Function at 0x1003c971
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov al, byte [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x34]
and al, 1
push ebp
mov ebp, dword [esp + 0x3c]
push esi
shr ebx, 1
mov byte [esp + 0xf], al
push edi
mov edi, dword [esp + 0x50]
and bl, 1
jne 0x1003c9b8
test edi, edi
jne 0x1003c9b8
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x50], 1
lea eax, [eax*4 - 0x27]
cmp ebp, eax
jb 0x1003c9bd
mov byte [esp + 0x50], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x1003c9da
push 1
call sym.CoreFoundation.dll__CFGetTSD
pop ecx
mov ecx, dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
test eax, eax
cmove eax, ecx
jmp 0x1003c9e0
mov ecx, dword [sym.CoreFoundation.dll_kCFAllocatorSystemDefault]
cmp eax, ecx
je 0x1003c9f9
cmp eax, dword [sym.CoreFoundation.dll_kCFAllocatorMalloc]
je 0x1003c9f9
mov byte [esp + 0x3c], 8
cmp eax, dword [sym.CoreFoundation.dll_kCFAllocatorMallocZone]
jne 0x1003c9fe
mov byte [esp + 0x3c], 0
cmp byte [esp + 0x50], 0
push 0x10
pop ecx
je 0x1003ca0b
lea ecx, [ebp + 0x1f]
push 0
push ecx
push dword [0x10186cec]
push eax
call sym.CoreFoundation.dll__CFRuntimeCreateInstance
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x1003ca2a
xor eax, eax
jmp 0x1003cb53
and dword [esi + 8], 0
mov cl, byte [esi + 4]
mov al, byte [esp + 0x50]
and cl, 0xc0
shl al, 2
or cl, al
mov al, byte [esp + 0x13]
or cl, byte [esp + 0x3c]
mov byte [esi + 4], cl
test al, al
je 0x1003ca5d
test bl, bl
je 0x1003ca5d
mov dword [esi + 0xc], 0x10
or byte [esi + 4], 3
jmp 0x1003ca6d
mov al, cl
mov dword [esi + 0xc], ebp
and al, 0xfd
or al, 1
mov byte [esi + 4], al
mov al, byte [esp + 0x13]
test edi, edi
je 0x1003ca8e
mov eax, dword [esp + 0x48]
push edi
mov dword [esi + 0x14], eax
call sym.CoreFoundation.dll_CFRetain
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x50]
pop ecx
mov dword [esi + 8], eax
jmp 0x1003cb45
test al, al
je 0x1003caa6
test bl, bl
jne 0x1003caa6
push 6
call sym.CoreFoundation.dll__CFExecutableLinkedOnOrAfter
pop ecx
test al, al
jne 0x1003caa6
inc bl
jmp 0x1003caa8
xor bl, bl
cmp byte [esp + 0x50], 0
mov byte [esp + 0x3c], bl
jne 0x1003caee
push dword [esp + 0x3c]
push dword [esi + 0xc]
push esi
call fcn.1003c5d9
add esp, 0xc
mov dword [esi + 0x14], eax
cmp byte [sym.CoreFoundation.dll___CFOASafe], 0
je 0x1003cadc
push str.CFData__store_
push eax
call sym.CoreFoundation.dll___CFSetLastAllocationEventName
pop ecx
pop ecx
cmp dword [esi + 0x14], 0
jne 0x1003cb1c
push esi
call sym.CoreFoundation.dll_CFRelease
pop ecx
jmp 0x1003ca23
cmp dword [esp + 0x4c], 0
jne 0x1003cb1a
cmp byte [esp + 0x13], 0
jne 0x1003cb1a
and dword [esi + 0x14], 0
and byte [esi + 4], 0xfb
cmp byte [0x101755bf], 0
jne 0x1003cb1a
lea eax, [esi + 0x27]
and eax, 0xfffffff0
mov dword [esi + 0x14], eax
or byte [esi + 4], 4
mov bl, 1
push dword [esp + 0x4c]
mov al, byte [esi + 4]
xor bl, 1
push dword [esp + 0x4c]
and al, 0xbf
shl bl, 6
push 0
or bl, al
push 0
mov byte [esi + 4], bl
and dword [esi + 0x10], 0
push esi
call sym.CoreFoundation.dll_CFDataReplaceBytes
add esp, 0x14
mov al, byte [esi + 4]
xor al, byte [esp + 0x40]
and al, 3
xor byte [esi + 4], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret