Function at 0x30002e80
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x3021be88]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x300030ef
mov esi, dword [edi]
test esi, esi
je 0x300030ef
cmp esi, dword [0x302738e4]
je 0x300030ea
cmp esi, dword [0x3026d3e8]
je 0x300030ea
cmp dword [edi + 0x2c], 0
jne 0x30002ee2
cmp dword [edi + 4], 0
jne 0x30002ee2
cmp dword [0x3026d3c0], 0
jne 0x300030ef
mov ecx, esi
call fcn.30002410
mov edx, eax
mov ecx, esi
call fcn.30003a30
mov dword [esp + 0xc], eax
test eax, eax
jne 0x30002f17
mov ecx, dword [edi + 4]
call fcn.30003b90
mov esi, eax
mov ecx, esi
call fcn.30002410
mov dword [esp + 0xc], eax
test eax, eax
je 0x300030ef
cmp dword [edi + 4], 0
je 0x30002f33
mov eax, dword [0x3026e818]
mov ecx, dword [edi]
test eax, eax
je 0x30002f33
cmp dword [eax + 4], ecx
je 0x30002f93
mov eax, dword [eax]
test eax, eax
jne 0x30002f28
cmp dword [0x302739a4], 0
jne 0x30002f47
push 0x302739a0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [edi + 0x28], 0
je 0x30002fc4
cmp dword [edi + 0x34], 0
je 0x300030ef
fld qword [edi + 0x38]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x300030ef
mov ecx, esi
call fcn.30003510
fldz
fucomp st(1)
fnstsw ax
test ah, 0x44
jnp 0x30002fc2
fsubr qword [edi + 0x38]
fabs
fcomp qword [0x30212490]
fnstsw ax
test ah, 5
jnp 0x300030ef
jmp 0x30002fc4
add eax, 0xc
je 0x30002f33
push ecx
push str.ProcessTrackedRegion:_.NET_cache_region_at_0x_p_skipped
call fcn.30009b40
add esp, 8
mov dword [edi + 0x28], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
fstp st(0)
cmp dword [0x30270340], 0
mov ebx, dword [0x30272c64]
mov dword [0x30272c64], 0
je 0x30002fe8
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.3001e090
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetMappedFileNameA]
test eax, eax
je 0x3000302c
lea eax, [esp + 0x10]
push eax
push esi
push str.ProcessTrackedRegion:_Region_at_0x_p_mapped_as__s__skipping
call fcn.30009b40
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
mov eax, dword [0x302739d0]
cmp dword [eax + 0x10], 0
jne 0x3000303e
mov dword [eax + 0x10], 9
cmp dword [eax + 0x1c], 0
jne 0x30003047
mov dword [eax + 0x1c], esi
mov ecx, esi
call fcn.30004c60
mov dword [edi + 0x28], eax
push esi
test eax, eax
je 0x300030a7
push str.ProcessTrackedRegion:_Dumped_region_at_0x_p._n
test ebx, ebx
je 0x30003083
call fcn.30009fe0
add esp, 8
mov ecx, edi
call fcn.30002ac0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
call fcn.30009b40
add esp, 8
mov ecx, edi
call fcn.30002ac0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
push str.ProcessTrackedRegion:_Failed_to_dump_region_at_0x_p._n
test ebx, ebx
je 0x300030cd
call fcn.30009fe0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
call fcn.30009b40
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
call fcn.30002cf0
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret