Function at 0x100dead
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push 0x18
mov eax, 0x1013ec8
call fcn.01012132
mov edi, ecx
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::CString_2
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.0100cb7a
mov ecx, dword [ebp + 0xc]
push 0x64
push ebx
call fcn.0100cb37
mov ecx, dword [ebp + 0xc]
push 1
call fcn.0100cb59
lea ecx, [edi + 8]
call fcn.0100d46f
cmp dword [edi + 0x30], 1
je 0x100e0a2
mov eax, 0x10000
push eax
mov dword [ebp - 0x14], eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
cmp esi, ebx
je 0x100e0a2
jmp 0x100df1c
mov esi, dword [ebp - 0x18]
push ebx
push dword [ebp - 0x14]
push esi
push 0xb
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, ebx
mov dword [ebp - 0x20], eax
jge 0x100df6c
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
cmp dword [ebp - 0x20], 0xc0000004
pop ecx
jne 0x100df5c
add dword [ebp - 0x14], 0x1000
push dword [ebp - 0x14]
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x100df19
jmp 0x100e0a2
push dword [ebp - 0x20]
push 0x6e
call fcn.0100aec8
pop ecx
jmp 0x100e0a1
push dword [esi]
mov ecx, dword [ebp + 0xc]
push ebx
call fcn.0100cb37
mov dword [ebp - 0x14], ebx
cmp dword [esi], ebx
jbe 0x100e094
cmp dword [ebp + 8], ebx
je 0x100df99
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x100e0bb
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x11c
add eax, esi
mov ecx, dword [eax + 0xc]
cmp ecx, dword [0x101779c]
jae 0x100dfbc
mov ecx, dword [ebp + 0xc]
call fcn.0100cf83
jmp 0x100e086
add eax, 0x20
mov dword [ebp - 0x20], eax
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x100dfc5
sub eax, esi
mov esi, eax
lea edi, [esi + 1]
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::GetBuffer
cmp eax, ebx
je 0x100e0c3
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x20]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::ReleaseBuffer
push 0x5c
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::ReverseFind
cmp eax, ebx
jle 0x100e033
sub esi, eax
dec esi
push esi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::Right
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::operator_2
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::MakeLower
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x10]
mov ecx, esi
call fcn.0100dae0
cmp dword [ebp - 0x14], ebx
je 0x100e053
cmp dword [ebp - 0x14], 1
jne 0x100e079
cmp eax, ebx
jl 0x100e079
push eax
lea ecx, [esi + 8]
call fcn.01009c92
lea ecx, [eax + 0x14]
cmp dword [ebp - 0x14], ebx
jne 0x100e06f
push 0x1002dd0
jmp 0x100e074
push 0x1002dc0
call sub.MFC42u.dll_CString::operator_3
mov ecx, dword [ebp + 0xc]
call fcn.0100cf83
mov edi, esi
mov esi, dword [ebp - 0x18]
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi]
jb 0x100df82
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov dword [edi + 0x30], 1
pop ecx
mov edi, dword [edi + 0x30]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42u.dll_CString::CString
mov eax, edi
call fcn.010121e0
ret 8
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
jmp 0x100e0a1
push 0x68
call fcn.0100aec8
mov edi, dword [ebp - 0x1c]
jmp 0x100e0a1