Function at 0x2e04338f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
mov ecx, dword [ebp + 8]
push ebx
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
push esi
xor esi, esi
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x44], esi
cmp dword [0x2e0d16d8], esi
jne 0x2e043629
test byte [0x2e0c5b1c], 0x20
je 0x2e0433ee
push esi
push esi
push esi
push 0x2e005604
push eax
push dword [ebp + 0xc]
push ecx
call fcn.2e042f41
jmp 0x2e043ae8
push 0x14
call fcn.2e0441a3
cmp eax, esi
je 0x2e043404
mov ecx, eax
call fcn.2e045b5c
mov ebx, eax
jmp 0x2e043406
xor ebx, ebx
cmp ebx, esi
je 0x2e043629
push esi
push 0x14
push 0x14
push ebx
call fcn.2e05c3de
test eax, eax
je 0x2e043629
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x2e0c5b0c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 4], eax
jmp 0x2e0434d8
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x78]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 4]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [ebp - 0x14], eax
cmp eax, 0x1c
je 0x2e04347d
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 4], eax
jmp 0x2e0434c4
cmp dword [ebp - 0x68], 0x1000
jne 0x2e0434c4
cmp dword [ebp - 0x64], 4
je 0x2e043492
cmp dword [ebp - 0x64], 0x40
jne 0x2e0434c4
cmp dword [ebp - 0x60], 0x20000
jne 0x2e0434c4
mov ecx, dword [ebp - 0x6c]
cmp ecx, 0xffffffff
jae 0x2e0434c4
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x78]
cdq
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x28], edx
call fcn.2e025df3
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6c]
ja 0x2e0434d2
mov eax, dword [ebp - 0x6c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x98]
jb 0x2e043444
push esi
lea eax, [ebp - 0x3c]
push eax
push esi
push 4
push dword [0x2e0cfc40]
call sub.dbghelp.dll_MiniDumpReadDumpStream
mov eax, dword [ebp - 0x3c]
cmp eax, esi
je 0x2e043629
mov dword [ebp - 8], esi
cmp dword [eax], esi
jbe 0x2e04368e
mov dword [ebp - 0x1c], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x2e04367a
and dword [ebp - 0xc], 0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
mov edi, dword [edx]
lea esi, [eax + ecx]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [ebp - 0x34], edi
mov edi, dword [edx + 4]
cmp eax, edi
ja 0x2e043571
jb 0x2e04354d
cmp ecx, dword [ebp - 0x34]
ja 0x2e043571
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edi, edi
add ecx, dword [eax]
adc edi, dword [eax + 4]
mov dword [ebp - 0x7c], edi
mov edi, dword [edx + 4]
cmp edi, dword [ebp - 0x7c]
jb 0x2e0435a4
ja 0x2e043571
cmp dword [ebp - 0x34], ecx
jb 0x2e0435a4
cmp edi, dword [esi + 4]
ja 0x2e043665
jb 0x2e043587
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi]
ja 0x2e043665
mov eax, dword [edx + 8]
xor edx, edx
add eax, dword [ebp - 0x34]
adc edx, edi
cmp dword [esi + 4], edx
ja 0x2e043665
jb 0x2e0435a4
cmp dword [esi], eax
jae 0x2e043665
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.2e05c9fa
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x2e0435f1
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x2e0435cc
cmp edx, dword [esi]
jae 0x2e0435f7
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.2e025df3
test eax, eax
je 0x2e043629
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x2e04366c
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.2e025df3
test eax, eax
jne 0x2e04366c
mov esi, dword [ebp + 0x10]
push esi
call fcn.2e03dca5
mov edi, dword [ebp + 8]
cmp word [edi], 0
je 0x2e043641
push edi
call fcn.2e03dce6
and dword [esi + 8], 0
and dword [esi + 4], 0
or dword [esi], 0xffffffff
xor eax, eax
mov word [edi], ax
test ebx, ebx
je 0x2e04365e
push 1
mov ecx, ebx
call fcn.2e04674e
xor eax, eax
jmp 0x2e043ae8
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x2e043529
mov eax, dword [ebp - 0x3c]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x1c], 0x6c
xor esi, esi
cmp ecx, dword [eax]
jb 0x2e043510
mov dword [ebp - 8], esi
cmp dword [eax], esi
jbe 0x2e043826
mov dword [ebp - 0x30], esi
mov ecx, dword [ebp - 0x30]
lea edi, [ecx + eax + 4]
lea ecx, [ebp - 0x14]
push ecx
push 4
mov dword [ebp - 0x14], esi
mov eax, dword [edi]
lea ecx, [ebp - 0x5c]
push ecx
add eax, 0x3c
push eax
push dword [ebp - 0x38]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x2e043804
cmp dword [ebp - 0x14], 4
jne 0x2e043804
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], esi
mov edi, dword [edi]
add edi, dword [ebp - 0x5c]
push 0xf8
lea eax, [ebp - 0x19c]
push eax
push edi
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x2e043804
cmp dword [ebp - 0x14], 0xf8
jne 0x2e043804
cmp dword [ebp - 0x19c], 0x4550
jne 0x2e043804
cmp word [ebp - 0x196], si
jbe 0x2e043804
movzx eax, word [ebp - 0x196]
imul eax, eax, 0x28
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x44], eax
jae 0x2e04375e
cmp dword [ebp - 0x18], esi
je 0x2e043747
push dword [ebp - 0x18]
call fcn.2e0441d7
mov eax, dword [ebp - 0x1c]
push eax
mov dword [ebp - 0x44], eax
call fcn.2e0441a3
mov dword [ebp - 0x18], eax
cmp eax, esi
je 0x2e043826
push dword [ebp - 0x44]
mov dword [ebp - 0x14], esi
push esi
push dword [ebp - 0x18]
call fcn.2e06e640
movzx eax, word [ebp - 0x188]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x1c]
lea eax, [edi + eax + 0x18]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x2e043804
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jne 0x2e043804
xor eax, eax
mov dword [ebp - 0x10], esi
cmp ax, word [ebp - 0x196]
jae 0x2e043804
mov eax, dword [ebp - 0x18]
add eax, 0x24
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
test eax, eax
jns 0x2e0437f1
test eax, 0x40000000
je 0x2e0437f1
test al, 0xc0
je 0x2e0437f1
mov edx, dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.2e025df3
add dword [ebp - 0xc], 0x28
movzx eax, word [ebp - 0x196]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x2e0437b2
inc dword [ebp - 8]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x6c
cmp ecx, dword [eax]
jb 0x2e04369c
cmp dword [ebp - 0x18], esi
je 0x2e043826
push dword [ebp - 0x18]
call fcn.2e0441d7
push esi
lea eax, [ebp - 0x40]
push eax
push esi
push 5
push dword [0x2e0cfc40]
call sub.dbghelp.dll_MiniDumpReadDumpStream
mov eax, dword [ebp - 0x40]
cmp eax, esi
je 0x2e043629
mov dword [ebp - 8], esi
cmp dword [eax], esi
jbe 0x2e043993
mov dword [ebp - 0x30], esi
cmp dword [ebx], esi
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax + 4]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
jle 0x2e04397f
and dword [ebp - 0xc], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0xc]
lea esi, [eax + ecx]
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp - 0x48], edx
cmp edi, dword [esi + 4]
ja 0x2e0438a0
jb 0x2e04388c
cmp edx, ecx
ja 0x2e0438a0
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x2e0438db
ja 0x2e0438a0
cmp dword [esi], eax
jb 0x2e0438db
cmp dword [esi + 4], edi
ja 0x2e04396a
jb 0x2e0438b6
mov eax, dword [ebp - 0x48]
cmp dword [esi], eax
ja 0x2e04396a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x2e04396a
jb 0x2e0438db
cmp dword [ebp - 0x48], ecx
jae 0x2e04396a
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp - 0x10]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.2e05c9fa
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax + 4]
ja 0x2e04392c
mov edx, dword [ebp - 0x58]
mov esi, eax
jb 0x2e043903
cmp edx, dword [esi]
jae 0x2e043932
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, ebx
call fcn.2e025df3
test eax, eax
je 0x2e043629
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x58]
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x50]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x2e043971
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x28], 0
sub edx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x24], edx
call fcn.2e025df3
test eax, eax
je 0x2e043629
jmp 0x2e043971
inc dword [ebp - 0x10]
add dword [ebp - 0xc], 0x10
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebx]
jl 0x2e04386b
mov eax, dword [ebp - 0x40]
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
add dword [ebp - 0x30], 0x10
xor esi, esi
cmp ecx, dword [eax]
jb 0x2e043852
mov eax, dword [ebx]
cmp eax, esi
jle 0x2e043629
mov edi, eax
shl edi, 4
add edi, 4
xor edx, edx
cmp eax, esi
jle 0x2e0439c3
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
inc edx
add ecx, 0x10
cmp edx, dword [ebx]
jl 0x2e0439b0
call fcn.2e042c65
test eax, eax
je 0x2e043629
push esi
push 0xc0000000
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x2e005604
push 0x2e0d0080
push dword [ebp + 0x10]
call fcn.2e03f460
test eax, eax
je 0x2e043629
mov eax, dword [ebp + 0x10]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
cmp eax, esi
je 0x2e043629
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
cmp eax, esi
je 0x2e043629
mov dword [ecx + 0xc], edi
mov edi, eax
mov eax, dword [ebx]
mov dword [edi], eax
add edi, 4
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x2e043a76
mov eax, dword [ebx + 8]
and eax, 0xffff
mov dword [ebp + 0xc], esi
push eax
mov eax, dword [ebx + 0xc]
add eax, dword [ebp + 0xc]
push eax
push edi
call fcn.2e06e2ea
mov eax, dword [ebx + 8]
add dword [ebp + 0xc], 0x10
and eax, 0xffff
add esp, 0xc
add edi, eax
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebx]
jl 0x2e043a4d
cmp dword [ebx], esi
mov dword [ebp - 8], esi
jle 0x2e043adc
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], esi
mov eax, dword [ebx + 0xc]
add eax, ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [eax + 8]
push edi
push dword [eax]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x2e043ab7
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
cmp ecx, dword [eax + edx + 8]
jne 0x2e043629
jmp 0x2e043ac4
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + ecx + 0xc], esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, dword [eax + ecx + 8]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp + 0xc], 0x10
cmp eax, dword [ebx]
jl 0x2e043a80
push 1
mov ecx, ebx
call fcn.2e04674e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc