de0
mov eax, dword [ebp - 0x178]
test eax, eax
jne 0x61037dc0
mov eax, dword [ebp - 0x16c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp], edi
mov dword [esp + 4], 0x610377ae
call fcn.6108c610
inc dword [ebp - 0x17c]
add edi, eax
jmp 0x61037b90
call sub.KERNEL32.dll_GetCurrentThread
mov dword [esp], eax
mov edx, dword [ebp - 0x178]
mov dword [esp + 4], edx
call sub.KERNEL32.dll_SetThreadAffinityMask
sub esp, 8
jmp 0x61037d92
mov dword [esp + 0xc], esi
mov eax, 0x100
lea edx, [ebp - 0x170]
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0x148]
mov eax, dword [ebp - 0x16c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x610377b0
mov dword [esp], eax
call fcn.610f4938
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x61037e35
cmp eax, 0xea
jne 0x61037fdd
mov eax, dword [ebp - 0x174]
cmp eax, 4
jne 0x61037f95
mov dword [esp], edi
mov eax, dword [ebp - 0x148]
mov dword [esp + 4], 0x610377b5
mov dword [esp + 8], eax
call fcn.6108c610
add edi, eax
mov dword [edi], 0x67616c66
mov dword [edi + 4], 0x20202073
mov dword [edi + 8], 0x20202020
mov dword [edi + 0xc], 0x20202020
mov word [edi + 0x10], 0x3a
add edi, 0x11
mov dword [esp], 7
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037eaa
mov dword [edi], 0x6e643320
mov word [edi + 4], 0x776f
mov byte [edi + 6], 0
add edi, 6
mov dword [esp], 2
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037eca
mov dword [edi], 0x38786320
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 1
call fcn.61106148
sub esp, 4
test eax, eax
jne 0x61037eea
mov dword [edi], 0x75706620
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 3
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037f0a
mov dword [edi], 0x786d6d20
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 9
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037f2a
mov dword [edi], 0x65617020
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 8
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037f4a
mov dword [edi], 0x63737420
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 6
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037f6a
mov dword [edi], 0x65737320
mov byte [edi + 4], 0
add edi, 4
mov dword [esp], 0xa
call fcn.61106148
sub esp, 4
test eax, eax
je 0x61037d88
mov dword [edi], 0x65737320
mov word [edi + 4], 0x32
add edi, 5
jmp 0x61037d88
mov edx, dword [0x610f08a0]
test edx, edx
jne 0x61037fab
xor eax, eax
xor edx, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x610377e0
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61037f9f
mov ecx, eax
mov edx, 0x27e
mov eax, 0x61036cc0
call fcn.61022e00
mov esi, dword [0x610f08a0]
test esi, esi
je 0x61037f9f
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61037820
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61037f9f
mov edx, dword [0x610f08a0]
test edx, edx
je 0x61037f9f
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 1
jmp 0x61037fb7
mov ecx, eax
mov edx, 0x27a
jmp 0x61037fe4
mov ecx, eax
mov edx, 0x278
jmp 0x61037fe4
mov dword [esp + 0xc], 0x61037842
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61037c56
mov ecx, dword [0x610f08a0]
test ecx, ecx
jne 0x61038895
pushfd
pop eax
mov edx, eax
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
push edx
popfd
xor eax, edx
test eax, 0x200000
je 0x61038880
test ecx, ecx
jne 0x61038850
mov dword [esp], edi
mov eax, dword [ebp - 0x17c]
lea esi, [ebp - 0x158]
mov dword [esp + 4], 0x61037750
mov dword [esp + 8], eax
call fcn.6108c610
mov dword [esp + 8], esi
add edi, eax
xor eax, eax
cpuid
mov dword [ebp - 0x15c], eax
and eax, 0xffff
mov dword [ebp - 0x180], eax
xor eax, eax
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
xor ebx, ebx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x154], edx
mov dword [esp], edi
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], eax
mov dword [esp + 4], 0x61037777
call fcn.6108c610
mov dword [ebp - 0x184], ebx
mov edx, dword [0x61148914]
add edi, eax
mov dword [ebp - 0x1a8], edx
movzx eax, byte [edx + 0xc]
and eax, 1
test al, al
jne 0x610387bc
mov eax, dword [ebp - 0x180]
test eax, eax
je 0x61038765
mov eax, 1
cpuid
mov dword [ebp - 0x188], ecx
mov esi, edx
mov dword [ebp - 0x160], ecx
mov ecx, eax
and ecx, 0xf00
mov dword [ebp - 0x168], eax
shr ecx, 8
mov dword [ebp - 0x18c], ecx
mov ecx, eax
and ecx, 0xf0
mov dword [ebp - 0x15c], edx
shr ecx, 4
mov edx, eax
mov dword [ebp - 0x190], ecx
and eax, 0xf
and edx, 0x3000
mov dword [ebp - 0x194], eax
mov ecx, ebx
shr edx, 0xc
mov dword [ebp - 0x164], ebx
mov eax, ebx
and ecx, 0xff0000
and eax, 0xf
shr ecx, 0x10
shr ebx, 0x18
mov dword [ebp - 0x198], eax
cmp edx, 1
mov eax, 0x6103785b
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x1a4], eax
je 0x61038220
mov ebx, 0x6103786f
cmp edx, 1
mov dword [ebp - 0x1a4], ebx
jb 0x61038220
mov ecx, 0x61037881
cmp edx, 2
mov dword [ebp - 0x1a4], ecx
je 0x61038220
mov edx, 0x61037895
mov dword [ebp - 0x1a4], edx
lea esi, [esi]
mov eax, 0x80000000
cpuid
mov dword [ebp - 0x168], eax
cmp eax, 0x80000003
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], edx
jbe 0x6103874a
mov eax, 0x80000002
cpuid
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x148], eax
mov eax, 0x80000003
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x13c], edx
cpuid
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x138], eax
mov eax, 0x80000004
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], edx
cpuid
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x128], eax
xor eax, eax
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x118], eax
mov edx, dword [ebp - 0x1a8]
movzx eax, byte [edx + 0xc]
and eax, 1
test al, al
je 0x610386ce
mov eax, esi
mov edx, 0x6103789e
and eax, 1
test al, al
jne 0x6103831f
mov edx, 0x610378a2
mov dword [esp + 0x2c], edx
mov ecx, dword [ebp - 0x184]
mov eax, dword [ebp - 0x1a0]
mov dword [esp + 4], 0x610378c0
mov edx, dword [ebp - 0x19c]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x198]
mov dword [esp + 0x24], eax
mov eax, dword [ebp - 0x194]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x148]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x190]
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x18c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x1a4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], edi
call fcn.6108c610
add edi, eax
mov eax, esi
and eax, 1
mov dword [edi], 0x67616c66
mov dword [edi + 4], 0x20202073
mov dword [edi + 8], 0x20202020
mov dword [edi + 0xc], 0x20202020
mov word [edi + 0x10], 0x3a
add edi, 0x11
test al, al
je 0x610383c9
mov dword [edi], 0x75706620
mov byte [edi + 4], 0
add edi, 4
test esi, 2
je 0x610383de
mov dword [edi], 0x656d7620
mov byte [edi + 4], 0
add edi, 4
test esi, 4
je 0x610383ef
mov dword [edi], 0x656420
add edi, 3
test esi, 8
je 0x61038404
mov dword [edi], 0x65737020
mov byte [edi + 4], 0
add edi, 4
test esi, 0x10
je 0x61038419
mov dword [edi], 0x63737420
mov byte [edi + 4], 0
add edi, 4
test esi, 0x20
je 0x6103842e
mov dword [edi], 0x72736d20
mov byte [edi + 4], 0
add edi, 4
test esi, 0x40
je 0x61038443
mov dword [edi], 0x65617020
mov byte [edi + 4], 0
add edi, 4
mov eax, esi
test al, al
jns 0x61038456
mov dword [edi], 0x65636d20
mov byte [edi + 4], 0
add edi, 4
test esi, 0x100
je 0x6103846b
mov dword [edi], 0x38786320
mov byte [edi + 4], 0
add edi, 4
test esi, 0x200
je 0x61038482
mov dword [edi], 0x69706120
mov word [edi + 4], 0x63
add edi, 5
test esi, 0x800
je 0x61038497
mov dword [edi], 0x70657320
mov byte [edi + 4], 0
add edi, 4
test esi, 0x1000
je 0x610384ae
mov dword [edi], 0x72746d20
mov word [edi + 4], 0x72
add edi, 5
test esi, 0x2000
je 0x610384c3
mov dword [edi], 0x65677020
mov byte [edi + 4], 0
add edi, 4
test esi, 0x4000
je 0x610384d8
mov dword [edi], 0x61636d20
mov byte [edi + 4], 0
add edi, 4
mov eax, esi
and eax, 0xffff8000
test ax, ax
je 0x610384f3
mov dword [edi], 0x6f6d6320
mov word [edi + 4], 0x76
add edi, 5
test esi, 0x10000
je 0x61038508
mov dword [edi], 0x74617020
mov byte [edi + 4], 0
add edi, 4
test esi, 0x20000
je 0x61038523
mov dword [edi], 0x65737020
mov word [edi + 4], 0x3633
mov byte [edi + 6], 0
add edi, 6
test esi, 0x40000
je 0x61038538
mov dword [edi], 0x6e737020
mov byte [edi + 4], 0
add edi, 4
test esi, 0x80000
je 0x6103854f
mov dword [edi], 0x666c6320
mov word [edi + 4], 0x6c
add edi, 5
test esi, 0x200000
je 0x61038566
mov dword [edi], 0x65746420
mov word [edi + 4], 0x73
add edi, 5
test esi, 0x400000
je 0x6103857d
mov dword [edi], 0x70636120
mov word [edi + 4], 0x69
add edi, 5
test esi, 0x800000
je 0x61038592
mov dword [edi], 0x786d6d20
mov byte [edi + 4], 0
add edi, 4
test esi, 0x1000000
je 0x610385a9
mov dword [edi], 0x73786620
mov word [edi + 4], 0x72
add edi, 5
test esi, 0x2000000
je 0x610385be
mov dword [edi], 0x65737320
mov byte [edi + 4], 0
add edi, 4
test esi, 0x4000000
je 0x610385d5
mov dword [edi], 0x65737320
mov word [edi + 4], 0x32
add edi, 5
test esi, 0x8000000
je 0x610385e6
mov dword [edi], 0x737320
add edi, 3
test esi, 0x10000000
je 0x610385fb
mov dword [edi], 0x74746820
mov byte [edi + 4], 0
add edi, 4
test esi, 0x20000000
je 0x61038610
mov dword [edi], 0x696d7420
mov byte [edi + 4], 0
add edi, 4
test esi, 0x40000000
je 0x6103862b
mov dword [edi], 0x2d616920
mov word [edi + 4], 0x3436
mov byte [edi + 6], 0
add edi, 6
test esi, esi
js 0x610386bc
mov eax, dword [ebp - 0x188]
and eax, 1
test al, al
je 0x6103864f
mov dword [edi], 0x65737320
mov word [edi + 4], 0x33
add edi, 5
test byte [ebp - 0x188], 8
je 0x61038665
mov dword [edi], 0x6e6f6d20
mov byte [edi + 4], 0
add edi, 4
test byte [ebp - 0x188], 0x10
je 0x61038681
mov dword [edi], 0x63736420
mov word [edi + 4], 0x6c70
mov byte [edi + 6], 0
add edi, 6
test dword [ebp - 0x188], 0x100
je 0x6103869a
mov dword [edi], 0x326d7420
mov byte [edi + 4], 0
add edi, 4
test dword [ebp - 0x188], 0x400
je 0x61037d88
mov dword [edi], 0x64696320
mov byte [edi + 4], 0
add edi, 4
jmp 0x61037d88
mov dword [edi], 0x65627020
mov byte [edi + 4], 0
add edi, 4
jmp 0x61038633
mov eax, esi
mov edx, 0x6103789e
and eax, 1
test al, al
jne 0x610386e1
mov edx, 0x610378a2
mov dword [esp + 0x28], edx
mov ecx, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x19c]
mov dword [esp + 4], 0x610379a0
mov edx, dword [ebp - 0x198]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x194]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x148]
mov dword [esp + 0x1c], edx
mov edx, dword [ebp - 0x190]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x18c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1a4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.6108c610
jmp 0x6103838d
mov eax, 0x6e6b6e75
mov dword [ebp - 0x148], eax
mov eax, 0x6e776f
mov dword [ebp - 0x144], eax
jmp 0x610382f7
mov edx, dword [ebp - 0x1a8]
movzx eax, byte [edx + 0xc]
and eax, 1
test al, al
je 0x61037d88
mov dword [esp], 1
call fcn.61106148
sub esp, 4
mov edx, 0x610378a2
test eax, eax
jne 0x61038797
mov edx, 0x6103789e
mov dword [esp], edi
mov ecx, dword [ebp - 0x184]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x61037a60
mov dword [esp + 8], ecx
call fcn.6108c610
add edi, eax
jmp 0x61037d88
mov dword [esp + 8], 0
lea eax, [ebp - 0x170]
mov ecx, 0x100
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x174]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0x148]
mov dword [esp + 0x10], ecx
mov dword [esp + 4], 0x610377b0
mov dword [esp], eax
call fcn.610f4938
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x61038813
cmp eax, 0xea
jne 0x6103883f
mov eax, dword [ebp - 0x174]
cmp eax, 4
jne 0x61037f95
mov eax, dword [ebp - 0x148]
mov edx, dword [0x61148914]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1a8], edx
jmp 0x6103814e
mov ecx, eax
mov edx, 0x29f
jmp 0x61037fe4
mov dword [esp + 0xc], 0x61037aa0
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x610380b2
test ecx, ecx
je 0x61037c56
mov dword [esp + 0xc], 0x61037ae0
jmp 0x6103805e
mov dword [esp + 0xc], 0x61037b0d
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
mov ecx, dword [0x610f08a0]
jmp 0x6103808e
mov dword [esp + 0xc], 0x61037b20
mov dword [esp + 8], 0x610376e0
mov dword [esp + 4], 0x40
mov dword [esp], 0x610f089c
call fcn.6108fd50
jmp 0x61037c26
cmp eax, 2
je 0x61038921
mov ecx, eax
mov edx, 0x258
mov eax, 0x61036cc0
call fcn.61022e00
mov eax, dword [0x610f08a0]
test eax, eax
je 0x61037f9f
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x61037b40
jmp 0x61038004
mov eax, dword [ebp + 8]
sub edi, eax
mov eax, edi
cdq
jmp 0x61037fa3