Function at 0x4d53a0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x62e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
sub eax, 0x947
je 0x4d5789
sub eax, 1
jne 0x4d58e4
mov ecx, dword ds:[edi + 0xc]
cmp ecx, dword [edi + 0x10]
jae 0x4d58e4
cmp dword [0x636aac], ecx
je 0x4d5768
add ecx, dword [0x637aac]
mov eax, dword [0x637ab0]
and ecx, dword [0x637aa4]
push 0
push 0x10
mov dword [ebp - 0x1a0], 3
mov esi, dword [eax + ecx*4]
xor eax, eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x6d
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1ac], 0x16
mov dword [ebp - 0x1a4], 0x18
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x4d56ec
cmp dword ds:[ebp - 0x194], 0
je 0x4d56ec
cmp dword [ebp - 0x190], 0
je 0x4d56ec
mov eax, dword ds:[ebp - 0x198]
fild dword [ebp - 0x198]
test eax, eax
jns 0x4d54aa
fadd qword [0x61db30]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
fmul qword [0x61da80]
mov eax, dword [ebp - 0x194]
fild dword [ebp - 0x194]
test eax, eax
jns 0x4d54d2
fadd qword [0x61db30]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
mov eax, dword [ebp - 0x190]
fmul st(1)
fild dword [ebp - 0x190]
test eax, eax
jns 0x4d54f6
fadd qword [0x61db30]
fstp qword [ebp - 0x1a8]
mov eax, esi
mov ecx, 0x1000
fdiv qword [ebp - 0x1a8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x178], 0x22
mov dword [ebp - 0x174], 0x6072fc
mov dword [ebp - 0x170], 0xd
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x130], 0x26
mov dword [ebp - 0x12c], str.Compressed_memory:
mul ecx
fld st(0)
fsub st(2)
fld qword [0x61db08]
fmul st(3), st(0)
mov dword [ebp - 0x160], eax
mov eax, 0xa
mov dword [ebp - 0x15c], edx
mov word [ebp - 0x148], ax
fmul st(3), st(0)
fmul st(2), st(0)
fmul st(2), st(0)
fmul st(1), st(0)
fmulp st(1)
fld qword [0x61db48]
fxch st(3)
fcomi st(3)
jb 0x4d55ac
fsub st(3)
fxch st(3)
fcomi st(3)
jbe 0x4d55aa
add esi, ebx
adc ebx, 0x80000000
fxch st(3)
call fcn.005a0a00
add eax, esi
mov dword [ebp - 0x128], 0xd
mov dword [ebp - 0x118], eax
fxch st(1)
adc edx, ebx
mov dword [ebp - 0x110], 0
mov eax, 0xa
mov dword [ebp - 0x114], edx
xor esi, esi
mov word [ebp - 0x100], ax
xor ebx, ebx
mov dword [ebp - 0xf8], 1
fcomi st(2)
mov dword [ebp - 0xe8], 0x24
mov dword [ebp - 0xe4], str.Total_compressed:
jb 0x4d561b
fsub st(2)
fxch st(2)
fcomi st(2)
jbe 0x4d5619
add esi, ebx
adc ebx, 0x80000000
fxch st(2)
jmp 0x4d5620
call fcn.005a0a00
add eax, esi
mov dword [ebp - 0xe0], 0xd
mov dword [ebp - 0xd0], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0xc8], 0
xor esi, esi
mov dword [ebp - 0xcc], edx
xor ebx, ebx
mov word [ebp - 0xb8], ax
fcomi st(1)
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x28
mov dword [ebp - 0x9c], str.Total_memory_saved:
jb 0x4d568d
fsub st(1)
fxch st(1)
fcompi st(1)
jbe 0x4d568f
add esi, ebx
adc ebx, 0x80000000
jmp 0x4d568f
fstp st(1)
call fcn.005a0a00
push dword [edi + 0xc]
add eax, esi
mov dword [ebp - 0x98], 0xd
mov dword [ebp - 0x88], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0x80], 0
push 0
mov dword [ebp - 0x84], edx
mov word [ebp - 0x70], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 0xd
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x58], ecx
jmp 0x4d573e
push dword [edi + 0xc]
mov ecx, 0x1000
mov dword [ebp - 0x50], 0xd
mov eax, esi
mov dword [ebp - 0x38], 0
mul ecx
push 0
mov dword [ebp - 0x40], eax
mov eax, 0xa
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x28], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
push eax
call sym.SystemInformer.exe_PhFormat
mov ecx, dword [0x636aa8]
mov dword [0x636aa8], eax
test ecx, ecx
je 0x4d5768
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d5768
call fcn.004fc020
mov eax, dword [0x636aa8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005802ef
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0xc]
mov ecx, 0x1003
cmp byte [0x6379c0], 0
mov eax, 3
cmovne eax, ecx
mov dword [esi + 8], eax
mov eax, dword [0x636ab8]
mov eax, dword [eax + 0x40]
push dword [eax + 0x3c]
push 0
push dword [0x637920]
push esi
call sym.SystemInformer.exe__PhSiSetColorsGraphDrawInfo_16
push dword [0x637aa8]
push dword [edi + 0xc]
push 0x636a94
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
cmp byte [0x636aa0], 0
jne 0x4d58e4
cmp byte [0x6379e8], 0
mov eax, dword [esi + 0x14]
je 0x4d57fb
push eax
push dword [0x636a94]
push 0x637aa0
call sym.SystemInformer.exe_PhCopyConvertCircularBufferULONG
jmp 0x4d584a
xor edx, edx
test eax, eax
je 0x4d584a
jmp 0x4d5810
mov ecx, dword [0x637aac]
mov eax, dword [0x637ab0]
add ecx, edx
and ecx, dword [0x637aa4]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
test eax, eax
jns 0x4d583c
fadd dword [0x61db5c]
mov eax, dword [0x636a94]
fstp dword [eax + edx*4]
inc edx
cmp edx, dword [esi + 0x14]
jb 0x4d5810
mov eax, dword [0x63504c]
test eax, eax
je 0x4d5885
push dword [esi + 0x14]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
jns 0x4d586a
fadd dword [0x61db5c]
fstp dword [ebp - 0x1a4]
fld dword [ebp - 0x1a4]
push ecx
fstp dword [esp]
push dword [0x636a94]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
cmp byte [0x6379c0], 0
je 0x4d58dd
mov dword [esi + 0x48], sym.SystemInformer.exe__PhSiSizeLabelYFunction_16
mov ecx, 0x1000
mov eax, dword [0x63504c]
mul ecx
mov dword [ebp - 0x1a8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x1a4], edx
fild qword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
fild qword [ebp - 0x1a8]
fchs
faddp st(1)
fstp dword [esi + 0x4c]
mov byte [0x636aa0], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005802ef
mov esp, ebp
pop ebp
ret