Function at 0x30002a90
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x30002bfa
cmp dword [0x3026ed64], ebx
jne 0x30002b2a
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x30002ad0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
jmp 0x30002adf
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
push 0x68
push 8
push dword [0x3026d8b0]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
test edx, edx
je 0x30002b12
mov ecx, dword [ebp - 4]
mov dword [edx + 0x34], ecx
mov ecx, dword [ebp - 8]
mov dword [edx + 0xbf4], ecx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x30002b12
push ecx
popfd
test eax, eax
jne 0x30002b25
push str.CreateTrackedRegion:_failed_to_allocate_memory_for_initial_tracked_region_list._n
call fcn.3000a0d0
add esp, 4
jmp 0x30002b2a
mov dword [0x3026ed64], eax
mov eax, dword [0x3026ed64]
test eax, eax
je 0x30002b50
mov ebx, eax
inc esi
mov eax, dword [eax + 0x60]
test eax, eax
jne 0x30002b33
cmp esi, 0x64
jbe 0x30002b50
push esi
push str.AddTrackedRegion:_DEBUG_Warning___number_of_tracked_regions__d._n
call fcn.3000a0d0
add esp, 8
mov ecx, dword [0x3026ed44]
test ecx, ecx
jne 0x30002b86
push 0x3026ed40
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x3026ed44]
test ecx, ecx
jne 0x30002b86
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.3000a0f0
mov ecx, dword [0x3026ed44]
add esp, 4
xor esi, esi
jmp 0x30002b91
xor edx, edx
mov eax, edi
div ecx
mov esi, eax
imul esi, ecx
mov eax, dword [0x3026ed64]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x30002bae
push str.GetPageAddress:_Error___Supplied_address_zero._n
call fcn.3000a0d0
add esp, 4
xor eax, eax
jmp 0x30002be2
test ecx, ecx
jne 0x30002bdb
push 0x3026ed40
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x3026ed44]
test ecx, ecx
jne 0x30002bd8
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.3000a0f0
add esp, 4
xor eax, eax
jmp 0x30002be2
mov eax, dword [ebp - 0xc]
xor edx, edx
div ecx
imul eax, ecx
cmp esi, eax
jne 0x30002c03
push dword [0x3026ed64]
push edi
push str.AddTrackedRegion:_Warning___attempting_to_track_the_page__0x_p__containing_the_tracked_region_list_at_0x_p._n
call fcn.3000a0d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.30002a40
mov esi, eax
test esi, esi
jne 0x30002c3e
test ebx, ebx
je 0x30002c3e
lea edx, [eax + 1]
lea ecx, [eax + 0x68]
call fcn.300011a0
mov esi, eax
mov dword [ebx + 0x60], esi
test esi, esi
jne 0x30002c3e
push str.AddTrackedRegion:_Failed_to_allocate_new_tracked_region_struct._n
call fcn.3000a0d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [esi + 8]
push 0x1c
push eax
push edi
call ebx
test eax, eax
jne 0x30002c68
push edi
push str.AddTrackedRegion:_unable_to_query_memory_region_0x_p
call fcn.3000a0f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov dword [esi], ecx
cmp edi, ecx
je 0x30002c74
mov dword [esi + 4], edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x30002c7e
mov dword [esi + 0x1c], eax
call fcn.30004460
mov dword [esi + 0x34], eax
test eax, eax
je 0x30002cb0
mov ecx, dword [esi]
call fcn.30003790
mov ecx, dword [esi]
fstp qword [esi + 0x38]
call fcn.30004080
mov dword [esi + 0x40], eax
test eax, eax
je 0x30002cb0
push eax
push str.AddTrackedRegion:_Min_PE_size_0x_x
call fcn.3000a0d0
add esp, 8
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
call ebx
neg eax
sbb ecx, ecx
mov eax, dword [0x302697b8]
and ecx, dword [ebp - 0x28]
test eax, eax
je 0x30002cf0
lea esp, [esp]
cmp dword [eax + 4], ecx
je 0x30002ce4
mov eax, dword [eax]
test eax, eax
jne 0x30002cd0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xc
je 0x30002cf0
mov dword [esi + 0x28], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret