Function at 0x3004251e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x300c1bc0], esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], esi
jne 0x300427bc
mov edx, dword [0x300bfc58]
test byte [edx + 0x38], 0x20
je 0x3004257e
push esi
push esi
push esi
push 0x30005638
push eax
push dword [ebp + 0xc]
push ecx
call fcn.30041d28
jmp 0x30042c77
push 0x14
call fcn.30042ff1
cmp eax, esi
je 0x30042594
mov ecx, eax
call fcn.30043d48
mov ebx, eax
jmp 0x30042596
xor ebx, ebx
cmp ebx, esi
je 0x300427bc
push esi
push 0x14
push 0x14
push ebx
call fcn.30059303
test eax, eax
je 0x300427bc
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x300bfc58]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 4], eax
jmp 0x3004266b
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x78]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 4]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp - 0x14], eax
je 0x30042610
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 4], eax
jmp 0x30042657
cmp dword [ebp - 0x68], 0x1000
jne 0x30042657
cmp dword [ebp - 0x64], 4
je 0x30042625
cmp dword [ebp - 0x64], 0x40
jne 0x30042657
cmp dword [ebp - 0x60], 0x20000
jne 0x30042657
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0xffffffff
jae 0x30042657
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x78]
cdq
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x28], edx
call fcn.30040334
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6c]
ja 0x30042665
mov eax, dword [ebp - 0x6c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x98]
jb 0x300425d7
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push dword [0x300c0124]
call fcn.30070a17
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x300427bc
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x3004281f
mov dword [ebp - 0x1c], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x3004280b
and dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
lea esi, [eax + ecx]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x34], edi
mov edi, dword [edx + 4]
cmp eax, edi
ja 0x30042704
jb 0x300426e0
cmp ecx, dword [ebp - 0x34]
ja 0x30042704
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edi, edi
add ecx, dword [eax]
adc edi, dword [eax + 4]
mov dword [ebp - 0x7c], edi
mov edi, dword [edx + 4]
cmp edi, dword [ebp - 0x7c]
jb 0x30042737
ja 0x30042704
cmp dword [ebp - 0x34], ecx
jb 0x30042737
cmp edi, dword [esi + 4]
ja 0x300427f6
jb 0x3004271a
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi]
ja 0x300427f6
mov eax, dword [edx + 8]
xor edx, edx
add eax, dword [ebp - 0x34]
adc edx, edi
cmp dword [esi + 4], edx
ja 0x300427f6
jb 0x30042737
cmp dword [esi], eax
jae 0x300427f6
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.300598fa
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042784
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x3004275f
cmp edx, dword [esi]
jae 0x3004278a
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30040334
test eax, eax
je 0x300427bc
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x300427fd
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.30040334
test eax, eax
jne 0x300427fd
mov esi, dword [ebp + 0x10]
push esi
call fcn.3003d0de
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x300427d4
push edi
call fcn.3003d11f
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x300427ef
push 1
mov ecx, ebx
call fcn.300444bd
xor eax, eax
jmp 0x30042c77
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x300426bc
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x1c], 0x6c
xor esi, esi
cmp ecx, dword [eax]
jb 0x300426a3
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x300429b5
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x30]
lea edi, [ecx + eax + 4]
lea ecx, [ebp - 0x14]
push ecx
push 4
mov dword [ebp - 0x14], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x5c]
push ecx
add eax, 0x3c
push eax
push dword [ebp - 0x38]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042993
cmp dword [ebp - 0x14], 4
jne 0x30042993
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
mov edi, dword [edi]
add edi, dword [ebp - 0x5c]
push 0xf8
lea eax, [ebp - 0x19c]
push eax
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042993
cmp dword [ebp - 0x14], 0xf8
jne 0x30042993
cmp dword [ebp - 0x19c], 0x4550
jne 0x30042993
cmp word [ebp - 0x196], si
jbe 0x30042993
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
cmp dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
jae 0x300428ef
cmp dword [ebp - 0x18], esi
je 0x300428d8
push dword [ebp - 0x18]
call fcn.3004304e
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], eax
call fcn.30042ff1
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x300429b5
push dword [ebp - 0x44]
mov dword [ebp - 0x14], esi
push esi
push dword [ebp - 0x18]
call sub.MSVCR80.dll_memset
movzx eax, word [ebp - 0x188]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x1c]
lea eax, [edi + eax + 0x18]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042993
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jne 0x30042993
cmp word [ebp - 0x196], si
mov dword [ebp - 0x10], esi
jbe 0x30042993
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jns 0x30042980
test eax, 0x40000000
je 0x30042980
test al, 0xc0
je 0x30042980
mov edx, dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30040334
add dword [ebp - 0xc], 0x28
movzx eax, word [ebp - 0x196]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x30042941
inc dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x6c
cmp ecx, dword [eax]
jb 0x3004282d
cmp dword [ebp - 0x18], esi
je 0x300429b5
push dword [ebp - 0x18]
call fcn.3004304e
push esi
lea eax, [ebp - 0x40]
push eax
push esi
push 5
push dword [0x300c0124]
call fcn.30070a17
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x300427bc
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042b22
mov dword [ebp - 0x30], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x30042b0e
and dword [ebp - 0xc], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + ecx]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp - 0x48], edx
ja 0x30042a2f
jb 0x30042a1b
cmp edx, ecx
ja 0x30042a2f
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30042a6a
ja 0x30042a2f
cmp dword [esi], eax
jb 0x30042a6a
cmp dword [esi + 4], edi
ja 0x30042af9
jb 0x30042a45
mov eax, dword [ebp - 0x48]
cmp dword [esi], eax
ja 0x30042af9
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30042af9
jb 0x30042a6a
cmp dword [ebp - 0x48], ecx
jae 0x30042af9
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.300598fa
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042abb
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x30042a92
cmp edx, dword [esi]
jae 0x30042ac1
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30040334
test eax, eax
je 0x300427bc
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30042b00
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.30040334
test eax, eax
je 0x300427bc
jmp 0x30042b00
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x300429fa
mov eax, dword [ebp - 0x40]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x10
xor esi, esi
cmp ecx, dword [eax]
jb 0x300429e1
mov eax, dword [ebx]
cmp eax, esi
jle 0x300427bc
mov edi, eax
shl edi, 4
add edi, 4
xor edx, edx
cmp eax, esi
jle 0x30042b52
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
inc edx
add ecx, 0x10
cmp edx, dword [ebx]
jl 0x30042b3f
call fcn.30041a12
test eax, eax
je 0x300427bc
push esi
push 0xc0000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x30005638
push 0x300c0568
push dword [ebp + 0x10]
call fcn.3003d1a7
test eax, eax
je 0x300427bc
mov eax, dword [ebp + 0x10]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
je 0x300427bc
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
je 0x300427bc
mov dword [ecx + 0xc], edi
mov edi, eax
mov eax, dword [ebx]
mov dword [edi], eax
add edi, 4
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042c05
mov eax, dword [ebx + 8]
and eax, 0xffff
mov dword [ebp + 0xc], esi
push eax
mov eax, dword [ebx + 0xc]
add eax, dword [ebp + 0xc]
push eax
push edi
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebx + 8]
add dword [ebp + 0xc], 0x10
and eax, 0xffff
add esp, 0xc
add edi, eax
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebx]
jl 0x30042bdc
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042c6b
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 0xc]
add eax, ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [eax + 8]
push edi
push dword [eax]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042c46
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
cmp ecx, dword [edx + eax + 8]
jne 0x300427bc
jmp 0x30042c53
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 0xc], esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, dword [eax + ecx + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp + 0xc], 0x10
cmp eax, dword [ebx]
jl 0x30042c0f
push 1
mov ecx, ebx
call fcn.300444bd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc