Function at 0x10001c40
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Create thread
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push esi
push 0
call fcn.100075cb
add esp, 4
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x100457d6
call fcn.100029c0
push ecx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 8]
call fcn.10001420
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10001ca5
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001c9b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000212b
push ecx
push edx
call fcn.1001b390
add esp, 8
lea eax, [ebp - 8]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0xf
push eax
mov byte [ebp - 0x28], 0
call fcn.10006f9f
mov ecx, dword [ebp - 0xc]
add esp, 8
test ecx, ecx
je 0x10001cdf
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x10001cdf
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10001cf7
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x10001cf7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
lea ecx, [ebp - 0x130]
call fcn.10002580
push str.https:__www.google.com_search_q
lea ecx, [ebp - 0xa0]
call fcn.100029c0
push str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
lea ecx, [ebp - 0x88]
call fcn.100029c0
push str.C:_Users_username_Documents_file.txt
lea ecx, [ebp - 0x70]
call fcn.100029c0
push str._home_user_documents_file.txt
lea ecx, [ebp - 0x58]
call fcn.100029c0
push str._name_:_John___age_:30__city_:_New_York_
lea ecx, [ebp - 0x40]
call fcn.100029c0
push str._product_:_Apple_iPhone_13___price_:999__currency_:_USD_
lea ecx, [ebp - 0x28]
call fcn.100029c0
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0xb0], 2
jl 0x10001fe0
push 0x5f5e100
call fcn.100200fb
mov esi, eax
add esp, 4
test esi, esi
je 0x10001d9c
push 0x5f5e100
push 0
push esi
call fcn.1001cf30
add esp, 0xc
push esi
call fcn.1001fd73
add esp, 4
push 0x100457d8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword fs:[0x30]
mov eax, dword ds:[eax + 0xc]
movzx eax, byte ds:[eax + 2]
test eax, eax
je 0x10001dc5
int3
test al, al
jne 0x10001fe0
push 0
push 0
push 0
push 0x10001a60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], eax
test ecx, ecx
je 0x10001e47
test eax, eax
je 0x10001e41
push 0xbb8
push 0
lea eax, [ebp - 8]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 0x102
jne 0x10001e31
lea ecx, [ebp - 0x10]
call fcn.100019b0
lea ecx, [ebp - 0x10]
call fcn.100019b0
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 4]
jmp 0x10001e4c
push ecx
call esi
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001e4e
push eax
call esi
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xe0], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x10001e82
cmp dword [ebp - 0xd4], 0
ja 0x10001e82
cmp dword [ebp - 0xd8], 0x80000000
jb 0x10001fe0
call fcn.10001a90
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10001ec3
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001eb9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x10001ef7
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001eed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jb 0x10001f2b
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001f21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0x10
jb 0x10001f5f
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001f55
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x74]
cmp ecx, 0x10
jb 0x10001f96
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001f8c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x8c]
cmp ecx, 0x10
jb 0x10001fd0
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001fc6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
lea ecx, [ebp - 0x130]
call fcn.100024c0
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10002014
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000200a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0x10
jb 0x10002048
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000203e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jb 0x1000207c
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002072
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0x10
jb 0x100020b0
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100020a6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x74]
cmp ecx, 0x10
jb 0x100020e3
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100020d9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
mov ecx, dword [ebp - 0x8c]
cmp ecx, 0x10
jb 0x10002119
mov edx, dword [ebp - 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000210f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002130
push ecx
push edx
call fcn.1001b390
add esp, 8
lea ecx, [ebp - 0x130]
call fcn.100024c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.100200aa
call fcn.100200aa
int3