Function at 0x48c7a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [0x591014]
xor eax, ebp
mov dword [esp + 0xe8], eax
mov dword [ecx + 8], ebx
mov eax, dword [0x5a79b8]
mov ecx, dword [0x5954dc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x48cadc
mov ecx, dword [0x5a79b4]
test ecx, ecx
je 0x48c831
lea edi, [esp + 0x10]
mov dword [edi], 0xffffffff
call dword [section..00cfg]
push edi
push ebx
call ecx
test eax, eax
je 0x48c81f
cmp dword [esp + 0x10], 0
setne byte [esi + 0x89]
je 0x48c838
mov byte [esi + 0x88], 0
jmp 0x48c88e
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x48c9c9
mov byte [esi + 0x89], 0
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x40]
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
mov dword [edi + 0x20], 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [edi], 9
sete byte [esi + 0x88]
jne 0x48c88e
push 2
call fcn.004a2710
add esp, 4
test al, al
jne 0x48c8c0
xor ebx, ebx
mov ecx, dword [esp + 0xe8]
xor ecx, ebp
call fcn.004c66e3
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
lea eax, [esi + 0x20]
lea ecx, [esi + 0x18]
push eax
push ecx
push esi
push 0
push ebx
call fcn.0053d8d0
add esp, 0x14
test al, al
je 0x48c8f7
cmp byte [esi + 0x88], 0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
je 0x48c92d
push esi
push ecx
push eax
push ebx
call fcn.0048cb30
jmp 0x48c936
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x211
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0044bd70
lea eax, [esp + 0x48]
push 0x32
push str.Reading_x64_process_from_x86_process_not_supported
push eax
call fcn.004f75f0
add esp, 0xc
mov ecx, esi
call fcn.0044c1b0
jmp 0x48c872
push 2
call fcn.004a2710
add esp, 4
test al, al
je 0x48c872
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x21f
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0044bd70
lea eax, [esp + 0x48]
push 0x21
push str.GetProcessBasicInformation_failed
jmp 0x48c8e2
push esi
push ecx
push eax
push ebx
call fcn.0048d110
add esp, 0x10
test al, al
je 0x48c990
movzx eax, byte [esi + 0x88]
push esi
push eax
push ebx
call fcn.0048bee0
add esp, 0xc
test al, al
jne 0x48ca03
push 2
call fcn.004a2710
add esp, 4
test al, al
je 0x48c872
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x22d
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0044bd70
lea eax, [esp + 0x48]
push 0x15
push str.ReadMemoryInfo_failed
jmp 0x48c8e2
push 2
call fcn.004a2710
add esp, 4
test al, al
je 0x48c872
lea esi, [esp + 0x40]
mov ecx, esi
push 2
push 0x228
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0044bd70
lea eax, [esp + 0x48]
push 0x16
push str.ReadProcessData_failed
jmp 0x48c8e2
call fcn.0050b630
lea edi, [esp + 0x40]
mov ecx, edi
push eax
push 2
push 0x4c
push str....._third_partycrashpadcrashpadutilwinprocess_info.cc
call fcn.0050b760
lea eax, [esp + 0x48]
push 0xe
push 0x587751
push eax
call fcn.004f75f0
add esp, 0xc
mov ecx, edi
call fcn.0050b7c0
jmp 0x48c831
xor eax, eax
lea ecx, [esp + 0x40]
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x24], eax
pxor xmm0, xmm0
movdqu xmmword [ecx + 0x14], xmm0
movdqu xmmword [ecx + 4], xmm0
mov eax, 0x2c
mov dword [ecx], eax
push eax
push ecx
push ebx
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
je 0x48ca7d
cmp byte [esi + 0x4c], 0
mov eax, dword [esp + 0x68]
jne 0x48ca3e
mov byte [esi + 0x4c], 1
mov dword [esi + 0x50], eax
cmp byte [esi + 0x58], 0
mov eax, dword [esp + 0x64]
jne 0x48ca4f
mov byte [esi + 0x58], 1
mov dword [esi + 0x5c], eax
cmp byte [esi + 0x64], 0
mov eax, dword [esp + 0x4c]
jne 0x48ca60
mov byte [esi + 0x64], 1
mov dword [esi + 0x68], eax
cmp byte [esi + 0x70], 0
jne 0x48ca76
mov eax, dword [esp + 0x48]
mov dword [esi + 0x74], eax
mov byte [esi + 0x70], 1
jmp 0x48ca7d
mov eax, dword [esp + 0x48]
mov dword [esi + 0x74], eax
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqu xmmword [eax + 0x1c], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
lea edi, [esp + 0xc]
mov dword [edi], 0xffffffff
mov ecx, dword [esi + 8]
mov edx, 3
push edi
push 0x2c
push eax
call fcn.0053dac0
add esp, 0xc
test eax, eax
js 0x48cad5
cmp byte [esi + 0x7c], 0
je 0x48cac7
mov eax, dword [esp + 0x14]
mov dword [esi + 0x80], eax
jmp 0x48cad5
mov eax, dword [esp + 0x14]
mov dword [esi + 0x80], eax
mov byte [esi + 0x7c], 1
mov bl, 1
jmp 0x48c874
push 0x5a79b8
call fcn.004c5d07
add esp, 4
cmp dword [0x5a79b8], 0xffffffff
jne 0x48c7e6
push 0
push str.::IsWow64Process
push 0x579896
call fcn.0048bcb0
add esp, 0xc
mov dword [0x5a79b4], eax
push 0x5a79b8
call fcn.004c5d7d
add esp, 4
jmp 0x48c7e6