Function at 0x3002750f
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1a0
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x74]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x3009c728], esi
push edi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x4c], esi
jne 0x30027ad9
mov edx, dword [0x3009a790]
test byte [edx + 0x38], 0x20
je 0x30027571
push esi
push esi
push esi
push 0x3000387c
push eax
push dword [ebp + 0x78]
push ecx
call fcn.30026d80
jmp 0x30027ca6
push 0x10
call fcn.300542cd
cmp eax, esi
pop ecx
je 0x30027591
mov word [eax], si
mov word [eax + 2], si
mov word [eax + 4], 0x10
mov dword [eax + 0xc], esi
mov ebx, eax
jmp 0x30027593
xor ebx, ebx
cmp ebx, esi
je 0x30027ad9
push 2
push 0x14
push 0x14
push ebx
call fcn.300559ee
test eax, eax
je 0x30027ad9
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x3009a790]
mov eax, dword [eax + 0x28]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x5c], eax
jmp 0x3002765c
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x10]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp + 0x54], eax
je 0x30027605
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x5c], eax
jmp 0x3002764b
cmp dword [ebp], 0x1000
jne 0x3002764b
cmp dword [ebp + 4], 4
je 0x3002761a
cmp dword [ebp + 4], 0x40
jne 0x3002764b
cmp dword [ebp + 8], 0x20000
jne 0x3002764b
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jae 0x3002764b
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cdq
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
mov dword [ebp + 0x40], edx
mov dword [ebp + 0x44], ecx
call fcn.30055b6b
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
ja 0x30027656
mov eax, dword [ebp - 4]
add dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0x30]
jb 0x300275cf
push esi
lea eax, [ebp + 0x34]
push eax
push esi
push 4
push dword [0x3009ac5c]
call fcn.30044e27
mov edx, dword [ebp + 0x34]
cmp edx, esi
je 0x30027ad9
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x300277e5
mov dword [ebp + 0x50], esi
cmp word [ebx], si
mov eax, dword [ebp + 0x50]
lea ecx, [eax + edx + 4]
mov dword [ebp + 0x5c], ecx
mov dword [ebp + 0x68], esi
jbe 0x300277d3
mov dword [ebp + 0x60], esi
jmp 0x300276af
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 0x60]
mov edi, dword [ecx]
add esi, eax
mov eax, dword [esi + 4]
mov dword [ebp + 0x28], edi
mov edi, dword [ecx + 4]
cmp eax, edi
mov dword [ebp + 0x2c], edi
ja 0x300276fe
jb 0x300276d2
mov eax, dword [esi]
cmp eax, dword [ebp + 0x28]
ja 0x300276fe
mov edi, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
and dword [ebp + 0x24], 0
add eax, edi
mov edi, dword [eax + 8]
mov dword [ebp + 0x20], edi
add edi, dword [eax]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp + 0x24]
adc edi, dword [eax + 4]
cmp dword [ebp + 0x2c], edi
jb 0x30027735
ja 0x300276fe
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x28], eax
jb 0x30027735
mov eax, dword [ebp + 0x2c]
cmp eax, dword [esi + 4]
ja 0x300279ba
jb 0x30027717
mov eax, dword [esi]
cmp dword [ebp + 0x28], eax
ja 0x300279ba
mov ecx, dword [ecx + 8]
xor eax, eax
add ecx, dword [ebp + 0x28]
adc eax, dword [ebp + 0x2c]
cmp dword [esi + 4], eax
ja 0x300279ba
jb 0x30027735
cmp dword [esi], ecx
jae 0x300279ba
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30055ce5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x5c]
cmp ecx, dword [eax + 4]
ja 0x30027786
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x3002775d
cmp edx, dword [esi]
jae 0x3002778c
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30055b6b
cmp eax, 0xffffffff
je 0x30027ad9
mov esi, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x300277c2
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.30055b6b
cmp eax, 0xffffffff
je 0x30027ad9
mov edx, dword [ebp + 0x34]
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x300276ac
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x30027691
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x3002798c
mov dword [ebp + 0x50], esi
mov eax, dword [ebp + 0x50]
lea eax, [eax + edx + 4]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x5c], eax
push 4
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
add eax, 0x3c
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3002796a
cmp dword [ebp + 0x54], 4
jne 0x3002796a
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
push 0xf8
lea ecx, [ebp - 0x134]
push ecx
push eax
push dword [ebp + 0x38]
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3002796a
cmp dword [ebp + 0x54], 0xf8
jne 0x3002796a
cmp dword [ebp - 0x134], 0x4550
jne 0x3002796a
cmp word [ebp - 0x12e], si
jbe 0x3002796a
movzx edi, word [ebp - 0x12e]
imul edi, edi, 0x28
cmp dword [ebp + 0x4c], edi
mov dword [ebp + 0x60], edi
jae 0x300278bd
cmp dword [ebp + 0x58], esi
je 0x300278a4
push dword [ebp + 0x58]
call fcn.30054161
push 0x106
push edi
mov dword [ebp + 0x4c], edi
call fcn.3005424c
cmp eax, esi
mov dword [ebp + 0x58], eax
je 0x3002798c
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x58]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [ebp + 0x54], esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movzx eax, word [ebp - 0x120]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax + 0x18]
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x3002796a
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x54], eax
jne 0x3002796a
cmp word [ebp - 0x12e], si
mov dword [ebp + 0x68], esi
jbe 0x3002796a
mov eax, dword [ebp + 0x58]
add eax, 0x24
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
test eax, eax
jns 0x30027957
test eax, 0x40000000
je 0x30027957
test al, 0xc0
je 0x30027957
mov edx, dword [ebp + 0x5c]
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x3c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30055b6b
add dword [ebp + 0x60], 0x28
movzx eax, word [ebp - 0x12e]
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], eax
jl 0x30027919
inc dword [ebp + 0x64]
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x300277f3
cmp dword [ebp + 0x58], esi
je 0x3002798c
push dword [ebp + 0x58]
call fcn.30054161
push esi
lea eax, [ebp + 0x30]
push eax
push esi
push 5
push dword [0x3009ac5c]
call fcn.30044e27
mov eax, dword [ebp + 0x30]
cmp eax, esi
je 0x30027ad9
cmp dword [eax], esi
mov dword [ebp + 0x64], esi
jbe 0x30027b42
mov dword [ebp + 0x4c], esi
jmp 0x300279c9
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
jmp 0x300277c5
mov eax, dword [ebp + 0x30]
cmp word [ebx], si
mov ecx, dword [ebp + 0x4c]
lea eax, [ecx + eax + 4]
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x68], esi
jbe 0x30027b2d
mov dword [ebp + 0x60], esi
jmp 0x300279e7
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x60]
mov edi, dword [eax + 4]
lea esi, [ecx + edx]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0x20], edx
ja 0x30027a19
jb 0x30027a05
cmp edx, ecx
ja 0x30027a19
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30027a54
ja 0x30027a19
cmp dword [esi], eax
jb 0x30027a54
cmp dword [esi + 4], edi
ja 0x30027b18
jb 0x30027a2f
mov eax, dword [ebp + 0x20]
cmp dword [esi], eax
ja 0x30027b18
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x30027b18
jb 0x30027a54
cmp dword [ebp + 0x20], ecx
jae 0x30027b18
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30055ce5
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x58]
cmp ecx, dword [eax + 4]
ja 0x30027aa1
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x30027a7c
cmp edx, dword [esi]
jae 0x30027aa7
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30055b6b
cmp eax, 0xffffffff
je 0x30027ad9
mov esi, dword [ebp + 0x58]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30027b1f
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.30055b6b
cmp eax, 0xffffffff
jne 0x30027b1f
mov esi, dword [ebp + 0x7c]
push esi
call fcn.300221bb
mov edi, dword [ebp + 0x74]
cmp word [edi], 0
je 0x30027af1
push edi
call fcn.300221f9
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x30027b11
mov ecx, ebx
call fcn.30054b75
push ebx
call fcn.30054233
pop ecx
xor eax, eax
jmp 0x30027ca6
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x300279e4
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x64]
add dword [ebp + 0x4c], 0x10
cmp ecx, dword [eax]
jb 0x300279c6
mov ax, word [ebx]
cmp ax, si
jbe 0x30027ad9
movzx eax, ax
mov edi, eax
shl edi, 4
add edi, 4
cmp eax, esi
mov dword [ebp + 0x64], esi
jle 0x30027b7a
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
movzx edx, word [ebx]
inc dword [ebp + 0x64]
add ecx, 0x10
cmp dword [ebp + 0x64], edx
jl 0x30027b61
call fcn.30026a72
test eax, eax
je 0x30027ad9
push esi
push 0xc0000000
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0x3000387c
push 0x3009b0c8
push dword [ebp + 0x7c]
call fcn.3002227c
test eax, eax
je 0x30027ad9
mov eax, dword [ebp + 0x7c]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 4], eax
je 0x30027ad9
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 8], eax
je 0x30027ad9
mov dword [ecx + 0xc], edi
movzx ecx, word [ebx]
mov dword [eax], ecx
add eax, 4
cmp word [ebx], si
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x64], esi
jbe 0x30027c38
mov ecx, dword [ebx + 4]
mov eax, 0xffff
and ecx, eax
and dword [ebp + 0x78], 0
mov esi, dword [ebx + 0xc]
add esi, dword [ebp + 0x78]
mov edi, dword [ebp + 0x68]
mov edx, ecx
add dword [ebp + 0x78], 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
movzx edx, word [ebx]
and ecx, eax
add dword [ebp + 0x68], ecx
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], edx
jl 0x30027c0a
xor edi, edi
cmp word [ebx], di
jbe 0x30027c95
xor esi, esi
and dword [ebp + 0x54], 0
mov eax, dword [ebx + 0xc]
lea ecx, [ebp + 0x54]
push ecx
add eax, esi
push dword [eax + 8]
push dword [ebp + 0x68]
push dword [eax]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30027c75
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0x54]
cmp ecx, dword [eax + esi + 8]
jne 0x30027ad9
jmp 0x30027c80
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax + 8]
and dword [eax + esi + 0xc], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi + 8]
add dword [ebp + 0x68], eax
movzx eax, word [ebx]
inc edi
add esi, 0x10
cmp edi, eax
jl 0x30027c41
mov ecx, ebx
call fcn.30054b75
push ebx
call fcn.30054233
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc