Function at 0x30027485
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1a0
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x74]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x3009c728], esi
push edi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x4c], esi
jne 0x30027a4f
mov edx, dword [0x3009a790]
test byte [edx + 0x38], 0x20
je 0x300274e7
push esi
push esi
push esi
push 0x3000387c
push eax
push dword [ebp + 0x78]
push ecx
call fcn.30026cf6
jmp 0x30027c1c
push 0x10
call fcn.3005410d
cmp eax, esi
pop ecx
je 0x30027507
mov word [eax], si
mov word [eax + 2], si
mov word [eax + 4], 0x10
mov dword [eax + 0xc], esi
mov ebx, eax
jmp 0x30027509
xor ebx, ebx
cmp ebx, esi
je 0x30027a4f
push 2
push 0x14
push 0x14
push ebx
call fcn.3005582e
test eax, eax
je 0x30027a4f
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x3009a790]
mov eax, dword [eax + 0x28]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x5c], eax
jmp 0x300275d2
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x10]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp + 0x54], eax
je 0x3002757b
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x5c], eax
jmp 0x300275c1
cmp dword [ebp], 0x1000
jne 0x300275c1
cmp dword [ebp + 4], 4
je 0x30027590
cmp dword [ebp + 4], 0x40
jne 0x300275c1
cmp dword [ebp + 8], 0x20000
jne 0x300275c1
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jae 0x300275c1
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cdq
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
mov dword [ebp + 0x40], edx
mov dword [ebp + 0x44], ecx
call fcn.300559ab
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
ja 0x300275cc
mov eax, dword [ebp - 4]
add dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0x30]
jb 0x30027545
push esi
lea eax, [ebp + 0x34]
push eax
push esi
push 4
push dword [0x3009ac5c]
call fcn.30044c67
mov edx, dword [ebp + 0x34]
cmp edx, esi
je 0x30027a4f
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x3002775b
mov dword [ebp + 0x50], esi
cmp word [ebx], si
mov eax, dword [ebp + 0x50]
lea ecx, [eax + edx + 4]
mov dword [ebp + 0x5c], ecx
mov dword [ebp + 0x68], esi
jbe 0x30027749
mov dword [ebp + 0x60], esi
jmp 0x30027625
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 0x60]
mov edi, dword [ecx]
add esi, eax
mov eax, dword [esi + 4]
mov dword [ebp + 0x28], edi
mov edi, dword [ecx + 4]
cmp eax, edi
mov dword [ebp + 0x2c], edi
ja 0x30027674
jb 0x30027648
mov eax, dword [esi]
cmp eax, dword [ebp + 0x28]
ja 0x30027674
mov edi, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
and dword [ebp + 0x24], 0
add eax, edi
mov edi, dword [eax + 8]
mov dword [ebp + 0x20], edi
add edi, dword [eax]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp + 0x24]
adc edi, dword [eax + 4]
cmp dword [ebp + 0x2c], edi
jb 0x300276ab
ja 0x30027674
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x28], eax
jb 0x300276ab
mov eax, dword [ebp + 0x2c]
cmp eax, dword [esi + 4]
ja 0x30027930
jb 0x3002768d
mov eax, dword [esi]
cmp dword [ebp + 0x28], eax
ja 0x30027930
mov ecx, dword [ecx + 8]
xor eax, eax
add ecx, dword [ebp + 0x28]
adc eax, dword [ebp + 0x2c]
cmp dword [esi + 4], eax
ja 0x30027930
jb 0x300276ab
cmp dword [esi], ecx
jae 0x30027930
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30055b25
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x5c]
cmp ecx, dword [eax + 4]
ja 0x300276fc
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x300276d3
cmp edx, dword [esi]
jae 0x30027702
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300559ab
cmp eax, 0xffffffff
je 0x30027a4f
mov esi, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30027738
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.300559ab
cmp eax, 0xffffffff
je 0x30027a4f
mov edx, dword [ebp + 0x34]
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x30027622
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x30027607
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x30027902
mov dword [ebp + 0x50], esi
mov eax, dword [ebp + 0x50]
lea eax, [eax + edx + 4]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x5c], eax
push 4
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
add eax, 0x3c
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300278e0
cmp dword [ebp + 0x54], 4
jne 0x300278e0
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
push 0xf8
lea ecx, [ebp - 0x134]
push ecx
push eax
push dword [ebp + 0x38]
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300278e0
cmp dword [ebp + 0x54], 0xf8
jne 0x300278e0
cmp dword [ebp - 0x134], 0x4550
jne 0x300278e0
cmp word [ebp - 0x12e], si
jbe 0x300278e0
movzx edi, word [ebp - 0x12e]
imul edi, edi, 0x28
cmp dword [ebp + 0x4c], edi
mov dword [ebp + 0x60], edi
jae 0x30027833
cmp dword [ebp + 0x58], esi
je 0x3002781a
push dword [ebp + 0x58]
call fcn.30053fa1
push 0x106
push edi
mov dword [ebp + 0x4c], edi
call fcn.3005408c
cmp eax, esi
mov dword [ebp + 0x58], eax
je 0x30027902
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x58]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [ebp + 0x54], esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movzx eax, word [ebp - 0x120]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax + 0x18]
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300278e0
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x54], eax
jne 0x300278e0
cmp word [ebp - 0x12e], si
mov dword [ebp + 0x68], esi
jbe 0x300278e0
mov eax, dword [ebp + 0x58]
add eax, 0x24
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
test eax, eax
jns 0x300278cd
test eax, 0x40000000
je 0x300278cd
test al, 0xc0
je 0x300278cd
mov edx, dword [ebp + 0x5c]
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x3c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300559ab
add dword [ebp + 0x60], 0x28
movzx eax, word [ebp - 0x12e]
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], eax
jl 0x3002788f
inc dword [ebp + 0x64]
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x30027769
cmp dword [ebp + 0x58], esi
je 0x30027902
push dword [ebp + 0x58]
call fcn.30053fa1
push esi
lea eax, [ebp + 0x30]
push eax
push esi
push 5
push dword [0x3009ac5c]
call fcn.30044c67
mov eax, dword [ebp + 0x30]
cmp eax, esi
je 0x30027a4f
cmp dword [eax], esi
mov dword [ebp + 0x64], esi
jbe 0x30027ab8
mov dword [ebp + 0x4c], esi
jmp 0x3002793f
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
jmp 0x3002773b
mov eax, dword [ebp + 0x30]
cmp word [ebx], si
mov ecx, dword [ebp + 0x4c]
lea eax, [ecx + eax + 4]
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x68], esi
jbe 0x30027aa3
mov dword [ebp + 0x60], esi
jmp 0x3002795d
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x60]
mov edi, dword [eax + 4]
lea esi, [ecx + edx]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0x20], edx
ja 0x3002798f
jb 0x3002797b
cmp edx, ecx
ja 0x3002798f
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x300279ca
ja 0x3002798f
cmp dword [esi], eax
jb 0x300279ca
cmp dword [esi + 4], edi
ja 0x30027a8e
jb 0x300279a5
mov eax, dword [ebp + 0x20]
cmp dword [esi], eax
ja 0x30027a8e
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30027a8e
jb 0x300279ca
cmp dword [ebp + 0x20], ecx
jae 0x30027a8e
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30055b25
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x58]
cmp ecx, dword [eax + 4]
ja 0x30027a17
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x300279f2
cmp edx, dword [esi]
jae 0x30027a1d
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.300559ab
cmp eax, 0xffffffff
je 0x30027a4f
mov esi, dword [ebp + 0x58]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30027a95
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.300559ab
cmp eax, 0xffffffff
jne 0x30027a95
mov esi, dword [ebp + 0x7c]
push esi
call fcn.300221a9
mov edi, dword [ebp + 0x74]
cmp word [edi], 0
je 0x30027a67
push edi
call fcn.300221e7
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x30027a87
mov ecx, ebx
call fcn.300549b5
push ebx
call fcn.30054073
pop ecx
xor eax, eax
jmp 0x30027c1c
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x3002795a
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x64]
add dword [ebp + 0x4c], 0x10
cmp ecx, dword [eax]
jb 0x3002793c
mov ax, word [ebx]
cmp ax, si
jbe 0x30027a4f
movzx eax, ax
mov edi, eax
shl edi, 4
add edi, 4
cmp eax, esi
mov dword [ebp + 0x64], esi
jle 0x30027af0
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
movzx edx, word [ebx]
inc dword [ebp + 0x64]
add ecx, 0x10
cmp dword [ebp + 0x64], edx
jl 0x30027ad7
call fcn.300269e8
test eax, eax
je 0x30027a4f
push esi
push 0xc0000000
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0x3000387c
push 0x3009b0c8
push dword [ebp + 0x7c]
call fcn.3002226a
test eax, eax
je 0x30027a4f
mov eax, dword [ebp + 0x7c]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 4], eax
je 0x30027a4f
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 8], eax
je 0x30027a4f
mov dword [ecx + 0xc], edi
movzx ecx, word [ebx]
mov dword [eax], ecx
add eax, 4
cmp word [ebx], si
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x64], esi
jbe 0x30027bae
mov ecx, dword [ebx + 4]
mov eax, 0xffff
and ecx, eax
and dword [ebp + 0x78], 0
mov esi, dword [ebx + 0xc]
add esi, dword [ebp + 0x78]
mov edi, dword [ebp + 0x68]
mov edx, ecx
add dword [ebp + 0x78], 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
movzx edx, word [ebx]
and ecx, eax
add dword [ebp + 0x68], ecx
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], edx
jl 0x30027b80
xor edi, edi
cmp word [ebx], di
jbe 0x30027c0b
xor esi, esi
and dword [ebp + 0x54], 0
mov eax, dword [ebx + 0xc]
lea ecx, [ebp + 0x54]
push ecx
add eax, esi
push dword [eax + 8]
push dword [ebp + 0x68]
push dword [eax]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30027beb
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0x54]
cmp ecx, dword [eax + esi + 8]
jne 0x30027a4f
jmp 0x30027bf6
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax + 8]
and dword [eax + esi + 0xc], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi + 8]
add dword [ebp + 0x68], eax
movzx eax, word [ebx]
inc edi
add esi, 0x10
cmp edi, eax
jl 0x30027bb7
mov ecx, ebx
call fcn.300549b5
push ebx
call fcn.30054073
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc