Function at 0x402500
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
sub esp, 0x24
jns 0x402513
js 0x402513
enter 0xfffffffffffff466, 0xffffffffffffffc5
aam 0x4f
pop eax
and byte [0x8b797f04], 0x44
and al, 0x28
mov eax, dword [esp + 0x28]
cmp word [eax], 0x5a4d
je 0x40252f
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x24
ret
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x40254b
cmp word [edi + 4], 0x14c
jne 0x40254b
test byte [edi + 0x38], 1
je 0x40255d
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
add esp, 0x24
ret
push ebx
push ebp
jnp 0x40257e
jp 0x40257e
mov edi, 0x8c87f884
adc eax, 0x2496be9f
das
sbb eax, 0x89b31c93
mov dword [0x478bdc33], eax
push eax
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push eax
push ecx
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4025dc
jne 0x4025b7
je 0x4025b7
arpl word [ebp + 0x4f6189ee], di
aad 0x42
sub dword [ebp - 0x45], ebx
mov eax, dword [0x2d37901d]
mov bh, 0x47
mov ebp, 0xcddc21dd
or byte [ebx + 0x46a5057], 0x68
add byte [eax], dh
add byte [eax], al
mov edx, dword [edi + 0x50]
push 4
push 0x3000
push edx
push eax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4025dc
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
push esi
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x402613
pop ds
push 0x8000
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
mov dword [esi + 4], ebp
movzx eax, word [edi + 0x16]
shr eax, 0xd
lea ecx, [esp + 0x10]
and eax, 1
push ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 0x4024c0
mov dword [esi + 0x20], 0x4024d0
mov dword [esi + 0x24], 0x4024f0
mov dword [esi + 0x28], 0
sbb al, 0xc0
and al, 0x40
add bh, al
inc esi
and al, dl
and al, 0x40
add bh, al
inc esi
and al, 0xf0
and al, 0x40
add bh, al
inc esi
sub byte [eax], al
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetNativeSystemInfo
add byte [eax], al
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x30], edx
jne 0x402667
je 0x402667
adc edi, edi
and bh, byte [ecx]
loop 0x40262a
aas
je 0x402613
add al, 0xcf
jbe 0x402640
aas
inc eax
add ebx, esp
jp 0x4025f3
mov eax, dword [edi + 0x54]
inc edi
push esp
push 4
push 0x1000
push eax
push ebp
call ebx
mov ecx, dword [edi + 0x54]
mov edx, dword [esp + 0x38]
push ecx
mov ebx, eax
push edx
push ebx
call fcn.00423740
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x3c]
push esi
add ebx, ecx
push edi
mov dword [esi], ebx
push eax
mov dword [ebx + 0x34], ebp
call fcn.00401e00
add esp, 0x18
test eax, eax
je 0x402758
je 0x4026ba
jne 0x4026ba
push ebx
xor ebp, ebp
fsubr qword [ecx]
movsd dword es:[edi], dword [esi]
sti
sub dword [ebp + 0x2bc58bfb], esp
inc edi
xor al, 0x74
adc byte [eax - 0x75], dl
invalid
mov eax, ebp
sub eax, dword [edi + 0x34]
je 0x4026d1
push eax
mov eax, esi
call fcn.00402210
add esp, 4
mov dword [esi + 0x18], eax
jmp 0x4026d8
mov dword [esi + 0x18], 1
call fcn.004022c0
test eax, eax
je 0x402758
push esi
call fcn.00401fe0
add esp, 4
test eax, eax
je 0x402758
jmp 0x402709
mov eax, esi
call fcn.004021c0
test eax, eax
je 0x402758
invalid
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x4027a5
add eax, ebp
cmp dword [esi + 0x14], 0
je 0x402798
jns 0x402742
js 0x402742
outsd dx, dword [esi]
and eax, 0xfbf91111
jae 0x4026b7
and dword [ecx + 0x48], edx
mov ecx, 0x70c4f293
xor al, 0xfe
adc dh, byte [ecx - 0x4b]
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x402787
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
js 0x402778
jns 0x402778
out dx, al
daa
aas
loop 0x40270e
or cl, cl
sti
ja 0x4027ed
jecxz 0x4027e0
or esp, dword [ecx]
sbb ebp, dword [ecx + 0x658cacff]
call fcn.004028e0
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret
mov dword [esi + 0x2c], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret
mov dword [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret
add byte [ebx], dh
rol byte [ebx + 0x56c308c4], 0xf
mov byte [eax], bl
add byte [eax], al
add byte [edi], cl
mov dword [edx], edx
add byte [eax], al
add byte [0xfe5cf95d], bh
imul esp, dword [ebx], 0xf43d9a39
sbb esi, dword [eax]
add eax, 0xdf92ac3a
mov esi, dword [eax]
mov eax, dword [esi + ecx + 0x18]
add esi, ecx
test eax, eax
je 0x4028ce
cmp dword [esi + 0x14], 0
je 0x4028ce
mov edx, dword [esp + 0x10]
push edi
mov edi, edx
shr edi, 0x10
jne 0x40283a
movzx eax, dx
mov edx, dword [esi + 0x10]
cmp eax, edx
jb 0x402876
sub eax, edx
jmp 0x402871
mov edi, dword [esi + 0x20]
push ebx
mov ebx, dword [esi + 0x24]
push ebp
add edi, ecx
add ebx, ecx
xor ebp, ebp
test eax, eax
mov dword [esp + 0x14], 0
ja 0x40288a
mov eax, dword [esp + 0x14]
je 0x402868
jne 0x402868
push ds
outsd dx, dword [esi]
sub ebx, esi
cmp dword [esp + 0x14], 0
pop ebp
pop ebx
je 0x402876
cmp eax, dword [esi + 0x14]
jbe 0x4028bd
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x1c]
mov eax, dword [edi]
add eax, ecx
push eax
push edx
call fcn.0041ea7b
mov ecx, dword [esp + 0x18]
add esp, 8
test eax, eax
je 0x4028b0
add ebp, 1
add edi, 4
add ebx, 2
cmp ebp, dword [esi + 0x18]
jb 0x402886
jmp 0x402854
movzx eax, word [ebx]
mov dword [esp + 0x14], 1
jmp 0x402858
mov edx, dword [esi + 0x1c]
lea eax, [edx + eax*4]
mov eax, dword [eax + ecx]
pop edi
add eax, ecx
pop esi
add esp, 8
ret
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
add esp, 8
ret