Function at 0x402500
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
sub esp, 0x24
jmp 0x402513
mov eax, dword [esp + 0x28]
cmp word [eax], 0x5a4d
je 0x40252f
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add esp, 0x24
ret
push edi
mov edi, dword [eax + 0x3c]
add edi, eax
cmp dword [edi], 0x4550
jne 0x40254b
cmp word [edi + 4], 0x14c
jne 0x40254b
test byte [edi + 0x38], 1
je 0x40255d
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_SetLastError
xor eax, eax
pop edi
add esp, 0x24
ret
push ebx
push ebp
jb 0x40257e
jae 0x40257e
mov ah, 0x83
xchg edi, eax
inc edi
push ds
sar byte [ebx*8 + 0x67c8340e], cl
and dl, byte [esi]
std
outsd dx, dword [esi]
push edi
fcmove st(0), st(4)
cmc
xor al, 0x35
and bh, bl
inc ebp
salc
add al, 0x8b
inc edi
push eax
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x3000
push eax
push ecx
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4025dc
jb 0x4025b7
jae 0x4025b7
add esi, ebx
mov ch, 0xed
inc eax
add esi, dword [ebp + 0x73]
pop ss
jbe 0x40254d
mov bl, 0x76
cmp bh, al
or eax, 0x8518c98c
fnstsw ax
fisttp qword [ebx + 0x46a5057]
mov edx, dword [edi + 0x50]
push 4
push 0x3000
push edx
push eax
call ebx
mov ebp, eax
test ebp, ebp
jne 0x4025dc
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
push esi
push 0x34
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x402613
push 0x8000
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
mov dword [esi + 4], ebp
movzx eax, word [edi + 0x16]
shr eax, 0xd
lea ecx, [esp + 0x10]
and eax, 1
push ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], 0x4024c0
mov dword [esi + 0x20], 0x4024d0
mov dword [esi + 0x24], 0x4024f0
mov dword [esi + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [esp + 0x14]
mov dword [esi + 0x30], edx
jne 0x402667
je 0x402667
cli
xor ecx, dword [esp]
push 0xa090a8aa
mov byte [ecx + ebp - 0x32], 0x96
add eax, 0x8bf7d890
inc edi
push esp
mov eax, dword [edi + 0x54]
push 4
push 0x1000
push eax
push ebp
call ebx
mov ecx, dword [edi + 0x54]
mov edx, dword [esp + 0x38]
push ecx
mov ebx, eax
push edx
push ebx
call fcn.00423740
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x3c]
push esi
add ebx, ecx
push edi
mov dword [esi], ebx
push eax
mov dword [ebx + 0x34], ebp
call fcn.00401e00
add esp, 0x18
test eax, eax
je 0x402758
jnp 0x4026ba
jp 0x4026ba
aas
pop esi
imul eax, dword [eax + esi], 0xc58ba720
mov eax, ebp
sub eax, dword [edi + 0x34]
je 0x4026d1
push eax
mov eax, esi
call fcn.00402210
add esp, 4
mov dword [esi + 0x18], eax
jmp 0x4026d8
mov dword [esi + 0x18], 1
call fcn.004022c0
test eax, eax
je 0x402758
push esi
call fcn.00401fe0
add esp, 4
test eax, eax
je 0x402758
jns 0x402709
js 0x402709
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
mov edx, 0xcdd9ab2e
sub dword [ecx + 0x2c], ebx
sti
imul esi, dword [edi + 0x6e], 0xffffffa5
pop ebx
sbb dword [esi + 0x2e], ebp
push eax
adc byte [edx - 0x4f173975], bh
cli
invalid
mov eax, esi
call int.004021c0
test eax, eax
je 0x402758
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x4027a5
add eax, ebp
cmp dword [esi + 0x14], 0
je 0x402798
jmp 0x402742
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x402787
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jns 0x402778
js 0x402778
xor eax, 0x9c14a21b
cdq
push ecx
into
pop eax
out 0x2d, al
insd dword es:[edi], dx
add al, byte [edx]
jp 0x40270b
mov ecx, 0x308ed440
inc edi
mov esp, 0x5ce1bf25
call fcn.004028e0
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x24
ret
mov dword [esi + 0x10], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret
mov dword [esi + 0x2c], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret
mov dword [esi + 0x2c], 0
mov eax, esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x24
ret