Function at 0x1004ce80
Capabilities:
Create thread
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x1015dfa6
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0xec], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x104]
mov dword fs:[0], eax
mov eax, dword [esp + 0x130]
mov esi, dword [esp + 0x114]
mov edi, dword [esp + 0x118]
mov dword [esp + 0x7c], esi
mov dword [esp + 0x64], eax
xor ebp, ebp
mov byte [eax], 0
test edx, edx
mov ebx, 1
mov dword [esp + 0x78], ebx
test eax, 0x6ec2
push 0x10165378
push edi
call fcn.101020d0
add esp, 8
test eax, eax
je 0x1004cf19
push 0x10165630
push edi
call fcn.101020d0
add esp, 8
test eax, eax
jne 0x1004cf19
xor ebx, ebx
mov dword [esp + 0x78], ebx
test cl, cl
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10c], 1
nop
cmp ebx, ebp
je 0x1004d2b9
test esi, esi
jns 0x1004cf50
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1004cf50
and esi, 0x7fffffff
jmp 0x1004cf6a
mov dword [esp + 0x5c], ebp
mov bl, bl
lea eax, [esp + 0x5c]
push eax
push esi
call fcn.10064eb0
add esp, 8
test ecx, ecx
mov esi, dword [esp + 0x5c]
test cl, cl
push ebp
push ebp
push esi
push ebp
push 0x400
call fcn.100648d0
add esp, 0x14
mov dword [esp + 0x58], eax
test al, al
cmp eax, ebp
je 0x1004d09c
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov bh, bh
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
test eax, 0xfc9
mov bl, 0x49
mov dl, 0x36
mov cl, 0x34
mov al, 0x78
mov byte [esp + 0x88], 0x25
mov byte [esp + 0x89], bl
mov byte [esp + 0x8a], dl
mov byte [esp + 0x8b], cl
mov byte [esp + 0x8c], al
mov byte [esp + 0x8d], 0x2d
mov byte [esp + 0x8e], 0x25
mov byte [esp + 0x8f], bl
mov byte [esp + 0x90], dl
mov byte [esp + 0x91], cl
mov byte [esp + 0x92], al
mov byte [esp + 0x93], 0
mov ah, ah
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x90]
push eax
push edi
call fcn.10104175
add esp, 0x10
mov ch, ch
push esi
call fcn.10068fc0
add esp, 4
mov byte [esp + 0x68], al
mov ah, ah
test al, al
mov edx, dword [esp + 0x2c]
je 0x1004d0da
cmp edx, 0x80000000
ja 0x1004d08d
mov ebx, dword [esp + 0x28]
jb 0x1004d04e
cmp ebx, ebp
jae 0x1004d08d
mov ecx, dword [esp + 0x24]
cmp edx, ecx
ja 0x1004d08d
mov eax, dword [esp + 0x20]
jb 0x1004d060
cmp ebx, eax
ja 0x1004d08d
cmp ecx, 0x80000000
jb 0x1004d12f
ja 0x1004d076
cmp eax, ebp
jb 0x1004d12f
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], SysReAllocStringLen
push ecx
pop ecx
jmp 0x1004d127
mov ecx, dword [esp + 0x58]
push ecx
call fcn.100486c0
add esp, 4
test bh, bh
mov dword [esp + 0x10c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1004cac0
xor eax, eax
mov ecx, dword [esp + 0x104]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xec]
xor ecx, esp
call fcn.1010190d
add esp, 0xfc
ret
cmp edx, ebp
ja 0x1004d2a5
mov ebx, dword [esp + 0x28]
jb 0x1004d0f4
cmp ebx, 0x80000000
jae 0x1004d2a5
mov ecx, dword [esp + 0x24]
cmp edx, ecx
ja 0x1004d2a5
mov eax, dword [esp + 0x20]
jb 0x1004d10e
cmp ebx, eax
ja 0x1004d2a5
cmp ecx, ebp
ja 0x1004d119
cmp eax, 0x80000000
jb 0x1004d12f
mov dword [esp + 0x20], SysReAllocStringLen
mov dword [esp + 0x24], ebp
mov bh, bh
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov ebp, edx
mov ecx, ecx
cmp ebp, dword [esp + 0x24]
ja 0x1004d291
jb 0x1004d150
cmp ebx, dword [esp + 0x20]
jae 0x1004d291
lea esp, [esp]
nop
test eax, 0x5b26
mov edx, dword [esp + 0x68]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x80]
push edx
mov edx, dword [esp + 0x68]
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x70]
push ecx
push ebp
push ebx
push edx
call fcn.10047a00
add esp, 0x24
test al, al
je 0x1004d291
push 0x3f
lea eax, [esp + 0xc5]
push 0
push eax
mov byte [esp + 0xcc], 0
call fcn.10102a00
add esp, 0xc
mov ebx, ebx
mov esi, dword [esp + 0x5c]
add esi, dword [esp + 0x80]
mov edi, dword [esp + 0x60]
adc edi, dword [esp + 0x84]
mov ecx, esi
add ecx, 0xffffffff
mov eax, edi
adc eax, 0xffffffff
mov edi, edi
mov edx, dword [esp + 0x24]
cmp eax, edx
jb 0x1004d1e9
ja 0x1004d1e1
cmp ecx, dword [esp + 0x20]
jbe 0x1004d1e9
mov ecx, dword [esp + 0x20]
mov eax, edx
mov ebp, ebp
push eax
push ecx
push ebp
push ebx
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0xd4]
push edx
call fcn.10103959
add esp, 0x18
mov esi, esi
lea eax, [esp + 0x57]
push eax
lea ecx, [esp + 0xc4]
push ecx
lea ecx, [esp + 0xa8]
call fcn.100085d0
mov byte [esp + 0x10c], 2
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
lea edx, [esp + 0x57]
lea ecx, [esp + 0xa0]
je 0x1004d24f
push edx
push ecx
push eax
call fcn.1004b1c0
add esp, 0xc
add dword [esp + 0x18], 0x18
jmp 0x1004d25f
push 1
push 1
push edx
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.1004cdc0
mov byte [esp + 0x10c], 1
lea ecx, [esp + 0xa0]
call fcn.10006e20
test dh, dh
mov ebx, esi
mov ebp, edi
test dh, dh
cmp ebp, dword [esp + 0x24]
jb 0x1004d150
ja 0x1004d291
cmp ebx, dword [esp + 0x20]
jb 0x1004d150
mov edx, dword [esp + 0x58]
push edx
call fcn.100486c0
add esp, 4
mov dh, dh
jmp 0x1004d49d
mov eax, dword [esp + 0x58]
push eax
call fcn.100486c0
add esp, 4
push edx
pop edx
jmp 0x1004d09c
mov ebx, edi
mov ecx, ecx
mov edi, edi
jmp 0x1004d2c3
xor ebp, ebp
xor eax, eax
mov byte [esp + 0xa0], 0
mov dword [esp + 0xa1], eax
mov dword [esp + 0xa5], eax
mov dword [esp + 0xa9], eax
mov dword [esp + 0xad], eax
mov dword [esp + 0xb1], eax
mov dword [esp + 0xb5], eax
mov dword [esp + 0xb9], eax
mov word [esp + 0xbd], ax
mov byte [esp + 0xbf], al
mov eax, eax
push 0x10165378
push ebx
call fcn.101020d0
mov esi, eax
add esp, 8
mov dword [esp + 0x68], esi
test ah, ah
cmp esi, ebp
lea edx, [esp + 0xa0]
je 0x1004d343
mov ecx, esi
sub ecx, ebx
push ecx
push ebx
push edx
call fcn.10104780
add esp, 0xc
mov cl, cl
jmp 0x1004d355
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x1004d347
mov ecx, ecx
lea ebx, [esi + 1]
test eax, 0x5493
lea eax, [esp + 0x88]
mov ecx, eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], ecx
mov byte [esp + 0x10c], 3
lea eax, [esp + 0xa0]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1004d386
sub eax, edx
lea edi, [esp + eax + 0xa0]
mov esi, edi
lea edx, [esp + 0xa0]
sub esi, edx
lea eax, [esi + 1]
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
ja 0x1004d883
test eax, eax
jbe 0x1004d883
cmp eax, 0x10
jbe 0x1004d3f0
lea ecx, [esp + 0x20]
push ecx
push eax
lea ecx, [esp + 0xa4]
call fcn.10003590
mov dword [esp + 0x9c], eax
mov edx, dword [esp + 0x20]
lea ecx, [eax + edx]
mov dword [esp + 0x98], eax
mov dword [esp + 0x88], ecx
jmp 0x1004d3f7
mov eax, dword [esp + 0x9c]
lea edx, [esp + 0xa0]
cmp edi, edx
je 0x1004d411
push esi
mov ecx, edx
push ecx
push eax
call fcn.10102690
add esp, 0xc
add eax, esi
mov dword [esp + 0x98], eax
mov byte [eax], 0
mov byte [esp + 0x10c], 4
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
je 0x1004d45f
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov byte [esp + 0x10c], 5
test eax, eax
je 0x1004d450
lea edx, [esp + 0x88]
push edx
mov ecx, eax
call fcn.1000cef0
mov byte [esp + 0x10c], 4
add dword [esp + 0x18], 0x18
jmp 0x1004d47a
push 1
push 1
lea ecx, [esp + 0x5f]
push ecx
lea edx, [esp + 0x94]
push edx
push eax
lea ecx, [esp + 0x28]
call fcn.1004cdc0
mov byte [esp + 0x10c], 1
lea ecx, [esp + 0x88]
call fcn.10006e20
test eax, eax
cmp dword [esp + 0x68], 0
jne 0x1004d2c1
mov ebp, ebp
mov edx, edx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
test eax, 0xb8e
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x14]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ebp, edx
shr ebp, 0x1f
add ebp, edx
mov dword [esp + 0x70], ebp
test eax, eax
mov ebp, ebp
mov ebx, dword [esp + 0x44]
cmp ebp, ebx
jae 0x1004d4e2
mov ebx, ebp
mov dword [esp + 0x5c], ebp
push edx
pop edx
jmp 0x1004d4e8
mov dword [esp + 0x5c], ebx
push ebx
pop ebx
cmp ebx, 0x40
jl 0x1004d4fb
mov ebx, 0x40
mov dword [esp + 0x5c], ebx
test eax, 0x1e5d
lea edi, [ebx*4]
push edi
call fcn.1010136f
add esp, 4
mov dword [esp + 0x28], eax
mov eax, eax
test eax, eax
je 0x1004d09c
lea esi, [ebx + ebx*8]
add esi, esi
add esi, esi
push esi
call fcn.1010136f
add esp, 4
mov dword [esp + 0x58], eax
mov edx, edx
test eax, eax
jne 0x1004d547
mov ecx, dword [esp + 0x28]
push ecx
call fcn.10101432
add esp, 4
mov eax, eax
jmp 0x1004d09c
mov edx, dword [esp + 0x28]
push edi
push 0
push edx
call fcn.10102a00
add esp, 0xc
test bh, bh
mov eax, dword [esp + 0x58]
push esi
push 0
push eax
call fcn.10102a00
add esp, 0xc
test eax, eax
xor edi, edi
test esi, esi
mov eax, ebp
xor edx, edx
div ebx
mov dword [esp + 0x74], eax
mov dl, dl
mov eax, dword [esp + 0x134]
xor edx, edx
div ebx
mov dword [esp + 0x68], eax
mov ah, ah
mov al, al
xor ebp, ebp
test ebx, ebx
jle 0x1004d72a
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x20], ecx
add esi, 0xc
mov al, al
mov edx, dword [esp + 0x74]
lea ebx, [edi + edx - 1]
mov eax, eax
mov eax, dword [esp + 0x5c]
add eax, 0xffffffff
cmp ebp, eax
jne 0x1004d5c7
mov ebx, dword [esp + 0x70]
add ebx, 0xffffffff
test dh, dh
mov eax, dword [esp + 0x78]
mov ecx, ebx
sub ecx, edi
push eax
add ecx, 1
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
lea edx, [esp + 0x94]
call fcn.1004baa0
add esp, 0xc
mov byte [esp + 0x10c], 6
mov bl, bl
mov eax, dword [esp + 0x7c]
lea edi, [esi - 0xc]
mov dword [edi], eax
test dl, dl
mov ecx, dword [esp + 0x11c]
mov dword [esi - 4], ecx
mov dh, dh
mov edx, dword [esp + 0x120]
mov dword [esi], edx
test al, al
mov eax, dword [esp + 0x124]
mov dword [esi + 4], eax
mov edx, edx
mov ecx, dword [esp + 0x128]
mov dword [esi + 8], ecx
test eax, eax
mov edx, dword [esp + 0x12c]
mov dword [esi + 0xc], edx
test eax, 0x3d52
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esp + 0x68]
mov dword [esi + 0x14], ecx
mov ebx, ebx
mov edx, dword [esp + 0x98]
sub edx, dword [esp + 0x9c]
add edx, 1
push edx
call fcn.1010136f
add esp, 4
mov dword [esi - 8], eax
mov ebp, ebp
mov eax, dword [esi - 8]
test eax, eax
je 0x1004d708
mov edx, dword [esp + 0x9c]
mov cl, byte [edx]
mov byte [eax], cl
add edx, 1
add eax, 1
test cl, cl
jne 0x1004d680
test edi, edi
call fcn.1003c870
mov dword [esp + 0x6c], eax
test ecx, ecx
nop
push 0
push 0
push edi
push 0x10049db0
push 0
push 0
call fcn.1010405f
add esp, 0x18
push ebx
pop ebx
mov edi, dword [esp + 0x28]
mov dword [edi + ebp*4], eax
test bh, bh
mov eax, dword [esp + 0x6c]
push eax
call fcn.1003c940
add esp, 4
test eax, 0x52cd
cmp dword [edi + ebp*4], 0
je 0x1004d70e
lea edi, [ebx + 1]
push eax
pop eax
mov byte [esp + 0x10c], 1
lea ecx, [esp + 0x88]
call fcn.10006e20
mov ecx, dword [esp + 0x68]
add dword [esp + 0x20], ecx
add ebp, 1
add esi, 0x24
cmp ebp, dword [esp + 0x5c]
jl 0x1004d5a7
jmp 0x1004d726
xor ebp, ebp
push edx
pop edx
jmp 0x1004d712
xor ebp, ebp
test dl, dl
mov byte [esp + 0x10c], 1
lea ecx, [esp + 0x88]
call fcn.10006e20
mov ebx, dword [esp + 0x5c]
mov esi, dword [esp + 0x64]
xor edi, edi
mov ebp, ebp
cmp ebp, ebx
jne 0x1004d7e8
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push 1
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForMultipleObjects]
mov edi, edi
cmp eax, 0xffffffff
je 0x1004d7e8
xor ebp, ebp
mov ecx, ecx
test ebx, ebx
jle 0x1004d7e1
mov ecx, dword [esp + 0x58]
lea eax, [edi + edi*8]
mov edx, dword [ecx + eax*4 + 0x1c]
cmp byte [edx], 0
lea eax, [ecx + eax*4 + 0x1c]
je 0x1004d7d1
test edi, edi
jle 0x1004d7bb
cmp byte [esi], 0
je 0x1004d789
mov byte [esi + ebp], 0x7c
mov ah, ah
add ebp, 1
mov ecx, ecx
mov edx, dword [eax]
mov eax, dword [esp + 0x64]
add eax, ebp
mov esi, eax
mov cl, byte [edx]
mov byte [esi], cl
add edx, 1
add esi, 1
test cl, cl
jne 0x1004d793
test bh, bh
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1004d7a6
sub eax, edx
add ebp, eax
mov al, al
mov esi, dword [esp + 0x64]
jmp 0x1004d7da
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1004d7c0
sub eax, edx
mov ebp, eax
mov ebp, ebp
jmp 0x1004d7da
test edi, edi
jne 0x1004d7da
mov byte [esi], 0
mov ecx, ecx
add edi, 1
cmp edi, ebx
jl 0x1004d761
mov edi, 1
test ah, ah
mov ebp, dword [esp + 0x28]
xor esi, esi
test ebx, ebx
jle 0x1004d825
mov eax, dword [ebp + esi*4]
test eax, eax
je 0x1004d81e
push eax
call fcn.100628e0
add esp, 4
mov ah, ah
mov ecx, dword [ebp + esi*4]
push ecx
call fcn.100b5f10
add esp, 4
mov ebx, ebx
mov dword [ebp + esi*4], 0
mov ah, ah
add esi, 1
cmp esi, ebx
jl 0x1004d7f2
push ebp
call fcn.10101432
add esp, 4
push edx
pop edx
test ebx, ebx
jle 0x1004d859
mov esi, dword [esp + 0x58]
add esi, 4
jmp 0x1004d840
mov eax, dword [esi]
test eax, eax
je 0x1004d851
push eax
call fcn.10101432
add esp, 4
mov esi, esi
add esi, 0x24
sub ebx, 1
jne 0x1004d840
mov edx, dword [esp + 0x58]
push edx
call fcn.10101432
add esp, 4
mov edx, edx
mov dword [esp + 0x10c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1004cac0
mov eax, edi
jmp 0x1004d0b2
push 0x101651d8
call fcn.100f34a0