Function at 0x300264e8
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1a0
mov eax, dword [ebp + 0x74]
push ebx
push esi
xor esi, esi
mov word [eax], si
mov eax, dword [ebp + 0x7c]
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x30098848], esi
push edi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x4c], esi
jne 0x30026a8f
push 0x10
call fcn.30050f1b
cmp eax, esi
pop ecx
je 0x30026547
mov word [eax], si
mov word [eax + 2], si
mov word [eax + 4], 0x10
mov dword [eax + 0xc], esi
mov ebx, eax
jmp 0x30026549
xor ebx, ebx
cmp ebx, esi
je 0x30026a8f
push 2
push 0x14
push 0x14
push ebx
call fcn.30050f76
test eax, eax
je 0x30026a8f
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x300968a8]
mov eax, dword [eax + 0x28]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x5c], eax
jmp 0x30026612
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x10]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp + 0x54], eax
je 0x300265bb
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x5c], eax
jmp 0x30026601
cmp dword [ebp], 0x1000
jne 0x30026601
cmp dword [ebp + 4], 4
je 0x300265d0
cmp dword [ebp + 4], 0x40
jne 0x30026601
cmp dword [ebp + 8], 0x20000
jne 0x30026601
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jae 0x30026601
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cdq
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
mov dword [ebp + 0x40], edx
mov dword [ebp + 0x44], ecx
call fcn.300510f3
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
ja 0x3002660c
mov eax, dword [ebp - 4]
add dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0x30]
jb 0x30026585
push esi
lea eax, [ebp + 0x34]
push eax
push esi
push 4
push dword [0x30096d74]
call fcn.30042972
mov edx, dword [ebp + 0x34]
cmp edx, esi
je 0x30026a8f
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x3002679b
mov dword [ebp + 0x50], esi
cmp word [ebx], si
mov eax, dword [ebp + 0x50]
lea ecx, [eax + edx + 4]
mov dword [ebp + 0x5c], ecx
mov dword [ebp + 0x68], esi
jbe 0x30026789
mov dword [ebp + 0x60], esi
jmp 0x30026665
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 0x60]
mov edi, dword [ecx]
add esi, eax
mov eax, dword [esi + 4]
mov dword [ebp + 0x28], edi
mov edi, dword [ecx + 4]
cmp eax, edi
mov dword [ebp + 0x2c], edi
ja 0x300266b4
jb 0x30026688
mov eax, dword [esi]
cmp eax, dword [ebp + 0x28]
ja 0x300266b4
mov edi, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
and dword [ebp + 0x24], 0
add eax, edi
mov edi, dword [eax + 8]
mov dword [ebp + 0x20], edi
add edi, dword [eax]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp + 0x24]
adc edi, dword [eax + 4]
cmp dword [ebp + 0x2c], edi
jb 0x300266eb
ja 0x300266b4
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x28], eax
jb 0x300266eb
mov eax, dword [ebp + 0x2c]
cmp eax, dword [esi + 4]
ja 0x30026970
jb 0x300266cd
mov eax, dword [esi]
cmp dword [ebp + 0x28], eax
ja 0x30026970
mov ecx, dword [ecx + 8]
xor eax, eax
add ecx, dword [ebp + 0x28]
adc eax, dword [ebp + 0x2c]
cmp dword [esi + 4], eax
ja 0x30026970
jb 0x300266eb
cmp dword [esi], ecx
jae 0x30026970
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.3005126d
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x5c]
cmp ecx, dword [eax + 4]
ja 0x3002673c
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x30026713
cmp edx, dword [esi]
jae 0x30026742
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300510f3
cmp eax, 0xffffffff
je 0x30026a8f
mov esi, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30026778
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.300510f3
cmp eax, 0xffffffff
je 0x30026a8f
mov edx, dword [ebp + 0x34]
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x30026662
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x30026647
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x30026942
mov dword [ebp + 0x50], esi
mov eax, dword [ebp + 0x50]
lea eax, [eax + edx + 4]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x5c], eax
push 4
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
add eax, 0x3c
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30026920
cmp dword [ebp + 0x54], 4
jne 0x30026920
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
push 0xf8
lea ecx, [ebp - 0x134]
push ecx
push eax
push dword [ebp + 0x38]
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30026920
cmp dword [ebp + 0x54], 0xf8
jne 0x30026920
cmp dword [ebp - 0x134], 0x4550
jne 0x30026920
cmp word [ebp - 0x12e], si
jbe 0x30026920
movzx edi, word [ebp - 0x12e]
imul edi, edi, 0x28
cmp dword [ebp + 0x4c], edi
mov dword [ebp + 0x60], edi
jae 0x30026873
cmp dword [ebp + 0x58], esi
je 0x3002685a
push dword [ebp + 0x58]
call fcn.30050db4
push 0x106
push edi
mov dword [ebp + 0x4c], edi
call fcn.30050e9f
cmp eax, esi
mov dword [ebp + 0x58], eax
je 0x30026942
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x58]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [ebp + 0x54], esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movzx eax, word [ebp - 0x120]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax + 0x18]
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30026920
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x54], eax
jne 0x30026920
cmp word [ebp - 0x12e], si
mov dword [ebp + 0x68], esi
jbe 0x30026920
mov eax, dword [ebp + 0x58]
add eax, 0x24
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
test eax, eax
jns 0x3002690d
test eax, 0x40000000
je 0x3002690d
test al, 0xc0
je 0x3002690d
mov edx, dword [ebp + 0x5c]
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x3c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300510f3
add dword [ebp + 0x60], 0x28
movzx eax, word [ebp - 0x12e]
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], eax
jl 0x300268cf
inc dword [ebp + 0x64]
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x300267a9
cmp dword [ebp + 0x58], esi
je 0x30026942
push dword [ebp + 0x58]
call fcn.30050db4
push esi
lea eax, [ebp + 0x30]
push eax
push esi
push 5
push dword [0x30096d74]
call fcn.30042972
mov eax, dword [ebp + 0x30]
cmp eax, esi
je 0x30026a8f
cmp dword [eax], esi
mov dword [ebp + 0x64], esi
jbe 0x30026af8
mov dword [ebp + 0x4c], esi
jmp 0x3002697f
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
jmp 0x3002677b
mov eax, dword [ebp + 0x30]
cmp word [ebx], si
mov ecx, dword [ebp + 0x4c]
lea eax, [ecx + eax + 4]
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x68], esi
jbe 0x30026ae3
mov dword [ebp + 0x60], esi
jmp 0x3002699d
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x60]
mov edi, dword [eax + 4]
lea esi, [edx + ecx]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0x20], edx
ja 0x300269cf
jb 0x300269bb
cmp edx, ecx
ja 0x300269cf
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30026a0a
ja 0x300269cf
cmp dword [esi], eax
jb 0x30026a0a
cmp dword [esi + 4], edi
ja 0x30026ace
jb 0x300269e5
mov eax, dword [ebp + 0x20]
cmp dword [esi], eax
ja 0x30026ace
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30026ace
jb 0x30026a0a
cmp dword [ebp + 0x20], ecx
jae 0x30026ace
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.3005126d
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x58]
cmp ecx, dword [eax + 4]
ja 0x30026a57
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x30026a32
cmp edx, dword [esi]
jae 0x30026a5d
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300510f3
cmp eax, 0xffffffff
je 0x30026a8f
mov esi, dword [ebp + 0x58]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30026ad5
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.300510f3
cmp eax, 0xffffffff
jne 0x30026ad5
mov esi, dword [ebp + 0x7c]
push esi
call fcn.30021bf6
mov edi, dword [ebp + 0x74]
cmp word [edi], 0
je 0x30026aa7
push edi
call fcn.30021c34
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x30026ac7
mov ecx, ebx
call fcn.30024e57
push ebx
call fcn.30050e86
pop ecx
xor eax, eax
jmp 0x30026c5c
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x3002699a
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x64]
add dword [ebp + 0x4c], 0x10
cmp ecx, dword [eax]
jb 0x3002697c
mov ax, word [ebx]
cmp ax, si
jbe 0x30026a8f
movzx eax, ax
mov edi, eax
shl edi, 4
add edi, 4
cmp eax, esi
mov dword [ebp + 0x64], esi
jle 0x30026b30
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
movzx edx, word [ebx]
inc dword [ebp + 0x64]
add ecx, 0x10
cmp dword [ebp + 0x64], edx
jl 0x30026b17
call fcn.300263f5
test eax, eax
je 0x30026a8f
push esi
push 0xc0000000
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0x300037bc
push 0x300971e0
push dword [ebp + 0x7c]
call fcn.30021cb7
test eax, eax
je 0x30026a8f
mov eax, dword [ebp + 0x7c]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 4], eax
je 0x30026a8f
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 8], eax
je 0x30026a8f
mov dword [ecx + 0xc], edi
movzx ecx, word [ebx]
mov dword [eax], ecx
add eax, 4
cmp word [ebx], si
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x64], esi
jbe 0x30026bee
mov ecx, dword [ebx + 4]
mov eax, 0xffff
and ecx, eax
and dword [ebp + 0x78], 0
mov esi, dword [ebx + 0xc]
add esi, dword [ebp + 0x78]
mov edi, dword [ebp + 0x68]
mov edx, ecx
add dword [ebp + 0x78], 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
movzx edx, word [ebx]
and ecx, eax
add dword [ebp + 0x68], ecx
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], edx
jl 0x30026bc0
xor edi, edi
cmp word [ebx], di
jbe 0x30026c4b
xor esi, esi
and dword [ebp + 0x54], 0
mov eax, dword [ebx + 0xc]
lea ecx, [ebp + 0x54]
push ecx
add eax, esi
push dword [eax + 8]
push dword [ebp + 0x68]
push dword [eax]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30026c2b
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0x54]
cmp ecx, dword [esi + eax + 8]
jne 0x30026a8f
jmp 0x30026c36
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax + 8]
and dword [eax + esi + 0xc], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [esi + eax + 8]
add dword [ebp + 0x68], eax
movzx eax, word [ebx]
inc edi
add esi, 0x10
cmp edi, eax
jl 0x30026bf7
mov ecx, ebx
call fcn.30024e57
push ebx
call fcn.30050e86
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc