Function at 0x1003b8f0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0x11c
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x118], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x124]
push 0x9c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x38]
push eax
call fcn.100f8db0
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x1003b979
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100f30a6
add esp, 0x11c
ret 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push str.GetNativeSystemInfo
push str.kernel32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
test eax, eax
je 0x1003b9a3
lea edx, [esp + 0x10]
push edx
call eax
jmp 0x1003b9ae
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x48], 2
jne 0x1003c50a
mov eax, dword [esp + 0x3c]
cmp eax, 4
jbe 0x1003c50a
mov ecx, dword [str.Microsoft]
mov dword [ebp], ecx
mov edx, dword [0x101421cc]
mov dword [ebp + 4], edx
mov cx, word [0x101421d0]
mov word [ebp + 8], cx
mov dl, byte [0x101421d2]
mov byte [ebp + 0xa], dl
cmp eax, 6
jne case.0x1003bb91.5
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x1003ba92
mov eax, ebp
dec eax
cmp byte [esp + 0xd2], 1
jne 0x1003ba50
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003ba10
mov ecx, dword [str.Windows_Vista]
mov dword [eax], ecx
mov edx, dword [0x101421d8]
mov dword [eax + 4], edx
mov ecx, dword [0x101421dc]
mov dword [eax + 8], ecx
mov dx, word [0x101421e0]
mov word [eax + 0xc], dx
mov cl, byte [0x101421e2]
mov byte [eax + 0xe], cl
jmp 0x1003bb5f
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003ba50
mov edx, dword [str.Windows_Server_2008]
mov dword [eax], edx
mov ecx, dword [0x101421e8]
mov dword [eax + 4], ecx
mov edx, dword [0x101421ec]
mov dword [eax + 8], edx
mov ecx, dword [0x101421f0]
mov dword [eax + 0xc], ecx
mov edx, dword [0x101421f4]
mov dword [eax + 0x10], edx
mov cl, byte [0x101421f8]
mov byte [eax + 0x14], cl
jmp 0x1003bb5f
cmp eax, 1
je 0x1003baa0
cmp eax, 2
jne 0x1003bb5f
cmp byte [esp + 0xd2], 1
jne 0x1003bb1f
cmp eax, 1
jne 0x1003bae1
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bab2
mov edx, dword [str.Windows_7]
mov dword [eax], edx
mov ecx, dword [0x10142200]
mov dword [eax + 4], ecx
mov dx, word [0x10142204]
mov word [eax + 8], dx
mov cl, byte [0x10142206]
mov byte [eax + 0xa], cl
jmp 0x1003bb5f
cmp eax, 2
jne 0x1003bb1f
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003baf0
mov edx, dword [str.Windows_8]
mov dword [eax], edx
mov ecx, dword [0x1014220c]
mov dword [eax + 4], ecx
mov dx, word [0x10142210]
mov word [eax + 8], dx
mov cl, byte [0x10142212]
mov byte [eax + 0xa], cl
jmp 0x1003bb5f
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bb22
mov edx, dword [str.Windows_Server_2008_R2]
mov dword [eax], edx
mov ecx, dword [0x10142218]
mov dword [eax + 4], ecx
mov edx, dword [0x1014221c]
mov dword [eax + 8], edx
mov ecx, dword [0x10142220]
mov dword [eax + 0xc], ecx
mov edx, dword [0x10142224]
mov dword [eax + 0x10], edx
mov ecx, dword [0x10142228]
mov dword [eax + 0x14], ecx
push str.GetProductInfo
push str.kernel32.dll
call esi
push eax
call edi
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x40]
push 0
push 0
push ecx
push edx
call eax
mov eax, dword [esp + 0xc]
dec eax
cmp eax, 0x18
ja case.0x1003bb91.5
jmp dword [eax*4 + 0x1003c528]
mov eax, ebp
dec eax
jmp 0x1003bba0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bba0
mov ecx, dword [str.Ultimate_Edition]
mov dword [eax], ecx
mov edx, dword [0x10142240]
mov dword [eax + 4], edx
mov ecx, dword [0x10142244]
mov dword [eax + 8], ecx
mov edx, dword [0x10142248]
mov dword [eax + 0xc], edx
mov cl, byte [0x1014224c]
mov byte [eax + 0x10], cl
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bbe0
mov edx, dword [str.Home_Premium_Edition]
mov dword [eax], edx
mov ecx, dword [0x10142254]
mov dword [eax + 4], ecx
mov edx, dword [0x10142258]
mov dword [eax + 8], edx
mov ecx, dword [0x1014225c]
mov dword [eax + 0xc], ecx
mov edx, dword [0x10142260]
mov dword [eax + 0x10], edx
mov cl, byte [0x10142264]
mov byte [eax + 0x14], cl
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bc25
mov edx, dword [str.Home_Basic_Edition]
mov dword [eax], edx
mov ecx, dword [0x1014226c]
mov dword [eax + 4], ecx
mov edx, dword [0x10142270]
mov dword [eax + 8], edx
mov ecx, dword [0x10142274]
mov dword [eax + 0xc], ecx
mov dx, word [0x10142278]
mov word [eax + 0x10], dx
mov cl, byte [0x1014227a]
jmp 0x1003bf3c
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bc70
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x10142280]
mov dword [eax + 4], ecx
mov edx, dword [0x10142284]
mov dword [eax + 8], edx
mov ecx, dword [0x10142288]
mov dword [eax + 0xc], ecx
mov dx, word [0x1014228c]
mov word [eax + 0x10], dx
mov cl, byte [0x1014228e]
jmp 0x1003bf3c
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bcb4
mov edx, dword [str.Business_Edition]
mov dword [eax], edx
mov ecx, dword [0x10142294]
mov dword [eax + 4], ecx
mov edx, dword [0x10142298]
mov dword [eax + 8], edx
mov ecx, dword [0x1014229c]
mov dword [eax + 0xc], ecx
mov dl, byte [0x101422a0]
mov byte [eax + 0x10], dl
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bcf0
mov ecx, dword [str.Starter_Edition]
mov dword [eax], ecx
mov edx, dword [0x101422a8]
mov dword [eax + 4], edx
mov ecx, dword [0x101422ac]
mov dword [eax + 8], ecx
mov edx, dword [0x101422b0]
mov dword [eax + 0xc], edx
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bd23
mov ecx, 5
mov esi, str.Cluster_Server_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bd42
mov ecx, dword [str.Datacenter_Edition]
mov dword [eax], ecx
mov edx, dword [0x101422d0]
mov dword [eax + 4], edx
mov ecx, dword [0x101422d4]
mov dword [eax + 8], ecx
mov edx, dword [0x101422d8]
mov dword [eax + 0xc], edx
mov cx, word [0x101422dc]
mov word [eax + 0x10], cx
mov dl, byte [0x101422de]
mov byte [eax + 0x12], dl
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bd90
mov ecx, 9
mov esi, str.Datacenter_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bdb0
mov ecx, dword [str.Enterprise_Edition]
mov dword [eax], ecx
mov edx, dword [0x10142280]
mov dword [eax + 4], edx
mov ecx, dword [0x10142284]
mov dword [eax + 8], ecx
mov edx, dword [0x10142288]
mov dword [eax + 0xc], edx
mov cx, word [0x1014228c]
mov word [eax + 0x10], cx
mov dl, byte [0x1014228e]
mov byte [eax + 0x12], dl
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bdf7
mov ecx, 9
mov esi, str.Enterprise_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003be16
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003be33
mov ecx, dword [str.Small_Business_Server]
mov dword [eax], ecx
mov edx, dword [0x10142364]
mov dword [eax + 4], edx
mov ecx, dword [0x10142368]
mov dword [eax + 8], ecx
mov edx, dword [0x1014236c]
mov dword [eax + 0xc], edx
mov ecx, dword [0x10142370]
mov dword [eax + 0x10], ecx
mov dx, word [0x10142374]
mov word [eax + 0x14], dx
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003be80
mov ecx, 9
mov esi, str.Small_Business_Server_Premium_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bea0
mov ecx, dword [str.Standard_Edition]
mov dword [eax], ecx
mov edx, dword [0x101423a4]
mov dword [eax + 4], edx
mov ecx, dword [0x101423a8]
mov dword [eax + 8], ecx
mov edx, dword [0x101423ac]
mov dword [eax + 0xc], edx
mov cl, byte [0x101423b0]
mov byte [eax + 0x10], cl
jmp case.0x1003bb91.5
mov edi, ebp
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bee0
mov ecx, 9
mov esi, str.Standard_Edition__core_installation_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp case.0x1003bb91.5
mov eax, ebp
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bf00
mov edx, dword [str.Web_Server_Edition]
mov dword [eax], edx
mov ecx, dword [0x101423e0]
mov dword [eax + 4], ecx
mov edx, dword [0x101423e4]
mov dword [eax + 8], edx
mov ecx, dword [0x101423e8]
mov dword [eax + 0xc], ecx
mov dx, word [0x101423ec]
mov word [eax + 0x10], dx
mov cl, byte [0x101423ee]
mov byte [eax + 0x12], cl
cmp dword [esp + 0x3c], 5
jne 0x1003c3f5
mov eax, dword [esp + 0x40]
push ebx
cmp eax, 2
jne 0x1003c2d0
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0xd4]
test eax, eax
je 0x1003bf8c
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bf72
mov ecx, 6
mov esi, str.Windows_Server_2003_R2_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003c01f
test ebx, 0x2000
je 0x1003bfad
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bf97
mov ecx, 7
mov esi, str.Windows_Storage_Server_2003
rep movsd dword es:[edi], dword [esi]
jmp 0x1003c01f
cmp byte [esp + 0xd6], 1
jne 0x1003bfd9
cmp dx, 9
jne 0x1003bfd9
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003bfc0
mov ecx, 9
mov esi, str.Windows_XP_Professional_x64_Edition
rep movsd dword es:[edi], dword [esi]
jmp 0x1003c258
mov eax, ebp
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003bfe0
mov ecx, dword [str.Windows_Server_2003_]
mov dword [eax], ecx
mov ecx, dword [0x10142450]
mov dword [eax + 4], ecx
mov ecx, dword [0x10142454]
mov dword [eax + 8], ecx
mov ecx, dword [0x10142458]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x1014245c]
mov dword [eax + 0x10], ecx
mov cx, word [0x10142460]
mov word [eax + 0x14], cx
cmp byte [esp + 0xd6], 1
je 0x1003c258
cmp dx, 6
jne 0x1003c080
test bl, bl
jns 0x1003c05a
mov edi, ebp
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c040
mov ecx, 0xb
mov esi, str.Datacenter_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003c258
test bl, 2
je 0x1003c258
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c066
mov ecx, 0xb
mov esi, str.Enterprise_Edition_for_Itanium_based_Systems
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003c258
cmp dx, 9
jne 0x1003c116
test bl, bl
jns 0x1003c0ad
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c091
mov ecx, 5
mov esi, str.Datacenter_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003c258
test bl, 2
je 0x1003c0d1
mov edi, ebp
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c0b5
mov ecx, 5
mov esi, str.Enterprise_x64_Edition
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x1003c258
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c0d4
mov edx, dword [str.Standard_x64_Edition]
mov dword [eax], edx
mov ecx, dword [0x101424c8]
mov dword [eax + 4], ecx
mov edx, dword [0x101424cc]
mov dword [eax + 8], edx
mov ecx, dword [0x101424d0]
mov dword [eax + 0xc], ecx
mov edx, dword [0x101424d4]
mov dword [eax + 0x10], edx
mov cl, byte [0x101424d8]
mov byte [eax + 0x14], cl
jmp 0x1003c258
mov eax, ebp
dec eax
test ebx, 0x4000
je 0x1003c163
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c121
mov edx, dword [str.Compute_Cluster_Edition]
mov dword [eax], edx
mov ecx, dword [0x101424e0]
mov dword [eax + 4], ecx
mov edx, dword [0x101424e4]
mov dword [eax + 8], edx
mov ecx, dword [0x101424e8]
mov dword [eax + 0xc], ecx
mov edx, dword [0x101424ec]
mov dword [eax + 0x10], edx
mov ecx, dword [0x101424f0]
mov dword [eax + 0x14], ecx
jmp 0x1003c258
test bl, bl
jns 0x1003c1ab
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c167
mov edx, dword [str.Datacenter_Edition]
mov dword [eax], edx
mov ecx, dword [0x101422d0]
mov dword [eax + 4], ecx
mov edx, dword [0x101422d4]
mov dword [eax + 8], edx
mov ecx, dword [0x101422d8]
mov dword [eax + 0xc], ecx
mov dx, word [0x101422dc]
mov word [eax + 0x10], dx
mov cl, byte [0x101422de]
mov byte [eax + 0x12], cl
jmp 0x1003c258
test bl, 2
je 0x1003c1f1
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c1b0
mov edx, dword [str.Enterprise_Edition]
mov dword [eax], edx
mov ecx, dword [0x10142280]
mov dword [eax + 4], ecx
mov edx, dword [0x10142284]
mov dword [eax + 8], edx
mov ecx, dword [0x10142288]
mov dword [eax + 0xc], ecx
mov dx, word [0x1014228c]
mov word [eax + 0x10], dx
mov cl, byte [0x1014228e]
mov byte [eax + 0x12], cl
jmp 0x1003c258
test ebx, 0x400
je 0x1003c224
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c200
mov edx, dword [str.Web_Edition]
mov dword [eax], edx
mov ecx, dword [0x101424f8]
mov dword [eax + 4], ecx
mov edx, dword [0x101424fc]
mov dword [eax + 8], edx
jmp 0x1003c258
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c224
mov ecx, dword [str.Standard_Edition]
mov dword [eax], ecx
mov edx, dword [0x101423a4]
mov dword [eax + 4], edx
mov ecx, dword [0x101423a8]
mov dword [eax + 8], ecx
mov edx, dword [0x101423ac]
mov dword [eax + 0xc], edx
mov cl, byte [0x101423b0]
mov byte [eax + 0x10], cl
cmp dword [esp + 0x40], 5
jne 0x1003c3f4
mov eax, dword [esp + 0x44]
cmp eax, 1
jne 0x1003c2ea
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c273
mov edx, dword [str.Windows_XP]
mov dword [eax], edx
mov ecx, dword [0x10142504]
mov dword [eax + 4], ecx
mov edx, dword [0x10142508]
mov dword [eax + 8], edx
mov eax, ebp
dec eax
test ebx, 0x200
je 0x1003c2e0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c2a0
mov ecx, dword [str.Home_Edition]
mov dword [eax], ecx
mov edx, dword [0x10142510]
mov dword [eax + 4], edx
mov ecx, dword [0x10142514]
mov dword [eax + 8], ecx
mov dl, byte [0x10142518]
mov byte [eax + 0xc], dl
jmp 0x1003c3f4
mov ebx, dword [esp + 0xd4]
jmp 0x1003c267
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c2e0
jmp 0x1003c338
test eax, eax
jne 0x1003c3f4
mov eax, ebp
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c2f5
mov ecx, dword [str.Windows_2000]
mov dword [eax], ecx
mov edx, dword [0x10142530]
mov dword [eax + 4], edx
mov ecx, dword [0x10142534]
mov dword [eax + 8], ecx
mov dx, word [0x10142538]
mov word [eax + 0xc], dx
mov eax, ebp
dec eax
cmp byte [esp + 0xd6], 1
jne 0x1003c360
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c330
mov ecx, dword [str.Professional]
mov dword [eax], ecx
mov edx, dword [0x10142520]
mov dword [eax + 4], edx
mov ecx, dword [0x10142524]
mov dword [eax + 8], ecx
mov dl, byte [0x10142528]
mov byte [eax + 0xc], dl
jmp 0x1003c3f4
test bl, bl
jns 0x1003c39c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c364
mov ecx, dword [str.Datacenter_Server]
mov dword [eax], ecx
mov edx, dword [0x10142540]
mov dword [eax + 4], edx
mov ecx, dword [0x10142544]
mov dword [eax + 8], ecx
mov edx, dword [0x10142548]
mov dword [eax + 0xc], edx
mov cx, word [0x1014254c]
mov word [eax + 0x10], cx
jmp 0x1003c3f4
test bl, 2
je 0x1003c3d0
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c3a1
mov edx, dword [str.Advanced_Server]
mov dword [eax], edx
mov ecx, dword [0x10142554]
mov dword [eax + 4], ecx
mov edx, dword [0x10142558]
mov dword [eax + 8], edx
mov ecx, dword [0x1014255c]
mov dword [eax + 0xc], ecx
jmp 0x1003c3f4
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c3d0
mov edx, dword [str.Server]
mov dword [eax], edx
mov cx, word [0x10142564]
mov word [eax + 4], cx
mov dl, byte [0x10142566]
mov byte [eax + 6], dl
pop ebx
lea eax, [esp + 0x4c]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003c400
sub eax, edx
je 0x1003c44b
mov edi, ebp
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1003c410
mov ax, word [0x1013e238]
mov word [edi], ax
lea eax, [esp + 0x4c]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003c427
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003c435
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x44]
push ecx
lea edx, [esp + 0xd8]
push str.__build__d_
push edx
call fcn.100f468d
lea eax, [esp + 0xe0]
add esp, 0xc
mov ecx, eax
mov edi, edi
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003c470
mov edi, ebp
sub eax, ecx
mov esi, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003c480
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [esp + 0x3c], 6
rep movsb byte es:[edi], byte [esi]
jb 0x1003c503
mov eax, dword [esp + 0x10]
cmp ax, 9
jne 0x1003c4d9
dec ebp
mov eax, ebp
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c4b0
mov ecx, dword [str.__64_bit]
mov dword [eax], ecx
mov edx, dword [0x10142578]
mov dword [eax + 4], edx
mov cl, byte [0x1014257c]
mov byte [eax + 8], cl
mov eax, 1
jmp 0x1003c50c
test ax, ax
jne 0x1003c503
dec ebp
mov eax, ebp
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1003c4e1
mov edx, dword [str.__32_bit]
mov dword [eax], edx
mov ecx, dword [0x10142584]
mov dword [eax + 4], ecx
mov dl, byte [0x10142588]
mov byte [eax + 8], dl
mov eax, 1
jmp 0x1003c50c
xor eax, eax
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.100f30a6
add esp, 0x11c
ret 4