Function at 0x30027354
Capabilities:
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1a0
mov eax, dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x74]
push ebx
push esi
xor esi, esi
mov word [ecx], si
or dword [eax], 0xffffffff
xor ebx, ebx
mov dword [eax + 8], esi
mov dword [eax + 4], esi
cmp dword [0x3009b840], esi
push edi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0x4c], esi
jne 0x3002791e
mov edx, dword [0x300998a8]
test byte [edx + 0x38], 0x20
je 0x300273b6
push esi
push esi
push esi
push 0x3000387c
push eax
push dword [ebp + 0x78]
push ecx
call fcn.30026bc5
jmp 0x30027aeb
push 0x10
call fcn.300534bb
cmp eax, esi
pop ecx
je 0x300273d6
mov word [eax], si
mov word [eax + 2], si
mov word [eax + 4], 0x10
mov dword [eax + 0xc], esi
mov ebx, eax
jmp 0x300273d8
xor ebx, ebx
cmp ebx, esi
je 0x3002791e
push 2
push 0x14
push 0x14
push ebx
call fcn.30054bdc
test eax, eax
je 0x3002791e
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x300998a8]
mov eax, dword [eax + 0x28]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0x5c], eax
jmp 0x300274a1
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x10]
push 0x1c
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
mov dword [ebp + 0x54], eax
je 0x3002744a
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x5c], eax
jmp 0x30027490
cmp dword [ebp], 0x1000
jne 0x30027490
cmp dword [ebp + 4], 4
je 0x3002745f
cmp dword [ebp + 4], 0x40
jne 0x30027490
cmp dword [ebp + 8], 0x20000
jne 0x30027490
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jae 0x30027490
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
cdq
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
mov dword [ebp + 0x40], edx
mov dword [ebp + 0x44], ecx
call fcn.30054d59
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 4]
ja 0x3002749b
mov eax, dword [ebp - 4]
add dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x5c]
cmp eax, dword [ebp - 0x30]
jb 0x30027414
push esi
lea eax, [ebp + 0x34]
push eax
push esi
push 4
push dword [0x30099d74]
call fcn.3004402a
mov edx, dword [ebp + 0x34]
cmp edx, esi
je 0x3002791e
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x3002762a
mov dword [ebp + 0x50], esi
cmp word [ebx], si
mov eax, dword [ebp + 0x50]
lea ecx, [eax + edx + 4]
mov dword [ebp + 0x5c], ecx
mov dword [ebp + 0x68], esi
jbe 0x30027618
mov dword [ebp + 0x60], esi
jmp 0x300274f4
mov ecx, dword [ebp + 0x5c]
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 0x60]
mov edi, dword [ecx]
add esi, eax
mov eax, dword [esi + 4]
mov dword [ebp + 0x28], edi
mov edi, dword [ecx + 4]
cmp eax, edi
mov dword [ebp + 0x2c], edi
ja 0x30027543
jb 0x30027517
mov eax, dword [esi]
cmp eax, dword [ebp + 0x28]
ja 0x30027543
mov edi, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
and dword [ebp + 0x24], 0
add eax, edi
mov edi, dword [eax + 8]
mov dword [ebp + 0x20], edi
add edi, dword [eax]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp + 0x24]
adc edi, dword [eax + 4]
cmp dword [ebp + 0x2c], edi
jb 0x3002757a
ja 0x30027543
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x28], eax
jb 0x3002757a
mov eax, dword [ebp + 0x2c]
cmp eax, dword [esi + 4]
ja 0x300277ff
jb 0x3002755c
mov eax, dword [esi]
cmp dword [ebp + 0x28], eax
ja 0x300277ff
mov ecx, dword [ecx + 8]
xor eax, eax
add ecx, dword [ebp + 0x28]
adc eax, dword [ebp + 0x2c]
cmp dword [esi + 4], eax
ja 0x300277ff
jb 0x3002757a
cmp dword [esi], ecx
jae 0x300277ff
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30054ed3
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x5c]
cmp ecx, dword [eax + 4]
ja 0x300275cb
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x300275a2
cmp edx, dword [esi]
jae 0x300275d1
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30054d59
cmp eax, 0xffffffff
je 0x3002791e
mov esi, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30027607
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.30054d59
cmp eax, 0xffffffff
je 0x3002791e
mov edx, dword [ebp + 0x34]
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x300274f1
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x300274d6
cmp dword [edx], esi
mov dword [ebp + 0x64], esi
jbe 0x300277d1
mov dword [ebp + 0x50], esi
mov eax, dword [ebp + 0x50]
lea eax, [eax + edx + 4]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x5c], eax
push 4
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
lea ecx, [ebp + 0xc]
push ecx
add eax, 0x3c
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300277af
cmp dword [ebp + 0x54], 4
jne 0x300277af
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp + 0x54]
push ecx
mov dword [ebp + 0x54], esi
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
push 0xf8
lea ecx, [ebp - 0x134]
push ecx
push eax
push dword [ebp + 0x38]
mov dword [ebp + 0x68], eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300277af
cmp dword [ebp + 0x54], 0xf8
jne 0x300277af
cmp dword [ebp - 0x134], 0x4550
jne 0x300277af
cmp word [ebp - 0x12e], si
jbe 0x300277af
movzx edi, word [ebp - 0x12e]
imul edi, edi, 0x28
cmp dword [ebp + 0x4c], edi
mov dword [ebp + 0x60], edi
jae 0x30027702
cmp dword [ebp + 0x58], esi
je 0x300276e9
push dword [ebp + 0x58]
call fcn.30053354
push 0x106
push edi
mov dword [ebp + 0x4c], edi
call fcn.3005343f
cmp eax, esi
mov dword [ebp + 0x58], eax
je 0x300277d1
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x58]
mov edx, ecx
shr ecx, 2
xor eax, eax
mov dword [ebp + 0x54], esi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
movzx eax, word [ebp - 0x120]
mov ecx, dword [ebp + 0x68]
lea eax, [ecx + eax + 0x18]
lea ecx, [ebp + 0x54]
push ecx
push dword [ebp + 0x60]
push dword [ebp + 0x58]
push eax
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x300277af
mov eax, dword [ebp + 0x60]
cmp dword [ebp + 0x54], eax
jne 0x300277af
cmp word [ebp - 0x12e], si
mov dword [ebp + 0x68], esi
jbe 0x300277af
mov eax, dword [ebp + 0x58]
add eax, 0x24
mov dword [ebp + 0x60], eax
mov eax, dword [ebp + 0x60]
mov eax, dword [eax]
test eax, eax
jns 0x3002779c
test eax, 0x40000000
je 0x3002779c
test al, 0xc0
je 0x3002779c
mov edx, dword [ebp + 0x5c]
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x60]
mov ecx, dword [eax - 0x18]
add ecx, dword [edx]
mov dword [ebp + 0x40], esi
mov dword [ebp + 0x3c], ecx
mov eax, dword [eax - 0x1c]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30054d59
add dword [ebp + 0x60], 0x28
movzx eax, word [ebp - 0x12e]
inc dword [ebp + 0x68]
cmp dword [ebp + 0x68], eax
jl 0x3002775e
inc dword [ebp + 0x64]
mov edx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x64]
add dword [ebp + 0x50], 0x6c
cmp eax, dword [edx]
jb 0x30027638
cmp dword [ebp + 0x58], esi
je 0x300277d1
push dword [ebp + 0x58]
call fcn.30053354
push esi
lea eax, [ebp + 0x30]
push eax
push esi
push 5
push dword [0x30099d74]
call fcn.3004402a
mov eax, dword [ebp + 0x30]
cmp eax, esi
je 0x3002791e
cmp dword [eax], esi
mov dword [ebp + 0x64], esi
jbe 0x30027987
mov dword [ebp + 0x4c], esi
jmp 0x3002780e
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
jmp 0x3002760a
mov eax, dword [ebp + 0x30]
cmp word [ebx], si
mov ecx, dword [ebp + 0x4c]
lea eax, [ecx + eax + 4]
mov dword [ebp + 0x58], eax
mov dword [ebp + 0x68], esi
jbe 0x30027972
mov dword [ebp + 0x60], esi
jmp 0x3002782c
mov eax, dword [ebp + 0x58]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp + 0x60]
mov edi, dword [eax + 4]
lea esi, [ecx + edx]
cmp edi, dword [esi + 4]
mov edx, dword [eax]
mov ecx, dword [esi]
mov dword [ebp + 0x20], edx
ja 0x3002785e
jb 0x3002784a
cmp edx, ecx
ja 0x3002785e
mov eax, dword [eax + 8]
xor ecx, ecx
add eax, edx
adc ecx, edi
cmp dword [esi + 4], ecx
jb 0x30027899
ja 0x3002785e
cmp dword [esi], eax
jb 0x30027899
cmp dword [esi + 4], edi
ja 0x3002795d
jb 0x30027874
mov eax, dword [ebp + 0x20]
cmp dword [esi], eax
ja 0x3002795d
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov ecx, dword [eax + 8]
xor edx, edx
add ecx, dword [eax]
adc edx, dword [eax + 4]
cmp edi, edx
ja 0x3002795d
jb 0x30027899
cmp dword [ebp + 0x20], ecx
jae 0x3002795d
lea edi, [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 1
push dword [ebp + 0x68]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.30054ed3
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x58]
cmp ecx, dword [eax + 4]
ja 0x300278e6
mov edx, dword [ebp + 0x10]
mov esi, eax
jb 0x300278c1
cmp edx, dword [esi]
jae 0x300278ec
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp + 0x3c], edx
mov dword [ebp + 0x40], ecx
mov eax, dword [esi]
sub eax, edx
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x3c]
push eax
push ebx
call fcn.30054d59
cmp eax, 0xffffffff
je 0x3002791e
mov esi, dword [ebp + 0x58]
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x18]
add ecx, dword [esi]
add edx, eax
cmp edx, ecx
jbe 0x30027964
xor eax, eax
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp + 0x40], 0
lea eax, [ebp + 0x3c]
push eax
sub edx, ecx
push ebx
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x44], edx
call fcn.30054d59
cmp eax, 0xffffffff
jne 0x30027964
mov esi, dword [ebp + 0x7c]
push esi
call fcn.30022093
mov edi, dword [ebp + 0x74]
cmp word [edi], 0
je 0x30027936
push edi
call fcn.300220d1
or dword [esi], 0xffffffff
xor eax, eax
cmp ebx, eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov word [edi], ax
je 0x30027956
mov ecx, ebx
call fcn.30053d63
push ebx
call fcn.30053426
pop ecx
xor eax, eax
jmp 0x30027aeb
inc dword [ebp + 0x68]
add dword [ebp + 0x60], 0x10
movzx eax, word [ebx]
cmp dword [ebp + 0x68], eax
jl 0x30027829
xor esi, esi
inc dword [ebp + 0x64]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x64]
add dword [ebp + 0x4c], 0x10
cmp ecx, dword [eax]
jb 0x3002780b
mov ax, word [ebx]
cmp ax, si
jbe 0x3002791e
movzx eax, ax
mov edi, eax
shl edi, 4
add edi, 4
cmp eax, esi
mov dword [ebp + 0x64], esi
jle 0x300279bf
mov eax, dword [ebx + 0xc]
xor ecx, ecx
mov dword [eax + ecx + 0xc], edi
mov eax, dword [ebx + 0xc]
add edi, dword [eax + ecx + 8]
movzx edx, word [ebx]
inc dword [ebp + 0x64]
add ecx, 0x10
cmp dword [ebp + 0x64], edx
jl 0x300279a6
call fcn.300268c0
test eax, eax
je 0x3002791e
push esi
push 0xc0000000
push dword [ebp + 0x78]
push dword [ebp + 0x74]
push 0x3000387c
push str.C:DOCUME1TommyLOCALS1Temp
push dword [ebp + 0x7c]
call fcn.30022154
test eax, eax
je 0x3002791e
mov eax, dword [ebp + 0x7c]
push esi
push edi
push esi
push 4
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 4], eax
je 0x3002791e
push esi
push esi
push esi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov ecx, dword [ebp + 0x7c]
mov dword [ecx + 8], eax
je 0x3002791e
mov dword [ecx + 0xc], edi
movzx ecx, word [ebx]
mov dword [eax], ecx
add eax, 4
cmp word [ebx], si
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x64], esi
jbe 0x30027a7d
mov ecx, dword [ebx + 4]
mov eax, 0xffff
and ecx, eax
and dword [ebp + 0x78], 0
mov esi, dword [ebx + 0xc]
add esi, dword [ebp + 0x78]
mov edi, dword [ebp + 0x68]
mov edx, ecx
add dword [ebp + 0x78], 0x10
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 4]
movzx edx, word [ebx]
and ecx, eax
add dword [ebp + 0x68], ecx
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], edx
jl 0x30027a4f
xor edi, edi
cmp word [ebx], di
jbe 0x30027ada
xor esi, esi
and dword [ebp + 0x54], 0
mov eax, dword [ebx + 0xc]
lea ecx, [ebp + 0x54]
push ecx
add eax, esi
push dword [eax + 8]
push dword [ebp + 0x68]
push dword [eax]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x30027aba
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0x54]
cmp ecx, dword [eax + esi + 8]
jne 0x3002791e
jmp 0x30027ac5
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax + 8]
and dword [eax + esi + 0xc], 0
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + esi + 8]
add dword [ebp + 0x68], eax
movzx eax, word [ebx]
inc edi
add esi, 0x10
cmp edi, eax
jl 0x30027a86
mov ecx, ebx
call fcn.30053d63
push ebx
call fcn.30053426
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc