Function at 0x1002f980
Capabilities:
Get memory capacity
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8d0
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x550], 0
push 0x7f
push 0
lea eax, [ebp - 0x54f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0xd0], 0
push 0x7f
push 0
lea ecx, [ebp - 0xcf]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x558], 0
xor edx, edx
mov dword [ebp - 0x557], edx
mov word [ebp - 0x553], dx
mov byte [ebp - 0x551], dl
mov byte [ebp - 0x660], 0
push 0xff
push 0
lea eax, [ebp - 0x65f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x6d0], 0
xor ecx, ecx
mov dword [ebp - 0x6cf], ecx
mov dword [ebp - 0x6cb], ecx
mov dword [ebp - 0x6c7], ecx
mov dword [ebp - 0x6c3], ecx
mov dword [ebp - 0x6bf], ecx
mov dword [ebp - 0x6bb], ecx
mov dword [ebp - 0x6b7], ecx
mov word [ebp - 0x6b3], cx
mov byte [ebp - 0x6b1], cl
mov byte [ebp - 0x40c], 0
xor edx, edx
mov word [ebp - 0x40b], dx
mov byte [ebp - 0x409], dl
mov byte [ebp - 0x50], 0
push 0x3f
push 0
lea eax, [ebp - 0x4f]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x318], 0
push 0x3f
push 0
lea ecx, [ebp - 0x317]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x450], 0
push 0x3f
push 0
lea edx, [ebp - 0x44f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x2d8], 0
push 0x1ff
push 0
lea eax, [ebp - 0x2d7]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x4d0], 0
push 0x7f
push 0
lea ecx, [ebp - 0x4cf]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x8d0], 0
push 0x1ff
push 0
lea edx, [ebp - 0x8cf]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov byte [ebp - 0x408], 0
push 0x3f
push 0
lea eax, [ebp - 0x407]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x3c4], 0
mov dword [ebp - 0xc], 0
push 0x200
lea ecx, [ebp - 0x2d8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [ebp - 0x320], 0
lea edx, [ebp - 0x320]
push edx
push 0x101
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002fb7b
jmp 0x10030303
mov dword [ebp - 0x55c], 0
mov dword [ebp - 0x31c], 0x80
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x550]
push ecx
lea edx, [ebp - 0x55c]
push edx
push 0
push str.ProductName
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 0x80
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0xd0]
push edx
lea eax, [ebp - 0x55c]
push eax
push 0
push str.CSDVersion
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 4
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x3c8]
push eax
lea ecx, [ebp - 0x55c]
push ecx
push 0
push str.CurrentMajorVersionNumber
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002fc55
mov dword [ebp - 0x31c], 4
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0xd4]
push ecx
lea edx, [ebp - 0x55c]
push edx
push 0
push str.CurrentMinorVersionNumber
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 4
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x55c]
push eax
push 0
push 0x1003fb3c
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 0x40
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x55c]
push ecx
push 0
push str.CurrentBuildNumber
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 0x80
lea eax, [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x4d0]
push ecx
lea edx, [ebp - 0x55c]
push edx
push 0
push str.BuildLabEx
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x3c0], 0x94
lea ecx, [ebp - 0x3c0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x3ac]
push edx
push 0x1003fb60
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
cmp dword [ebp - 0x3c8], 0
je 0x1002fd42
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x3bc], ecx
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0x3b8], edx
mov eax, dword [ebp - 0x3b0]
push eax
mov ecx, dword [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x3b8]
push edx
mov eax, dword [ebp - 0x3bc]
push eax
push str.___d._d._d._d_
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0x8d0]
push edx
lea eax, [ebp - 0x550]
push eax
call sub.ntdll.dll_strcat
add esp, 8
mov dword [ebp - 0x31c], pe_nt_image_headers32
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x660]
push edx
lea eax, [ebp - 0x55c]
push eax
push 0
push str.SystemRoot
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x320]
push eax
push 0x101
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002fdf5
jmp 0x10030303
mov dword [ebp - 0x31c], 0x20
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x55c]
push eax
push 0
push str.PROCESSOR_ARCHITECTURE
mov ecx, dword [ebp - 0x320]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x31c], 4
lea edx, [ebp - 0x31c]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x55c]
push ecx
push 0
push str.NUMBER_OF_PROCESSORS
mov edx, dword [ebp - 0x320]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x320]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x6b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [ebp - 0x6a4]
push edx
movzx eax, word [ebp - 0x6a6]
push eax
movzx ecx, word [ebp - 0x6a8]
push ecx
movzx edx, word [ebp - 0x6aa]
push edx
movzx eax, word [ebp - 0x6ae]
push eax
movzx ecx, word [ebp - 0x6b0]
push ecx
push str._d__d__d__d:_d:_d
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x20
mov dword [ebp - 0x6a0], 0x40
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0x400
mov ecx, dword [ebp - 0x694]
push ecx
mov edx, dword [ebp - 0x698]
push edx
call sub.ntdll.dll__aulldiv
push 0
push 0x400
push edx
push eax
call sub.ntdll.dll__aulldiv
push edx
push eax
push 0x1003fc04
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
push 0
push 0x400
mov ecx, dword [ebp - 0x68c]
push ecx
mov edx, dword [ebp - 0x690]
push edx
call sub.ntdll.dll__aulldiv
push 0
push 0x400
push edx
push eax
call sub.ntdll.dll__aulldiv
push edx
push eax
push 0x1003fc18
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
mov dword [ebp - 4], str._System_Information__r_n
push 0
lea ecx, [ebp - 0x324]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x2d8]
push edx
push str.Module_Path:__s_r_n
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x324]
push ecx
lea edx, [ebp - 0x8d0]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x8d0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [ebp - 0x550]
push edx
push str.Product_Name:__s_r_n
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea ecx, [ebp - 0x324]
push ecx
lea edx, [ebp - 0x8d0]
push edx
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea eax, [ebp - 0x8d0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x408]
push eax
push str.OS_Build_Name:__s._d_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x10
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0xd0]
push eax
push str.Service_Package:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x3c4]
push eax
mov ecx, dword [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x3b8]
push edx
mov eax, dword [ebp - 0x3bc]
push eax
push str.OS_Version:__d._d._d._d_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0x18
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x4d0]
push eax
push str.BuildLabEx:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x318]
push eax
push 0x1003fcfc
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x450]
push eax
push str._s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x660]
push eax
push str.System_Root:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x6d0]
push eax
push str.Processor_Architecture:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x40c]
push eax
push str.Processor_Number:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x50]
push eax
push str.Current_Time:__s_r_n
lea ecx, [ebp - 0x8d0]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0x324]
push edx
lea eax, [ebp - 0x8d0]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x8d0]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], str._r_n_r_n
push 0
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret