Function at 0x10003e0f
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 8], esi
call fcn.1000393c
test eax, eax
je 0x10004067
mov edi, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1000405c
mov eax, dword [edi + 0x3c]
mov ecx, esi
add eax, 0xf8
push eax
push dword [ebp + 0xc]
call fcn.1000393c
test eax, eax
je 0x10004067
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
jne 0x1000405c
mov eax, 0x14c
cmp word [ebx + 4], ax
jne 0x1000405c
test byte [ebx + 0x38], 1
jne 0x1000405c
movzx eax, word [ebx + 0x14]
movzx edi, word [ebx + 6]
add eax, 0x24
test edi, edi
je 0x10003ebd
mov ecx, dword [ebp - 4]
lea edx, [eax + ebx]
cmp dword [edx + 4], 0
mov eax, dword [ebx + 0x38]
cmovne eax, dword [edx + 4]
add eax, dword [edx]
lea edx, [edx + 0x28]
cmp eax, ecx
cmovbe eax, ecx
mov ecx, eax
sub edi, 1
jne 0x10003e9e
mov dword [ebp - 4], ecx
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
dec eax
add eax, ecx
lea edx, [ecx - 1]
lea edi, [ecx - 1]
not edx
add edi, dword [ebx + 0x50]
and eax, edx
and edi, edx
cmp edi, eax
jne 0x1000405c
push 4
push 0x3000
push edi
push dword [ebx + 0x34]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10003f1b
push 4
push 0x3000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10003f1b
push 0xe
jmp 0x10004061
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 4]
mov edi, eax
test edi, edi
jne 0x10003f44
push 0x8000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10003f14
mov dword [edi + 4], ecx
mov ecx, esi
movzx eax, word [ebx + 0x16]
shr eax, 0xd
and eax, 1
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x30], eax
push dword [ebx + 0x54]
push dword [ebp + 0xc]
call fcn.1000393c
test eax, eax
je 0x1000403c
push 4
push 0x1000
push dword [ebx + 0x54]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push dword [ebx + 0x54]
mov esi, eax
push dword [ebp + 8]
push esi
call fcn.100041a4
mov edx, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
push edi
add eax, esi
mov esi, dword [ebp - 8]
push ebx
push dword [ebp + 0xc]
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, esi
push edx
call fcn.1000395a
test eax, eax
je 0x1000403c
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
sub eax, dword [ebx + 0x34]
je 0x10003fe4
push eax
push edi
mov ecx, esi
call fcn.100040ea
jmp 0x10003fe7
xor eax, eax
inc eax
push edi
mov ecx, esi
mov dword [edi + 0x18], eax
call fcn.100037dd
test eax, eax
je 0x1000403c
push edi
mov ecx, esi
call fcn.10003b13
test eax, eax
je 0x1000403c
push edi
mov ecx, esi
call fcn.10003a3f
test eax, eax
je 0x1000403c
mov eax, dword [edi]
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x10004054
mov eax, dword [ebp - 4]
add eax, ecx
cmp dword [edi + 0x14], 0
je 0x1000404f
push 0
push 1
push 0x10000000
call eax
test eax, eax
jne 0x10004046
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
mov ecx, esi
call fcn.10003c42
jmp 0x10004067
mov dword [edi + 0x10], 1
jmp 0x10004058
mov dword [edi + 0x2c], eax
jmp 0x10004058
and dword [edi + 0x2c], 0
mov eax, edi
jmp 0x10004069
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x18