Function at 0x300030c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x30215e88]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x3000336d
mov esi, dword [edi]
test esi, esi
je 0x3000336d
cmp esi, dword [0x3026ec90]
je 0x30003368
cmp esi, dword [0x30267728]
je 0x30003368
cmp dword [edi + 0x2c], 0
jne 0x30003122
cmp dword [edi + 4], 0
jne 0x30003122
cmp dword [0x30267700], 0
jne 0x3000336d
mov ecx, esi
call fcn.30002650
mov edx, eax
mov ecx, esi
call fcn.30003cb0
mov ebx, eax
test ebx, ebx
jne 0x30003153
mov ecx, dword [edi + 4]
call fcn.30003e10
mov esi, eax
mov ecx, esi
call fcn.30002650
mov ebx, eax
test ebx, ebx
je 0x3000336d
cmp dword [edi + 4], 0
je 0x3000316f
mov eax, dword [0x302697b8]
mov ecx, dword [edi]
test eax, eax
je 0x3000316f
cmp dword [eax + 4], ecx
je 0x300031cf
mov eax, dword [eax]
test eax, eax
jne 0x30003164
cmp dword [0x3026ed44], 0
jne 0x30003183
push 0x3026ed40
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [edi + 0x28], 0
je 0x30003200
cmp dword [edi + 0x34], 0
je 0x3000336d
fld qword [edi + 0x38]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x3000336d
mov ecx, esi
call fcn.30003790
fldz
fucomp st(1)
fnstsw ax
test ah, 0x44
jnp 0x300031fe
fsubr qword [edi + 0x38]
fabs
fcomp qword [0x3020c1f0]
fnstsw ax
test ah, 5
jnp 0x3000336d
jmp 0x30003200
add eax, 0xc
je 0x3000316f
push ecx
push str.ProcessTrackedRegion:_.NET_cache_region_at_0x_p_skipped
call fcn.3000a0d0
add esp, 8
mov dword [edi + 0x28], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
fstp st(0)
cmp dword [0x3026b2e8], 0
mov eax, dword [0x3026e004]
mov dword [esp + 0xc], eax
mov dword [0x3026e004], 0
je 0x30003225
mov edx, ebx
mov ecx, esi
call fcn.3001e9f0
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetMappedFileNameW]
mov ebx, eax
test ebx, ebx
je 0x3000324e
mov ecx, esi
call fcn.3004da30
test eax, eax
jne 0x30003265
lea ecx, [esp + 0x10]
call fcn.30002320
mov edx, eax
mov ecx, esi
call fcn.30004660
cmp eax, 1
jne 0x3000328d
lea eax, [esp + 0x10]
push eax
push esi
push str.ProcessTrackedRegion:_Region_at_0x_p_mapped_as__ws__skipping
call fcn.3000a0d0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x300032a4
lea eax, [esp + 0x10]
push eax
push esi
push str.ProcessTrackedRegion:_Code_modification_detected_in_region_at_0x_p_mapped_as__ws__dumping
call fcn.3000a0d0
add esp, 0xc
mov eax, dword [0x3026ed74]
cmp dword [eax + 0x10], 0
jne 0x300032b6
mov dword [eax + 0x10], 9
cmp dword [eax + 0x1c], 0
jne 0x300032bf
mov dword [eax + 0x1c], esi
mov ecx, esi
call fcn.300051e0
mov dword [edi + 0x28], eax
push esi
test eax, eax
je 0x30003322
cmp dword [esp + 0x10], 0
push str.ProcessTrackedRegion:_Dumped_region_at_0x_p._n
je 0x300032fe
call fcn.3000a570
add esp, 8
mov ecx, edi
call fcn.30002d00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
call fcn.3000a0d0
add esp, 8
mov ecx, edi
call fcn.30002d00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x10], 0
push str.ProcessTrackedRegion:_Failed_to_dump_region_at_0x_p._n
je 0x3000334b
call fcn.3000a570
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
call fcn.3000a0d0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
call fcn.30002f30
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret