Function at 0x1000b614
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x10063229
call fcn.10062638
sub esp, 0x154
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], dl
mov dword [ebp - 0x20], edi
je 0x1000bc6a
test dl, dl
je 0x1000bc46
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x1000bc3e
lea eax, [ebp - 0x84]
xor ebx, ebx
push eax
push 0x1000
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.1000d591
mov dword [ebp - 4], ebx
mov edi, 0x11f00
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x60]
push dword [ebp - 0x60]
sar eax, 1
push eax
push edi
push 0x12c58
call fcn.10027dfb
pop ecx
pop ecx
call eax
push dword [ebp - 0x60]
lea ecx, [ebp - 0x9c]
call fcn.1000c9a7
push 0x11854
mov byte [ebp - 4], 1
call fcn.100438c2
pop ecx
movzx eax, ax
mov edx, 0x11ef
push 1
mov dword [ebp - 0x68], eax
mov ecx, 0x617a
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x68]
push eax
push 1
push 1
push 0x23cb
call fcn.1000aa56
lea eax, [ebp - 0x9c]
mov dl, 1
push eax
push 0x4575
push 1
push 0xe6f
push 0x61d2
push 0x41ee
push 0x521c
mov cl, dl
call fcn.1000b3f1
add esp, 0x34
lea eax, [ebp - 0x9c]
cmp dword [ebp - 0x88], 8
cmovae eax, dword [ebp - 0x9c]
push ebx
push eax
push edi
push 0x15460
call fcn.10027dfb
pop ecx
pop ecx
call eax
push dword [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x9c]
call fcn.1000d1c9
push ebx
push ecx
push esi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], ebx
push 0x7d92
push eax
call fcn.1000b53b
add esp, 0x14
mov al, bl
mov ecx, ebx
mov byte [ebp + 0xf], al
mov dword [ebp - 0x18], ecx
cmp ecx, 0x12c
jae 0x1000bc33
test al, al
jne 0x1000bc33
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xb4]
call fcn.10004d63
push 0x10
pop edx
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.100024c3
push 0x699b
push ecx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push eax
push ecx
push 0x31c6
push ecx
mov dl, 1
lea ecx, [ebp - 0xb4]
call fcn.1000b5b2
add esp, 0x18
mov dword [ebp - 0x2c], 0x56006b02
mov dword [ebp - 0x28], 0x27014b01
mov word [ebp - 0x24], 3
mov dword [ebp - 0x4c], ebx
push 0x78
pop eax
push 2
mov word [ebp - 0x7c], ax
pop esi
mov dword [ebp - 0x14], esi
cmp esi, 0xa
jae 0x1000b8f1
mov dword [ebp - 0x1c], 0x4f69
cmp dword [ebp - 0x1c], 0x52a3
jle 0x1000b870
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x40], 0x6b3
mov edi, dword [ebp - 0x50]
mov esi, ebx
mov eax, edi
lea ecx, [ebp - 0x148]
or eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b838
mov eax, dword [eax]
push eax
call fcn.1004a373
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x148]
call fcn.10005270
inc esi
cmp esi, 0xd3f
jl 0x1000b81c
mov edi, dword [ebp - 0x3c]
add dword [ebp - 0x50], edi
dec dword [ebp - 0x40]
jne 0x1000b817
inc edi
mov dword [ebp - 0x3c], edi
cmp edi, 0x39cf
jl 0x1000b80d
mov esi, dword [ebp - 0x14]
movzx eax, byte [ebp - 0x2c]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x1000b88f
movzx ecx, byte [ebp + esi - 0x2c]
dec esi
add esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0x4c], eax
jmp 0x1000b8e9
cmp dword [ebp - 0x1c], 0x4cd1
jge 0x1000b8a3
push str.fysp_vmxd_qbuyhiyq_xmj_rwvg
call fcn.1004a373
pop ecx
mov dword [ebp - 4], 3
mov eax, esi
sub eax, dword [ebp - 0x4c]
movzx edx, byte [ebp + esi - 0x2b]
push 1
movzx eax, byte [ebp + eax - 0x2e]
movzx eax, word [ebp + eax*2 - 0x80]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x2c]
push ecx
push 0x6dbc
mov word [ebp + eax*2 - 0x80], cx
lea eax, [ebp - 0x4c]
push eax
push 0x6849
call fcn.1000b53b
add esp, 0x14
add esi, 2
jmp 0x1000b7e6
xor eax, eax
mov dword [ebp - 0xd4], 7
mov word [ebp - 0x78], ax
lea ecx, [ebp - 0xe8]
mov word [ebp - 0xe8], ax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0xd8], ebx
call fcn.1000d22d
push ecx
push ecx
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0xb4]
call fcn.1000e01b
push ebx
push 1
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 3
call fcn.100053e2
xor eax, eax
lea edi, [ebp - 0x80]
cmp dword [ebp - 0xa0], 8
stosd dword es:[edi], eax
push ebx
push 0x80
push 2
stosd dword es:[edi], eax
push ebx
push ebx
push 0x40000000
stosw word es:[edi], ax
lea eax, [ebp - 0xb4]
cmovae eax, dword [ebp - 0xb4]
mov edi, 0x11f00
push eax
push edi
push 0x19dc4
call fcn.10027dfb
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1000b9ca
push ebx
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0x64]
mov eax, dword [ebp + 0x18]
push dword [eax]
push esi
push edi
push 0xe2f4
call fcn.10027dfb
pop ecx
pop ecx
call eax
push esi
test eax, eax
push edi
push 0x10450
setne bl
call fcn.10027dfb
pop ecx
pop ecx
call eax
test bl, bl
jne 0x1000b9f6
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.100053e2
push ebx
push 1
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.100053e2
mov ecx, dword [ebp - 0x18]
mov al, byte [ebp + 0xf]
inc ecx
jmp 0x1000b762
xor eax, eax
mov word [ebp - 0x54], 0xd100
push 0x22
pop esi
mov word [ebp - 0x42], ax
lea ecx, [ebp - 0xcc]
mov word [ebp - 0xcc], ax
xor ebx, ebx
lea eax, [ebp - 0x44]
mov word [ebp - 0x44], si
push eax
mov dword [ebp - 0xb8], 7
mov dword [ebp - 0xbc], ebx
call fcn.1000d22d
lea eax, [ebp - 0xcc]
mov byte [ebp - 4], 7
push eax
push ecx
push 0x596a
push ecx
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x44], ebx
push eax
push ecx
xor dl, dl
mov ecx, 0x44a1
call fcn.1000b5b2
add esp, 0x18
mov word [ebp - 0x74], si
mov dword [ebp - 0x38], 0xa801bf00
mov ecx, ebx
mov dword [ebp - 0x34], 0x73017103
mov word [ebp - 0x30], 0xf02
push 2
pop esi
cmp esi, 2
jne 0x1000ba83
push esi
pop ecx
jmp 0x1000baaa
movzx edx, byte [ebp + esi - 0x37]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x3a]
movzx eax, word [ebp + eax*2 - 0x74]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x38]
mov word [ebp + eax*2 - 0x74], cx
mov ecx, ebx
add esi, 2
cmp esi, 0xa
jb 0x1000ba7a
xor eax, eax
mov dword [ebp - 0xec], 7
mov word [ebp - 0x6c], ax
lea ecx, [ebp - 0x100]
mov word [ebp - 0x100], ax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0xf0], ebx
call fcn.1000d22d
push ecx
push ecx
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0xcc]
call fcn.1000e01b
push ebx
push 1
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 7
call fcn.100053e2
xor eax, eax
lea edi, [ebp - 0x74]
stosd dword es:[edi], eax
mov dl, 1
push ecx
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0xf]
push eax
push ecx
push 0xe6f
push ecx
mov ecx, 0xf61
call fcn.1000b57d
mov dword [ebp - 0x1c], 0x5775
add esp, 0x14
cmp dword [ebp - 0x1c], 0x5ab9
jle 0x1000bbb1
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x18], 0x50fe
mov dword [ebp + 0xc], eax
mov esi, ebx
cdq
lea ecx, [ebp - 0x130]
idiv esi
or edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000bb6e
mov eax, dword [eax]
push eax
call fcn.1004a373
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x130]
call fcn.10005270
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, 0x333d
jl 0x1000bb4f
mov esi, dword [ebp - 0x14]
add eax, esi
dec dword [ebp - 0x18]
mov dword [ebp + 0xc], eax
jne 0x1000bb4d
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x30e6
jl 0x1000bb41
inc edi
cmp edi, 0x181b
jl 0x1000bb3e
cmp dword [ebp - 0x1c], 0x53af
jge 0x1000bbc5
push str.laiy_lgh_kdvurqeay_jvhgvykyj_cexipnv_ltg_tmrflyrnc_kjoy_quiye
call fcn.1004a373
pop ecx
lea edx, [ebp - 0x9c]
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xcc]
call fcn.10009b39
mov ecx, dword [ebp - 0x20]
push ebx
push 1
mov dword [ecx], eax
lea ecx, [ebp - 0xcc]
call fcn.100053e2
push ebx
push 1
lea ecx, [ebp - 0x118]
call fcn.100053e2
push ebx
push 1
lea ecx, [ebp - 0xb4]
call fcn.100053e2
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.100053e2
lea ecx, [ebp - 0x60]
call fcn.1000d622
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x20]
mov dword [ecx], 2
jmp 0x1000bc0c
mov dword [edi], 1
jmp 0x1000bc22
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x1000bc22
xor ebx, ebx
push ebx
push 0x6e9
push 0xabb
push 0x1e3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1000bc22
mov dword [ebp - 0x1c], 0x5ef7
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x61d3
jle 0x1000bce2
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x18], 0x58e8
mov dword [ebp - 0x20], eax
mov ecx, eax
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
sar edi, cl
mov eax, ebx
mov ecx, 0x1007e2d8
and eax, edi
cdq
push edx
push eax
call fcn.10004c4e
inc ebx
cmp ebx, 0x304a
jl 0x1000bca0
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
add eax, esi
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x20], eax
pop ebx
jne 0x1000bc96
inc esi
cmp esi, 0x3d32
jl 0x1000bc8a
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1522
jl 0x1000bc88
cmp byte [ebp + 0x1c], 0
je 0x1000bd94
mov dword [ebp - 0x14], 0x7e33
cmp dword [ebp - 0x14], 0x80ea
jle 0x1000bd5c
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x18], 0x7480
mov dword [ebp - 0x20], ecx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x160]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000bd28
mov eax, dword [eax]
push eax
call fcn.1004a373
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x160]
call fcn.10005270
mov ecx, dword [ebp - 0x20]
add ecx, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
jne 0x1000bd0c
inc esi
cmp esi, 0x3d71
jl 0x1000bd00
inc edi
cmp edi, 0x4d7b
jl 0x1000bcfe
cmp dword [ebp - 0x14], 0x7cbc
jge 0x1000bd70
push str.nfg_vliui_ahstlpug_pkoivahv_zqpso
call fcn.1004a373
pop ecx
mov edx, dword [ebp + 0x2c]
mov dword [edx], ebx
cmp dword [edx], 1
jge 0x1000be45
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc dword [edx]
cmp dword [edx], 1
jl 0x1000bd81
jmp 0x1000be45
mov ebx, dword [ebp + 0x38]
xor edx, edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x30]
mov eax, dword [ebx]
mov eax, dword [esi]
mov eax, dword [ebx]
mov ecx, dword [esi]
mov eax, dword [ebx]
neg ecx
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x8e21
setg al
xor edx, edx
mov dword [esi], eax
mov eax, dword [esi]
mov esi, dword [ebp + 0x28]
mov eax, dword [esi]
mov eax, dword [ebx]
mov eax, dword [edi]
mov ecx, dword [esi]
mov eax, dword [edi]
neg ecx
cmp ecx, eax
mov eax, dword [ebx]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebx]
mov eax, dword [edi]
setne cl
imul edx, ecx
xor ecx, ecx
sub edx, eax
mov eax, dword [ebx]
cmp edx, eax
mov eax, dword [ebx]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setl cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebx]
cmp ecx, eax
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x24]
setg dl
sub ecx, edx
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp + 0x14]
setne dl
xor ecx, ecx
cmp edx, 0xaac0
setne cl
mov dword [eax], ecx
mov edx, dword [eax]
mov eax, dword [ebp + 0x34]
neg edx
mov dword [eax], edx
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x1c], 0x5d4f
jge 0x1000bc22
mov edx, str.agppkip_qyiibsw_feigqh_fwpl_cabufdoe_pndcqm_hyrlxfe_wehqqsl_qfehrmdj
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1000bc22