Function at 0x300029b0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
xor esi, esi
xor ebx, ebx
test edi, edi
je 0x30002b1a
cmp dword [0x302728c4], ebx
jne 0x30002a4a
pushfd
mov eax, dword fs:[0x18]
pop dword [ebp - 0xc]
test eax, eax
jne 0x300029f0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0xffffffff
jmp 0x300029ff
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0xbf4]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
push 0x68
push 8
push dword [0x30271450]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword fs:[0x18]
test edx, edx
je 0x30002a32
mov ecx, dword [ebp - 4]
mov dword [edx + 0x34], ecx
mov ecx, dword [ebp - 8]
mov dword [edx + 0xbf4], ecx
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x30002a32
push ecx
popfd
test eax, eax
jne 0x30002a45
push str.CreateTrackedRegion:_failed_to_allocate_memory_for_initial_tracked_region_list._n
call fcn.30009b00
add esp, 4
jmp 0x30002a4a
mov dword [0x302728c4], eax
mov eax, dword [0x302728c4]
test eax, eax
je 0x30002a70
mov ebx, eax
inc esi
mov eax, dword [eax + 0x60]
test eax, eax
jne 0x30002a53
cmp esi, 0x64
jbe 0x30002a70
push esi
push str.AddTrackedRegion:_DEBUG_Warning___number_of_tracked_regions__d._n
call fcn.30009b00
add esp, 8
mov ecx, dword [0x302728a4]
test ecx, ecx
jne 0x30002aa6
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x302728a4]
test ecx, ecx
jne 0x30002aa6
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
mov ecx, dword [0x302728a4]
add esp, 4
xor esi, esi
jmp 0x30002ab1
xor edx, edx
mov eax, edi
div ecx
mov esi, eax
imul esi, ecx
mov eax, dword [0x302728c4]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x30002ace
push str.GetPageAddress:_Error___Supplied_address_zero._n
call fcn.30009b00
add esp, 4
xor eax, eax
jmp 0x30002b02
test ecx, ecx
jne 0x30002afb
push 0x302728a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [0x302728a4]
test ecx, ecx
jne 0x30002af8
push str.GetPageAddress:_Failed_to_obtain_system_page_size._n
call fcn.30009b20
add esp, 4
xor eax, eax
jmp 0x30002b02
mov eax, dword [ebp - 0xc]
xor edx, edx
div ecx
imul eax, ecx
cmp esi, eax
jne 0x30002b23
push dword [0x302728c4]
push edi
push str.AddTrackedRegion:_Warning___attempting_to_track_the_page__0x_p__containing_the_tracked_region_list_at_0x_p._n
call fcn.30009b00
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.30002930
mov esi, eax
test esi, esi
jne 0x30002b5e
test ebx, ebx
je 0x30002b5e
lea edx, [eax + 1]
lea ecx, [eax + 0x68]
call fcn.300011a0
mov esi, eax
mov dword [ebx + 0x60], esi
test esi, esi
jne 0x30002b5e
push str.AddTrackedRegion:_Failed_to_allocate_new_tracked_region_struct._n
call fcn.30009b00
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1c
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x30002b86
push edi
push str.AddTrackedRegion:_unable_to_query_memory_region_0x_p
call fcn.30009b20
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
mov dword [esi], ecx
cmp edi, ecx
je 0x30002b92
mov dword [esi + 4], edi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x30002b9c
mov dword [esi + 0x1c], eax
call fcn.30004110
mov dword [esi + 0x34], eax
test eax, eax
je 0x30002bce
mov ecx, dword [esi]
call fcn.30003600
mov ecx, dword [esi]
fstp qword [esi + 0x38]
call fcn.30003d30
mov dword [esi + 0x40], eax
test eax, eax
je 0x30002bce
push eax
push str.AddTrackedRegion:_Min_PE_size_0x_x
call fcn.30009b00
add esp, 8
mov ecx, edi
call fcn.30002350
mov ecx, eax
mov eax, dword [0x3026d758]
test eax, eax
je 0x30002c00
cmp dword [eax + 4], ecx
je 0x30002bf4
mov eax, dword [eax]
test eax, eax
jne 0x30002be0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xc
je 0x30002c00
mov dword [esi + 0x28], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret