Function at 0x300425f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x300cb85c], esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], esi
jne 0x3004288b
test byte [0x300bfc9c], 0x20
je 0x30042650
push esi
push esi
push esi
push 0x30005668
push eax
push dword [ebp + 0xc]
push ecx
call fcn.30041def
jmp 0x30042d46
push 0x14
call fcn.300430c2
cmp eax, esi
je 0x30042666
mov ecx, eax
call fcn.300403fa
mov ebx, eax
jmp 0x30042668
xor ebx, ebx
cmp ebx, esi
je 0x3004288b
push esi
push 0x14
push 0x14
push ebx
call fcn.30059383
test eax, eax
je 0x3004288b
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x300bfc8c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 4], eax
jmp 0x3004273a
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x78]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 4]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp - 0x14], eax
je 0x300426df
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 4], eax
jmp 0x30042726
cmp dword [ebp - 0x68], 0x1000
jne 0x30042726
cmp dword [ebp - 0x64], 4
je 0x300426f4
cmp dword [ebp - 0x64], 0x40
jne 0x30042726
cmp dword [ebp - 0x60], 0x20000
jne 0x30042726
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0xffffffff
jae 0x30042726
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x78]
cdq
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x28], edx
call fcn.300403e0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6c]
ja 0x30042734
mov eax, dword [ebp - 0x6c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x98]
jb 0x300426a6
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push dword [0x300c9dc0]
call fcn.30070aca
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x3004288b
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x300428ee
mov dword [ebp - 0x1c], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x300428da
and dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
lea esi, [eax + ecx]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x34], edi
mov edi, dword [edx + 4]
cmp eax, edi
ja 0x300427d3
jb 0x300427af
cmp ecx, dword [ebp - 0x34]
ja 0x300427d3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edi, edi
add ecx, dword [eax]
adc edi, dword [eax + 4]
mov dword [ebp - 0x7c], edi
mov edi, dword [edx + 4]
cmp edi, dword [ebp - 0x7c]
jb 0x30042806
ja 0x300427d3
cmp dword [ebp - 0x34], ecx
jb 0x30042806
cmp edi, dword [esi + 4]
ja 0x300428c5
jb 0x300427e9
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi]
ja 0x300428c5
mov eax, dword [edx + 8]
xor edx, edx
add eax, dword [ebp - 0x34]
adc edx, edi
cmp dword [esi + 4], edx
ja 0x300428c5
jb 0x30042806
cmp dword [esi], eax
jae 0x300428c5
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.3005997a
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042853
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x3004282e
cmp edx, dword [esi]
jae 0x30042859
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.300403e0
test eax, eax
je 0x3004288b
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x300428cc
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.300403e0
test eax, eax
jne 0x300428cc
mov esi, dword [ebp + 0x10]
push esi
call fcn.3003d18e
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x300428a3
push edi
call fcn.3003d1cf
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x300428be
push 1
mov ecx, ebx
call fcn.30043f70
xor eax, eax
jmp 0x30042d46
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x3004278b
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x1c], 0x6c
xor esi, esi
cmp ecx, dword [eax]
jb 0x30042772
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042a84
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x30]
lea edi, [ecx + eax + 4]
lea ecx, [ebp - 0x14]
push ecx
push 4
mov dword [ebp - 0x14], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x5c]
push ecx
add eax, 0x3c
push eax
push dword [ebp - 0x38]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042a62
cmp dword [ebp - 0x14], 4
jne 0x30042a62
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
mov edi, dword [edi]
add edi, dword [ebp - 0x5c]
push 0xf8
lea eax, [ebp - 0x19c]
push eax
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042a62
cmp dword [ebp - 0x14], 0xf8
jne 0x30042a62
cmp dword [ebp - 0x19c], 0x4550
jne 0x30042a62
cmp word [ebp - 0x196], si
jbe 0x30042a62
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
cmp dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], eax
jae 0x300429be
cmp dword [ebp - 0x18], esi
je 0x300429a7
push dword [ebp - 0x18]
call fcn.3004311f
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], eax
call fcn.300430c2
cmp eax, esi
mov dword [ebp - 0x18], eax
je 0x30042a84
push dword [ebp - 0x44]
mov dword [ebp - 0x14], esi
push esi
push dword [ebp - 0x18]
call sub.MSVCR80.dll_memset
movzx eax, word [ebp - 0x188]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x1c]
lea eax, [edi + eax + 0x18]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042a62
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jne 0x30042a62
cmp word [ebp - 0x196], si
mov dword [ebp - 0x10], esi
jbe 0x30042a62
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jns 0x30042a4f
test eax, 0x40000000
je 0x30042a4f
test al, 0xc0
je 0x30042a4f
mov edx, dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.300403e0
add dword [ebp - 0xc], 0x28
movzx eax, word [ebp - 0x196]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x30042a10
inc dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x6c
cmp ecx, dword [eax]
jb 0x300428fc
cmp dword [ebp - 0x18], esi
je 0x30042a84
push dword [ebp - 0x18]
call fcn.3004311f
push esi
lea eax, [ebp - 0x40]
push eax
push esi
push 5
push dword [0x300c9dc0]
call fcn.30070aca
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x3004288b
cmp dword [eax], esi
mov dword [ebp - 8], esi
jbe 0x30042bf1
mov dword [ebp - 0x30], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x30042bdd
and dword [ebp - 0xc], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + ecx]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp - 0x48], edx
ja 0x30042afe
jb 0x30042aea
cmp edx, ecx
ja 0x30042afe
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30042b39
ja 0x30042afe
cmp dword [esi], eax
jb 0x30042b39
cmp dword [esi + 4], edi
ja 0x30042bc8
jb 0x30042b14
mov eax, dword [ebp - 0x48]
cmp dword [esi], eax
ja 0x30042bc8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30042bc8
jb 0x30042b39
cmp dword [ebp - 0x48], ecx
jae 0x30042bc8
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.3005997a
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x30042b8a
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x30042b61
cmp edx, dword [esi]
jae 0x30042b90
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.300403e0
test eax, eax
je 0x3004288b
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30042bcf
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.300403e0
test eax, eax
je 0x3004288b
jmp 0x30042bcf
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x30042ac9
mov eax, dword [ebp - 0x40]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x10
xor esi, esi
cmp ecx, dword [eax]
jb 0x30042ab0
mov eax, dword [ebx]
cmp eax, esi
jle 0x3004288b
mov edi, eax
shl edi, 4
add edi, 4
xor edx, edx
cmp eax, esi
jle 0x30042c21
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
inc edx
add ecx, 0x10
cmp edx, dword [ebx]
jl 0x30042c0e
call fcn.30041ae2
test eax, eax
je 0x3004288b
push esi
push 0xc0000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x30005668
push 0x300ca200
push dword [ebp + 0x10]
call fcn.3003d257
test eax, eax
je 0x3004288b
mov eax, dword [ebp + 0x10]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
je 0x3004288b
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
je 0x3004288b
mov dword [ecx + 0xc], edi
mov edi, eax
mov eax, dword [ebx]
mov dword [edi], eax
add edi, 4
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042cd4
mov eax, dword [ebx + 8]
and eax, 0xffff
mov dword [ebp + 0xc], esi
push eax
mov eax, dword [ebx + 0xc]
add eax, dword [ebp + 0xc]
push eax
push edi
call sub.MSVCR80.dll_memcpy
mov eax, dword [ebx + 8]
add dword [ebp + 0xc], 0x10
and eax, 0xffff
add esp, 0xc
add edi, eax
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebx]
jl 0x30042cab
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x30042d3a
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 0xc]
add eax, ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [eax + 8]
push edi
push dword [eax]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30042d15
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
cmp ecx, dword [eax + edx + 8]
jne 0x3004288b
jmp 0x30042d22
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 0xc], esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, dword [eax + ecx + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp + 0xc], 0x10
cmp eax, dword [ebx]
jl 0x30042cde
push 1
mov ecx, ebx
call fcn.30043f70
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc