Function at 0x3001d237
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
lea eax, [ebp - 0x28]
push eax
mov esi, ecx
mov dword [ebp - 0x68], 0x40
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x3001d26d
push 0x30001e78
call fcn.300259d3
add esp, 4
push dword [ebp - 0x24]
push 0x30001e50
call fcn.300259d3
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x5c]
shrd eax, ecx, 0x14
shr ecx, 0x14
mov ecx, dword [ebp - 0x60]
shrd ecx, edx, 0x14
push ecx
push 0x30001e20
shr edx, 0x14
call fcn.300259d3
push eax
push 0x30001dec
call fcn.300259d3
push dword [ebp - 0x64]
push 0x30001dc8
call fcn.300259d3
add esp, 0x20
cmp dword [ebp - 0x54], 0
ja 0x3001d386
jb 0x3001d2d3
cmp dword [ebp - 0x58], 0x40000000
jae 0x3001d386
push dword [esi + 0x74]
push 0x30001d98
call fcn.300259d3
push dword [0x3006717c]
push 0x30001d6c
call fcn.300259d3
push dword [ebp - 0x58]
push 0x30001d4c
call fcn.300259d3
mov eax, dword [ebp - 0x58]
imul eax, dword [0x3006717c]
push eax
push 0x30001d30
call fcn.300259d3
mov eax, dword [ebp - 0x58]
imul eax, dword [0x3006717c]
push 0x64
pop ecx
xor edx, edx
div ecx
push eax
push 0x30001d18
call fcn.300259d3
mov eax, dword [ebp - 0x58]
imul eax, dword [0x3006717c]
xor edx, edx
div ecx
push eax
push 0x30001cec
mov dword [esi + 0x74], eax
call fcn.300259d3
mov eax, dword [ebp - 0x58]
xor edx, edx
div dword [ebp - 0x24]
xor edx, edx
add esp, 0x30
push dword [ebp - 0x24]
imul eax, eax, 0x5f
div ecx
push eax
mov dword [esi + 0x68], eax
call fcn.3001c944
push eax
push 0x30001cc0
mov dword [esi + 0x74], eax
call fcn.300259d3
push dword [esi + 0x74]
push 0x30001c90
call fcn.300259d3
add esp, 0x10
lea ebx, [esi + 0x74]
push dword [ebx]
push 0x30001c70
call fcn.300259d3
add esp, 8
cmp dword [0x30067184], 0
je 0x3001d3a8
mov eax, 0x30067184
jmp 0x3001d3b2
mov dword [ebp - 4], 0x7ff00000
lea eax, [ebp - 4]
push edi
push dword [eax]
call fcn.3001c979
mov edi, eax
push edi
push 0x30001c44
call fcn.300259d3
add esp, 8
push edi
push dword [ebx]
call fcn.3001c8c0
test al, al
je 0x3001d3de
push edi
mov ecx, ebx
call fcn.3001cc28
mov eax, 0x1900000
push eax
push dword [ebx]
push 0x30001c08
call fcn.300259d3
mov ecx, dword [ebx]
add esp, 0xc
shr ecx, 5
mov dword [ebp - 4], ecx
cmp dword [ebx], eax
jbe 0x3001d5b0
push dword [0x30067184]
push 0x30001be4
call fcn.300259d3
push 0x7ff00000
push 0x30001bc4
call fcn.300259d3
push dword [ebx]
push 0x30001ba4
call fcn.300259d3
add esp, 0x18
push dword [ebp - 0x24]
push dword [ebx]
call fcn.3001c95f
push dword [ebp - 0x24]
lea edi, [esi + 0x68]
push eax
mov dword [edi], eax
call fcn.3001c944
mov dword [ebx], eax
push dword [edi]
push 0x30001b84
call fcn.300259d3
mov eax, dword [ebx]
mov ecx, eax
shr ecx, 0x14
push ecx
shr eax, 0xa
push eax
push 0x30001b5c
call fcn.300259d3
add esp, 0x14
push dword [edi]
call fcn.3001c979
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esi + 0x70], eax
jne 0x3001d4a3
push 0x30001b3c
call fcn.300259d3
add esp, 4
jmp 0x3001d535
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
cmp eax, 1
je 0x3001d4c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30001b10
jmp 0x3001d52d
push dword [ebp - 0x24]
push dword [edi]
call fcn.3001c944
mov ecx, eax
mov dword [ebx], eax
shr ecx, 0x14
push ecx
shr eax, 0xa
push eax
push 0x30001aec
call fcn.300259d3
mov eax, dword [ebx]
add esp, 0xc
push 4
push 0x402000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x3001d50f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30001ac4
jmp 0x3001d52d
push dword [esi + 0x70]
mov ecx, dword [edi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
cmp eax, 1
je 0x3001d59e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x30001a94
call fcn.300259d3
add esp, 8
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x3001d55b
push 0
push dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
push 0x8000
push 0
push dword [esi + 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
and dword [esi + 0x6c], 0
mov eax, dword [esi + 0x70]
test eax, eax
je 0x3001d58a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
push dword [esi + 0x70]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [edi], 0
and dword [esi + 0x70], 0
push dword [ebp - 4]
mov ecx, ebx
call fcn.3001c9a8
mov eax, 0x1900000
jmp 0x3001d3fb
push 0x30001a74
call fcn.300259d3
add esp, 4
mov eax, 0x1900000
mov ecx, dword [ebx]
cmp ecx, eax
pop edi
jae 0x3001d5ce
push eax
push ecx
push 0x30001a38
call fcn.300259d3
add esp, 0xc
mov byte [esi + 0x7c], 1
xor eax, eax
jmp 0x3001d5eb
mov eax, dword [esi + 0x6c]
shr ecx, 2
push ecx
mov dword [esi + 0x60], eax
push 0x30001a04
mov dword [esi + 0x64], ecx
call fcn.300259d3
xor eax, eax
add esp, 8
inc eax
pop esi
pop ebx
leave
ret