Function at 0x7104d830
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x18
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1a6]
lea edx, [ebp - 0x238]
push ebx
sub esp, 0x28c
rep stosd dword es:[edi], eax
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x23c]
call sym._get_logical_processor_count
mov edx, dword [ebp - 0x238]
mov ecx, 0x40
mov dword [ebp - 0x268], eax
mov eax, dword [ebp + 8]
call sym._resize_table
test eax, eax
je 0x7104e06a
lea eax, [ebp - 0x144]
mov esi, 0x71062402
call sym._get_processor_manufacturer.constprop.0
lea eax, [ebp - 0xe0]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov dword [ebp - 0x254], eax
call eax
mov edx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0xe0], 9
cmove eax, edx
mov dword [esp + 4], str.32_bit
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [ebp - 0x250], eax
call eax
test eax, eax
jne 0x7104df18
mov eax, 1
xor ecx, ecx
cpuid
mov dword [ebp - 0x1cc], edx
mov edx, eax
mov dword [ebp - 0x1d0], ecx
shr edx, 8
mov ecx, eax
shr ecx, 4
and edx, 0xf
mov dword [ebp - 0x1d4], ebx
and ecx, 0xf
cmp edx, 6
je 0x7104ded0
cmp edx, 0xf
je 0x7104ded0
and eax, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xe0]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 8], str._s_Family__u_Model__u_Stepping__u
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sym._swprintf
mov eax, 1
mov ecx, esi
mov dword [esp + 8], str._08X_08X
cpuid
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1fa]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x11
mov dword [esp], eax
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x140], ebx
call sym._swprintf
lea eax, [ebp - 0x230]
call sym._get_processor_manufacturer.constprop.0
mov eax, 0x80000000
mov ecx, esi
cpuid
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], edx
cmp eax, 0x80000003
ja 0x7104df48
cmp word [ebp - 0x1a6], 0
lea eax, [ebp - 0x1a6]
je 0x7104da11
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x7104d9d8
mov edx, eax
lea edi, [ebp - 0x1a6]
sub edx, edi
sar edx, 1
dec edx
jns 0x7104da0a
jmp 0x7104da11
xor ebx, ebx
sub eax, 2
lea edi, [ebp - 0x1a6]
mov word [eax], bx
cmp edi, eax
je 0x7104da11
cmp word [eax - 2], 0x20
je 0x7104d9f8
mov eax, 1
xor ecx, ecx
cpuid
mov dword [ebp - 0x1d0], ecx
mov ecx, eax
mov dword [ebp - 0x1cc], edx
shr ecx, 8
mov edx, eax
shr edx, 4
and ecx, 0xf
mov dword [ebp - 0x1d4], ebx
and edx, 0xf
cmp ecx, 6
je 0x7104df00
cmp ecx, 0xf
je 0x7104df00
and eax, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x144]
mov dword [esp + 8], str.Model__u_Stepping__u
mov dword [esp + 4], 0x32
mov dword [esp], eax
call sym._swprintf
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x264], eax
test eax, eax
je 0x7104dea0
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x258], 0
sbb eax, eax
mov dword [ebp - 0x264], 0
mov edi, dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x260], 0
inc eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x24c], 0
jmp 0x7104db14
mov eax, dword [ebp - 0x1d4]
or eax, dword [ebp - 0x1d8]
je 0x7104e060
add dword [ebp - 0x260], 0x40
mov ebx, dword [ebp - 0x26c]
inc dword [ebp - 0x264]
inc dword [ebp - 0x24c]
mov eax, dword [ebp - 0x24c]
add dword [ebp - 0x258], 0x18
cmp dword [ebp - 0x238], eax
jbe 0x7104dea8
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x260]
mov ebx, dword [ebp - 0x254]
add esi, dword [eax + 0x14]
lea eax, [ebp - 0x1d8]
mov dword [esp], eax
call ebx
mov ecx, str.32_bit
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0x1d8], 9
cmovne eax, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x250]
call eax
lea edx, [ebp - 0x1d8]
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi], ax
mov dword [esp], edx
call ebx
mov ecx, str.32_bit
mov ebx, str.64_bit
mov eax, dword [ebp - 0x250]
sub esp, 4
cmp word [ebp - 0x1d8], 9
cmovne ebx, ecx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call eax
cmp eax, 1
sbb eax, eax
not eax
and eax, 9
mov word [esi + 2], ax
lea eax, [ebp - 0xe0]
mov dword [esp], eax
call edi
mov ecx, 1
mov dword [esi + 4], eax
lea eax, [ebp - 0x1d8]
mov word [esi + 8], cx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, 0x18
sub esp, 0x10
test eax, eax
jne 0x7104dbfd
movzx eax, byte [ebp - 0x1b0]
lea edx, [eax + eax*2]
shl edx, 3
mov dword [esp], edx
mov dword [ebp - 0x25c], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x7104e074
mov edx, dword [ebp - 0x25c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, 0x3e8
sub esp, 0x14
test eax, eax
jne 0x7104dc57
mov eax, dword [ebp - 0x258]
mov edx, dword [ebx + eax + 8]
mov dword [ebp - 0x25c], edx
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 0x1d8]
mov dword [esi + 0xa], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x254]
call eax
mov ecx, str.32_bit
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0x1d8], 9
cmovne eax, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x250]
call eax
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi + 0xe], ax
lea eax, [ebp - 0xe0]
mov dword [esp], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x24c]
mov dword [esp + 8], str.CPU_u
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x216]
mov dword [esp + 4], 0xe
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x216]
mov dword [esp], eax
call edi
mov dword [esi + 0x18], 0xf0002
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x230]
mov dword [esp], eax
call edi
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, 0x18
sub esp, 0x10
test eax, eax
jne 0x7104dd4f
movzx eax, byte [ebp - 0x1b0]
lea edx, [eax + eax*2]
shl edx, 3
mov dword [esp], edx
mov dword [ebp - 0x25c], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x7104e07e
mov edx, dword [ebp - 0x25c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, 0x3e8
sub esp, 0x14
test eax, eax
jne 0x7104dda9
mov eax, dword [ebp - 0x258]
mov edx, dword [ebx + eax + 4]
mov dword [ebp - 0x25c], edx
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x25c]
lea eax, [ebp - 0x1a6]
mov dword [esi + 0x20], edx
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x238]
xor edx, edx
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x23c]
div ecx
xor edx, edx
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x268]
div ecx
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x1fa]
mov dword [esp], eax
call edi
xor ecx, ecx
mov dword [esi + 0x30], eax
mov eax, 3
mov word [esi + 0x34], ax
mov eax, 1
cpuid
mov dword [ebp - 0x1cc], edx
mov dword [ebp - 0x1d4], ebx
mov dword [ebp - 0x1d0], ecx
mov word [esi + 0x36], ax
lea eax, [ebp - 0x144]
mov dword [esi + 0x38], 0
mov dword [esp], eax
call edi
mov edx, dword [ebp + 0xc]
mov dword [esi + 0x3c], eax
test edx, edx
je 0x7104dae2
lea eax, [ebp - 0x234]
mov ebx, 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1d8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
je 0x7104dad0
mov eax, dword [ebp - 0x24c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._free_row_values
jmp 0x7104daf5
xor ebx, ebx
lea esi, [esi]
test byte [0x71060048], 8
jne 0x7104e028
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x264]
mov dword [eax + 0xc], edi
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, eax
shr ebx, 0xc
and ebx, 0xf0
or ecx, ebx
cmp edx, 0xf
jne 0x7104d91d
mov edx, eax
shr edx, 0x14
movzx edx, dl
add edx, 0xf
jmp 0x7104d91d
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf0
or edx, ecx
jmp 0x7104da4e
lea eax, [ebp - 0x144]
mov dword [esp + 4], str.AuthenticAMD
mov esi, str.AMD64
mov dword [esp], eax
mov eax, dword [ebp - 0x250]
call eax
test eax, eax
mov eax, str.Intel64
cmovne esi, eax
jmp 0x7104d8e0
mov eax, 0x80000002
mov ecx, esi
cpuid
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x144], eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, byte [ebp + eax - 0x144]
mov word [ebp + eax*2 - 0x1a6], dx
inc eax
cmp eax, 0x10
jne 0x7104df70
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x186], ax
mov eax, 0x80000003
cpuid
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x144], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x144]
mov word [ebp + eax*2 - 0x186], dx
inc eax
cmp eax, 0x10
jne 0x7104dfb8
xor edi, edi
mov eax, 0x80000004
xor ecx, ecx
mov word [ebp - 0x166], di
cpuid
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x144], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x144]
mov word [ebp + eax*2 - 0x166], dx
inc eax
cmp eax, 0x10
jne 0x7104e000
xor esi, esi
mov word [ebp - 0x146], si
jmp 0x7104d9c2
mov eax, dword [ebp - 0x264]
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_processor
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x71060048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x7104deb5
mov ebx, 1
jmp 0x7104de82
mov ebx, 0xffffffff
jmp 0x7104dec1
mov edx, 0x3e8
jmp 0x7104dc6c
mov edx, 0x3e8
jmp 0x7104ddbe