Function at 0x30002850
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x300029ba
cmp dword [0x302739c4], ebx
jne 0x300028ea
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x30002890
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
jmp 0x3000289f
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
push 0x68
push 8
push dword [0x30272510]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
test edx, edx
je 0x300028d2
mov ecx, dword [ebp - 4]
mov dword [edx + 0x34], ecx
mov ecx, dword [ebp - 8]
mov dword [edx + 0xbf4], ecx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x300028d2
push ecx
popfd
test eax, eax
jne 0x300028e5
push str.CreateTrackedRegion:_failed_to_allocate_memory_for_initial_tracked_region_list._n
call fcn.30009b40
add esp, 4
jmp 0x300028ea
mov dword [0x302739c4], eax
mov eax, dword [0x302739c4]
test eax, eax
je 0x30002910
mov ebx, eax
inc esi
mov eax, dword [eax + 0x60]
test eax, eax
jne 0x300028f3
cmp esi, 0x64
jbe 0x30002910
push esi
push str.AddTrackedRegion:_DEBUG_Warning___number_of_tracked_regions__d._n
call fcn.30009b40
add esp, 8
mov ecx, dword [0x302739a4]
test ecx, ecx
jne 0x30002946
push 0x302739a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x302739a4]
test ecx, ecx
jne 0x30002946
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b60
mov ecx, dword [0x302739a4]
add esp, 4
xor esi, esi
jmp 0x30002951
xor edx, edx
mov eax, edi
div ecx
mov esi, eax
imul esi, ecx
mov eax, dword [0x302739c4]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x3000296e
push str.GetPageAddress:_Error___Supplied_address_zero._n
call fcn.30009b40
add esp, 4
xor eax, eax
jmp 0x300029a2
test ecx, ecx
jne 0x3000299b
push 0x302739a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x302739a4]
test ecx, ecx
jne 0x30002998
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b60
add esp, 4
xor eax, eax
jmp 0x300029a2
mov eax, dword [ebp - 0xc]
xor edx, edx
div ecx
imul eax, ecx
cmp esi, eax
jne 0x300029c3
push dword [0x302739c4]
push edi
push str.AddTrackedRegion:_Warning___attempting_to_track_the_page__0x_p__containing_the_tracked_region_list_at_0x_p._n
call fcn.30009b40
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.30002800
mov esi, eax
test esi, esi
jne 0x300029fe
test ebx, ebx
je 0x300029fe
lea edx, [eax + 1]
lea ecx, [eax + 0x68]
call fcn.300011a0
mov esi, eax
mov dword [ebx + 0x60], esi
test esi, esi
jne 0x300029fe
push str.AddTrackedRegion:_Failed_to_allocate_new_tracked_region_struct._n
call fcn.30009b40
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [esi + 8]
push 0x1c
push eax
push edi
call ebx
test eax, eax
jne 0x30002a28
push edi
push str.AddTrackedRegion:_unable_to_query_memory_region_0x_p
call fcn.30009b60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov dword [esi], ecx
cmp edi, ecx
je 0x30002a34
mov dword [esi + 4], edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x30002a3e
mov dword [esi + 0x1c], eax
call fcn.30004170
mov dword [esi + 0x34], eax
test eax, eax
je 0x30002a70
mov ecx, dword [esi]
call fcn.30003510
mov ecx, dword [esi]
fstp qword [esi + 0x38]
call fcn.30003d90
mov dword [esi + 0x40], eax
test eax, eax
je 0x30002a70
push eax
push str.AddTrackedRegion:_Min_PE_size_0x_x
call fcn.30009b40
add esp, 8
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push edi
call ebx
neg eax
sbb ecx, ecx
mov eax, dword [0x3026e818]
and ecx, dword [ebp - 0x28]
test eax, eax
je 0x30002ab0
lea esp, [esp]
cmp dword [eax + 4], ecx
je 0x30002aa4
mov eax, dword [eax]
test eax, eax
jne 0x30002a90
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xc
je 0x30002ab0
mov dword [esi + 0x28], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret