Function at 0x48ef70
Capabilities:
Get system information on windows

Disassembly:
mov edx, dword [0x5e2be8]
sub esp, 0x64
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
jne 0x48efa7
push 0x5000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov ecx, 0x400
xor eax, eax
mov dword [0x5e2be8], edi
rep stosd dword es:[edi], eax
mov edx, dword [0x5e2be8]
mov edi, dword [esp + 0x7c]
xor esi, esi
mov eax, edx
cmp dword [eax], edi
je 0x48f015
inc esi
add eax, 0x14
cmp esi, 0x400
jl 0x48efaf
xor ecx, ecx
mov eax, edx
cmp dword [eax], ebx
je 0x48efe2
inc ecx
add eax, 0x14
cmp ecx, 0x400
jl 0x48efc3
call fcn.0048ef50
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret
lea eax, [ecx + ecx*4]
mov esi, ecx
shl eax, 2
mov dword [eax + edx], edi
mov edx, dword [0x5e2be8]
mov dword [eax + edx + 4], ebx
mov edx, dword [0x5e2be8]
mov dword [eax + edx + 8], ebx
mov edx, dword [0x5e2be8]
mov dword [eax + edx + 0xc], ebx
mov edx, dword [0x5e2be8]
mov dword [eax + edx + 0x10], ebx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x44]
push edx
mov edx, dword [esp + 0x80]
lea ecx, [esp + 0x50]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x48f197
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x64]
lea ecx, [esp + 0x20]
push ecx
call fcn.0048f1b0
mov ebp, edx
lea edx, [esp + 0x2c]
push edx
mov ebx, eax
call fcn.0048f1b0
add esp, 8
add ebx, eax
mov eax, edi
adc ebp, edx
cdq
push edx
push eax
push ebp
push ebx
call fcn.004d2f20
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x18], edx
call fcn.0048f1b0
lea esi, [esi + esi*4]
mov dword [esp + 0x20], edx
mov edx, dword [0x5e2be8]
mov ebx, eax
shl esi, 2
add esp, 4
mov dword [esp + 0x18], ebx
mov ecx, dword [esi + edx + 4]
mov eax, dword [esi + edx + 8]
lea edi, [esi + edx + 4]
mov ebp, ecx
or ebp, eax
je 0x48f173
mov ebp, dword [esi + edx + 0xc]
mov edx, dword [esi + edx + 0x10]
mov dword [esp + 0x38], ebp
or ebp, edx
je 0x48f173
mov ebp, dword [esp + 0x38]
sub ebx, ebp
mov ebp, dword [esp + 0x1c]
sbb ebp, edx
mov edx, ebx
or edx, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebp
je 0x48f197
mov edx, dword [esp + 0x10]
push 0
sub edx, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, eax
push 0x64
push ecx
push edx
call fcn.004d3070
push 0
push 2
mov ecx, eax
push ebp
push ebx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], edx
call fcn.004d2fc0
mov ecx, dword [esp + 0x7c]
add ecx, eax
mov eax, dword [esp + 0x78]
adc eax, edx
mov edx, ebp
push edx
mov edx, ebx
push edx
push eax
push ecx
call fcn.004d2fc0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, dword [0x5e2be8]
mov edx, dword [esp + 0x18]
pop edi
mov dword [esi + ecx + 0xc], edx
mov ecx, dword [0x5e2be8]
mov edx, dword [esp + 0x18]
mov dword [esi + ecx + 0x10], edx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edx, dword [0x5e2be8]
mov ecx, dword [esp + 0x1c]
mov dword [esi + edx + 0xc], ebx
mov eax, dword [0x5e2be8]
mov dword [esi + eax + 0x10], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret