Function at 0x30004b50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
cmp dword [0x3027289c], 0xa
push ebx
push esi
push edi
mov ebx, ecx
jb 0x30004b7d
push 0xa
push ebx
push str.DumpRegion:_Dump_at_0x_p_skipped_due_to_dump_limit__d
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test ebx, ebx
jne 0x30004b8b
xor esi, esi
jmp 0x30004bcb
cmp dword [0x302728a4], 0
jne 0x30004bb5
push 0x302728a0
call edi
cmp dword [0x302728a4], 0
jne 0x30004bb5
push str.GetAllocationBase:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor esi, esi
jmp 0x30004bcb
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [ebp - 0x20]
mov ecx, ebx
call fcn.30002520
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x30004be0
xor edi, edi
jmp 0x30004c74
cmp dword [0x302728a4], 0
jne 0x30004c0a
push 0x302728a0
call edi
cmp dword [0x302728a4], 0
jne 0x30004c0a
push str.GetBaseAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor edi, edi
jmp 0x30004c20
push 0x1c
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edi, eax
neg edi
sbb edi, edi
and edi, dword [ebp - 0x40]
cmp dword [0x302728a4], 0
jne 0x30004c4e
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x302728a4], 0
jne 0x30004c4e
push str.GetRegionSize:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor ebx, ebx
jmp 0x30004c74
push 0x1c
lea eax, [ebp - 0x5c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x30004c71
push ebx
push str.GetRegionSize:_unable_to_query_memory_address_0x_p
call fcn.30009b20
add esp, 8
xor ebx, ebx
jmp 0x30004c74
mov ebx, dword [ebp - 0x50]
mov edx, dword [0x302728d0]
mov ecx, dword [edx + 0x24]
mov dword [edx + 0x1c], esi
test ecx, ecx
je 0x30004c9c
lea eax, [ecx + 1]
mov dword [ebp - 8], eax
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30004c90
sub ecx, dword [ebp - 8]
jne 0x30004caf
mov eax, dword [edx + 0x10]
test eax, eax
je 0x30004ca8
cmp eax, 9
jne 0x30004caf
mov dword [edx + 0x10], 8
mov edx, dword [ebp - 4]
mov ecx, esi
call fcn.300046f0
test eax, eax
je 0x30004ce5
mov ecx, esi
call fcn.30003f40
test eax, eax
jle 0x30004ce5
push dword [ebp - 4]
push esi
push str.DumpRegion:_Dumped_PE_image_s__from_base_address_0x_p__size__d_bytes._n
call fcn.30009b00
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x302728d0]
cmp dword [eax + 0x10], 8
jne 0x30004cf7
mov dword [eax + 0x10], 9
mov edx, dword [ebp - 4]
mov ecx, esi
call fcn.30004ae0
test eax, eax
je 0x30004d3a
cmp esi, dword fs:[8]
jae 0x30004d1c
mov eax, str.DumpRegion:_Dumped_stack_region_from_0x_p__size__d_bytes._n
cmp esi, dword fs:[4]
ja 0x30004d21
mov eax, str.DumpRegion:_Dumped_entire_allocation_from_0x_p__size__d_bytes._n
push dword [ebp - 4]
push esi
push eax
call fcn.30009b00
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x302728d0]
mov edx, ebx
mov ecx, edi
mov dword [eax + 0x1c], edi
call fcn.30004ae0
test eax, eax
je 0x30004d88
cmp edi, dword fs:[8]
jae 0x30004d66
mov eax, str.DumpRegion:_Dumped_stack_region_from_0x_p__size__d_bytes._n
cmp edi, dword fs:[4]
ja 0x30004d6b
mov eax, str.DumpRegion:_Dumped_region_at_0x_p__size__d_bytes._n
push ebx
push edi
push eax
call fcn.30009b00
add esp, 0xc
mov eax, 1
inc dword [0x3027289c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push edi
push str.DumpRegion:_Failed_to_dump_region_at_0x_p_size__d_bytes._n
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret