Function at 0x10001ef5
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
push 0x40
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], esi
call fcn.10001a13
test eax, eax
je 0x1000213d
push edi
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10001f32
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10001f49
mov eax, dword [edi + 0x3c]
mov ecx, esi
add eax, 0xf8
push eax
push dword [ebp + 0xc]
call fcn.10001a13
test eax, eax
jne 0x10001f50
xor eax, eax
jmp 0x1000213c
push ebx
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x10001f6e
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10002139
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x10001f5e
test byte [ebx + 0x38], 1
jne 0x10001f5e
movzx edi, word [ebx + 6]
movzx eax, word [ebx + 0x14]
test edi, edi
je 0x10001fb1
mov ecx, dword [ebp - 4]
lea edx, [ebx + 0x24]
add edx, eax
cmp dword [edx + 4], 0
mov eax, dword [edx]
jne 0x10001fa0
add eax, dword [ebx + 0x38]
jmp 0x10001fa3
add eax, dword [edx + 4]
cmp eax, ecx
cmova ecx, eax
add edx, 0x28
dec edi
jne 0x10001f93
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
dec eax
add eax, ecx
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
and eax, edx
and edi, edx
cmp edi, eax
jne 0x10001f5e
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000200b
push 4
push 0x3000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000200b
push 0xe
jmp 0x10001f63
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jne 0x10002034
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10002004
mov dword [edi + 4], ecx
mov ecx, esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push dword [ebp + 0xc]
call fcn.10001a13
test eax, eax
je 0x10002131
push 4
push 0x1000
push dword [ebx + 0x54]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.10002291
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push edi
add eax, esi
mov esi, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, esi
push edx
call fcn.10001a31
test eax, eax
je 0x10002131
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
sub eax, dword [ebx + 0x34]
je 0x100020da
push eax
push edi
mov ecx, esi
call fcn.100021d0
xor ebx, ebx
mov dword [edi + 0x18], eax
inc ebx
jmp 0x100020e0
xor ebx, ebx
inc ebx
mov dword [edi + 0x18], ebx
push edi
mov ecx, esi
call fcn.100018c0
test eax, eax
je 0x10002131
push edi
mov ecx, esi
call fcn.10001bf0
test eax, eax
je 0x10002131
push edi
mov ecx, esi
call fcn.10001b15
test eax, eax
je 0x10002131
mov eax, dword [edi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x1000214e
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [edi + 0x14], 0
je 0x10002149
push 0
push ebx
push 0x10000000
call eax
test eax, eax
jne 0x10002144
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov ecx, esi
call fcn.10001d2a
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov dword [edi + 0x10], ebx
jmp 0x10002152
mov dword [edi + 0x2c], eax
jmp 0x10002152
and dword [edi + 0x2c], 0
mov eax, edi
jmp 0x1000213b