Function at 0x410b19
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
push 0x40
pop edx
mov ecx, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebp
xor esi, esi
call fcn.004105b9
test eax, eax
je 0x410d6f
mov eax, 0x5a4d
cmp word [ebp], ax
jne 0x410d64
mov edx, dword [ebp + 0x3c]
mov ecx, ebx
add edx, 0xf8
call fcn.004105b9
test eax, eax
je 0x410d6f
mov ebx, dword [ebp + 0x3c]
add ebx, ebp
cmp dword [ebx], 0x4550
jne 0x410d64
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x410d64
test byte [ebx + 0x38], 1
jne 0x410d64
movzx eax, word [ebx + 0x14]
movzx edx, word [ebx + 6]
add eax, 0x24
test edx, edx
je 0x410bbf
lea ecx, [eax + ebx]
cmp dword [ecx + 4], 0
mov eax, dword [ebx + 0x38]
cmovne eax, dword [ecx + 4]
add eax, dword [ecx]
lea ecx, [ecx + 0x28]
cmp eax, esi
cmovbe eax, esi
mov esi, eax
sub edx, 1
jne 0x410ba3
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [esp + 0x1c]
mov ecx, dword [ebx + 0x50]
call fcn.004105ab
mov edx, dword [esp + 0x1c]
mov ecx, esi
mov edi, eax
call fcn.004105ab
cmp edi, eax
jne 0x410d64
xor esi, esi
push esi
push 0x40
push 0x3000
push edi
push dword [ebx + 0x34]
call fcn.00410abe
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x410c26
push esi
push 0x40
push 0x3000
push edi
push esi
call fcn.00410abe
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x410c26
push 0xe
jmp 0x410d69
push 0x40
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x410c4f
push esi
push 0x8000
push esi
push ebp
call fcn.00410ad5
add esp, 0x10
jmp 0x410c1f
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ebp
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x1c], fcn.00410abe
mov dword [edi + 0x14], eax
mov dword [edi + 0x20], fcn.00410ad5
mov dword [edi + 0x24], 0x410ae8
mov dword [edi + 0x28], 0x410af3
mov dword [edi + 0x2c], 0x410b02
mov dword [edi + 0x34], esi
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x3c], eax
mov edx, dword [ebx + 0x54]
call fcn.004105b9
test eax, eax
je 0x410d45
push esi
push 4
push 0x1000
push dword [ebx + 0x54]
push ebp
call fcn.00410abe
push dword [ebx + 0x54]
mov esi, eax
push dword [esp + 0x28]
push esi
call fcn.00435ad0
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edi
mov eax, dword [eax + 0x3c]
add eax, esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ebp
call fcn.004105cc
add esp, 0x28
test eax, eax
je 0x410d45
mov eax, dword [edi]
mov edx, dword [eax + 0x34]
sub edx, dword [ebx + 0x34]
je 0x410cf7
mov ecx, edi
call fcn.004108d5
jmp 0x410cfa
xor eax, eax
inc eax
mov ecx, edi
mov dword [edi + 0x18], eax
call fcn.00410975
test eax, eax
je 0x410d45
mov ecx, edi
call fcn.00410769
test eax, eax
je 0x410d45
mov ecx, edi
call fcn.004108a4
test eax, eax
je 0x410d45
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x410d5c
add eax, ebp
cmp dword [edi + 0x14], 0
je 0x410d57
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x410d4e
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, edi
call fcn.00410eb0
jmp 0x410d6f
mov dword [edi + 0x10], 1
jmp 0x410d60
mov dword [edi + 0x38], eax
jmp 0x410d60
and dword [edi + 0x38], 0
mov eax, edi
jmp 0x410d71
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret