Function at 0x30042635
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x300cb85c], esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], esi
jne 0x300428cd
test byte [0x300bfc9c], 0x20
je 0x30042692
push esi
push esi
push esi
push 0x30005668
push eax
push dword [ebp + 0xc]
push ecx
call fcn.30041e31
jmp 0x30042d88
push 0x14
call fcn.30043102
cmp eax, esi
je 0x300426a8
mov ecx, eax
call fcn.30043e89
mov ebx, eax
jmp 0x300426aa
xor ebx, ebx
cmp ebx, esi
je 0x300428cd
push esi
push 0x14
push 0x14
push ebx
call fcn.30059433
test eax, eax
je 0x300428cd
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x300bfc8c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 4], eax
jmp 0x3004277c
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x78]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 4]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp - 0x14], eax
je 0x30042721
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 4], eax
jmp 0x30042768
cmp dword [ebp - 0x68], 0x1000
jne 0x30042768
cmp dword [ebp - 0x64], 4
je 0x30042736
cmp dword [ebp - 0x64], 0x40
jne 0x30042768
cmp dword [ebp - 0x60], 0x20000
jne 0x30042768
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0xffffffff
jae 0x30042768
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x78]
cdq
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x28], edx
call fcn.30025d49
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6c]
ja 0x30042776
mov eax, dword [ebp - 0x6c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x98]
jb 0x300426e8
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push dword [0x300c9dc0]
call fcn.30070b75
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x300428cd
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042930
mov dword [ebp - 0x1c], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x3004291c
and dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
lea esi, [eax + ecx]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x34], edi
mov edi, dword [edx + 4]
cmp eax, edi
ja 0x30042815
jb 0x300427f1
cmp ecx, dword [ebp - 0x34]
ja 0x30042815
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edi, edi
add ecx, dword [eax]
adc edi, dword [eax + 4]
mov dword [ebp - 0x7c], edi
mov edi, dword [edx + 4]
cmp edi, dword [ebp - 0x7c]
jb 0x30042848
ja 0x30042815
cmp dword [ebp - 0x34], ecx
jb 0x30042848
cmp edi, dword [esi + 4]
ja 0x30042907
jb 0x3004282b
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi]
ja 0x30042907
mov eax, dword [edx + 8]
xor edx, edx
add eax, dword [ebp - 0x34]
adc edx, edi
cmp dword [esi + 4], edx
ja 0x30042907
jb 0x30042848
cmp dword [esi], eax
jae 0x30042907
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30059a2a
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042895
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x30042870
cmp edx, dword [esi]
jae 0x3004289b
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30025d49
test eax, eax
je 0x300428cd
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x3004290e
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.30025d49
test eax, eax
jne 0x3004290e
mov esi, dword [ebp + 0x10]
push esi
call fcn.3003d20b
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x300428e5
push edi
call fcn.3003d24c
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x30042900
push 1
mov ecx, ebx
call fcn.30044033
xor eax, eax
jmp 0x30042d88
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x300427cd
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x1c], 0x6c
xor esi, esi
cmp ecx, dword [eax]
jb 0x300427b4
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042ac6
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x30]
lea edi, [ecx + eax + 4]
lea ecx, [ebp - 0x14]
push ecx
push 4
mov dword [ebp - 0x14], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x5c]
push ecx
add eax, 0x3c
push eax
push dword [ebp - 0x38]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042aa4
cmp dword [ebp - 0x14], 4
jne 0x30042aa4
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
mov edi, dword [edi]
add edi, dword [ebp - 0x5c]
push 0xf8
lea eax, [ebp - 0x19c]
push eax
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042aa4
cmp dword [ebp - 0x14], 0xf8
jne 0x30042aa4
cmp dword [ebp - 0x19c], 0x4550
jne 0x30042aa4
cmp word [ebp - 0x196], si
jbe 0x30042aa4
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
cmp dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
jae 0x30042a00
cmp dword [ebp - 0x18], esi
je 0x300429e9
push dword [ebp - 0x18]
call fcn.3004315f
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], eax
call fcn.30043102
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x30042ac6
push dword [ebp - 0x44]
mov dword [ebp - 0x14], esi
push esi
push dword [ebp - 0x18]
call sub.MSVCR80.dll_memset
movzx eax, word [ebp - 0x188]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x1c]
lea eax, [edi + eax + 0x18]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042aa4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jne 0x30042aa4
cmp word [ebp - 0x196], si
mov dword [ebp - 0x10], esi
jbe 0x30042aa4
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jns 0x30042a91
test eax, 0x40000000
je 0x30042a91
test al, 0xc0
je 0x30042a91
mov edx, dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30025d49
add dword [ebp - 0xc], 0x28
movzx eax, word [ebp - 0x196]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x30042a52
inc dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x6c
cmp ecx, dword [eax]
jb 0x3004293e
cmp dword [ebp - 0x18], esi
je 0x30042ac6
push dword [ebp - 0x18]
call fcn.3004315f
push esi
lea eax, [ebp - 0x40]
push eax
push esi
push 5
push dword [0x300c9dc0]
call fcn.30070b75
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x300428cd
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042c33
mov dword [ebp - 0x30], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x30042c1f
and dword [ebp - 0xc], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + ecx]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp - 0x48], edx
ja 0x30042b40
jb 0x30042b2c
cmp edx, ecx
ja 0x30042b40
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30042b7b
ja 0x30042b40
cmp dword [esi], eax
jb 0x30042b7b
cmp dword [esi + 4], edi
ja 0x30042c0a
jb 0x30042b56
mov eax, dword [ebp - 0x48]
cmp dword [esi], eax
ja 0x30042c0a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30042c0a
jb 0x30042b7b
cmp dword [ebp - 0x48], ecx
jae 0x30042c0a
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30059a2a
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042bcc
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x30042ba3
cmp edx, dword [esi]
jae 0x30042bd2
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.30025d49
test eax, eax
je 0x300428cd
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30042c11
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.30025d49
test eax, eax
je 0x300428cd
jmp 0x30042c11
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x30042b0b
mov eax, dword [ebp - 0x40]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x10
xor esi, esi
cmp ecx, dword [eax]
jb 0x30042af2
mov eax, dword [ebx]
cmp eax, esi
jle 0x300428cd
mov edi, eax
shl edi, 4
add edi, 4
xor edx, edx
cmp eax, esi
jle 0x30042c63
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
inc edx
add ecx, 0x10
cmp edx, dword [ebx]
jl 0x30042c50
call fcn.30041b24
test eax, eax
je 0x300428cd
push esi
push 0xc0000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x30005668
push 0x300ca200
push dword [ebp + 0x10]
call fcn.3003d2d4
test eax, eax
je 0x300428cd
mov eax, dword [ebp + 0x10]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
je 0x300428cd
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
je 0x300428cd
mov dword [ecx + 0xc], edi
mov edi, eax
mov eax, dword [ebx]
mov dword [edi], eax
add edi, 4
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042d16
mov eax, dword [ebx + 8]
and eax, 0xffff
mov dword [ebp + 0xc], esi
push eax
mov eax, dword [ebx + 0xc]
add eax, dword [ebp + 0xc]
push eax
push edi
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebx + 8]
add dword [ebp + 0xc], 0x10
and eax, 0xffff
add esp, 0xc
add edi, eax
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebx]
jl 0x30042ced
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042d7c
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 0xc]
add eax, ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [eax + 8]
push edi
push dword [eax]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042d57
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
cmp ecx, dword [eax + edx + 8]
jne 0x300428cd
jmp 0x30042d64
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 0xc], esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, dword [eax + ecx + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp + 0xc], 0x10
cmp eax, dword [ebx]
jl 0x30042d20
push 1
mov ecx, ebx
call fcn.30044033
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc