Function at 0x1000dab0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x19e]
lea edx, [ebp - 0x230]
push ebx
push ecx
sub esp, 0x26c
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov ecx, 0x18
mov dword [ebp - 0x258], eax
xor eax, eax
rep stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x248], esi
mov word [edi], ax
lea eax, [ebp - 0x234]
call sym._get_logical_processor_count
mov edx, dword [ebp - 0x230]
mov ecx, 0x40
mov dword [ebp - 0x25c], eax
mov eax, esi
call sym._resize_table
test eax, eax
je 0x1000e30a
lea eax, [ebp - 0x13c]
mov esi, 0x1002352e
call sym._get_processor_manufacturer.constprop.0
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov dword [ebp - 0x240], eax
call eax
mov edx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0xd8], 9
cmove eax, edx
mov dword [esp + 4], str.32_bit
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [ebp - 0x23c], eax
call eax
test eax, eax
jne 0x1000e1b8
mov eax, 1
xor ecx, ecx
cpuid
mov dword [ebp - 0x1c4], edx
mov edx, eax
mov dword [ebp - 0x1c8], ecx
shr edx, 8
mov ecx, eax
shr ecx, 4
and edx, 0xf
mov dword [ebp - 0x1cc], ebx
and ecx, 0xf
cmp edx, 6
je 0x1000e178
cmp edx, 0xf
je 0x1000e178
and eax, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 8], str._s_Family__u_Model__u_Stepping__u
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sym._swprintf
mov eax, 1
mov ecx, esi
mov dword [esp + 8], str._08X_08X
cpuid
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1f2]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x11
mov dword [esp], eax
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ebx
call sym._swprintf
lea eax, [ebp - 0x228]
call sym._get_processor_manufacturer.constprop.0
mov eax, 0x80000000
mov ecx, esi
cpuid
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
cmp eax, 0x80000003
ja 0x1000e1e8
cmp word [ebp - 0x19e], 0
lea eax, [ebp - 0x19e]
je 0x1000dca9
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000dc70
mov edx, eax
lea edi, [ebp - 0x19e]
sub edx, edi
sar edx, 1
dec edx
jns 0x1000dca2
jmp 0x1000dca9
xor ecx, ecx
sub eax, 2
lea edi, [ebp - 0x19e]
mov word [eax], cx
cmp edi, eax
je 0x1000dca9
cmp word [eax - 2], 0x20
je 0x1000dc90
mov eax, 1
xor ecx, ecx
cpuid
mov dword [ebp - 0x1c8], ecx
mov ecx, eax
mov dword [ebp - 0x1c4], edx
shr ecx, 8
mov edx, eax
shr edx, 4
and ecx, 0xf
mov dword [ebp - 0x1cc], ebx
and edx, 0xf
cmp ecx, 6
je 0x1000e1a0
cmp ecx, 0xf
je 0x1000e1a0
and eax, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x13c]
mov dword [esp + 8], str.Model__u_Stepping__u
mov dword [esp + 4], 0x32
mov dword [esp], eax
call sym._swprintf
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x254], eax
test eax, eax
je 0x1000e140
cmp dword [ebp - 0x258], 1
mov dword [ebp - 0x244], 0
sbb eax, eax
mov dword [ebp - 0x254], 0
mov edi, dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x250], 0
inc eax
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x238], 0
jmp 0x1000ddac
mov eax, dword [ebp - 0x1cc]
or eax, dword [ebp - 0x1d0]
je 0x1000e300
add dword [ebp - 0x250], 0x40
mov ebx, dword [ebp - 0x260]
inc dword [ebp - 0x254]
inc dword [ebp - 0x238]
mov eax, dword [ebp - 0x238]
add dword [ebp - 0x244], 0x18
cmp dword [ebp - 0x230], eax
jbe 0x1000e148
mov eax, dword [ebp - 0x248]
mov esi, dword [ebp - 0x250]
mov ebx, dword [ebp - 0x240]
add esi, dword [eax + 0x14]
lea eax, [ebp - 0x1d0]
mov dword [esp], eax
call ebx
mov ecx, str.32_bit
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmovne eax, ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
lea edx, [ebp - 0x1d0]
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi], ax
mov dword [esp], edx
call ebx
mov ecx, str.32_bit
mov ebx, str.64_bit
mov eax, dword [ebp - 0x23c]
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmovne ebx, ecx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call eax
cmp eax, 1
sbb eax, eax
not eax
and eax, 9
mov word [esi + 2], ax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call edi
mov edx, 1
mov dword [esi + 4], eax
lea eax, [ebp - 0x1d0]
mov word [esi + 8], dx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, 0x18
sub esp, 0x10
test eax, eax
jne 0x1000de98
movzx eax, byte [ebp - 0x1a8]
lea edx, [eax + eax*2]
shl edx, 3
mov dword [esp], edx
mov dword [ebp - 0x24c], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x1000e314
mov edx, dword [ebp - 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, 0x3e8
sub esp, 0x14
test eax, eax
jne 0x1000def2
mov eax, dword [ebp - 0x244]
mov edx, dword [ebx + eax + 8]
mov dword [ebp - 0x24c], edx
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 0x1d0]
mov dword [esi + 0xa], edx
mov ebx, str.32_bit
mov dword [esp], eax
mov eax, dword [ebp - 0x240]
call eax
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmovne eax, ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi + 0xe], ax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], str.CPU_u
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20e]
mov dword [esp + 4], 0xe
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x20e]
mov dword [esp], eax
call edi
mov dword [esi + 0x18], 0xf0002
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
call edi
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edx, 0x18
sub esp, 0x10
test eax, eax
jne 0x1000dfea
movzx eax, byte [ebp - 0x1a8]
lea edx, [eax + eax*2]
shl edx, 3
mov dword [esp], edx
mov dword [ebp - 0x24c], edx
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x1000e31e
mov edx, dword [ebp - 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, 0x3e8
sub esp, 0x14
test eax, eax
jne 0x1000e044
mov eax, dword [ebp - 0x244]
mov edx, dword [ebx + eax + 4]
mov dword [ebp - 0x24c], edx
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 0x19e]
mov dword [esi + 0x20], edx
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x230]
xor edx, edx
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x234]
div ecx
xor edx, edx
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x25c]
div ecx
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x1f2]
mov dword [esp], eax
call edi
xor ecx, ecx
mov dword [esi + 0x30], eax
mov eax, 3
mov word [esi + 0x34], ax
mov eax, 1
cpuid
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c4], edx
mov word [esi + 0x36], ax
lea eax, [ebp - 0x13c]
mov dword [esi + 0x38], 0
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x258]
mov dword [esi + 0x3c], eax
test ecx, ecx
je 0x1000dd7a
lea eax, [ebp - 0x22c]
mov dword [esp + 8], ecx
mov ebx, 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
je 0x1000dd68
mov eax, dword [ebp - 0x238]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call sym._free_row_values
jmp 0x1000dd8d
xor ebx, ebx
lea esi, [esi]
test byte [0x10021048], 8
jne 0x1000e2c8
mov eax, dword [ebp - 0x248]
mov edi, dword [ebp - 0x254]
mov dword [eax + 0xc], edi
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov ebx, eax
shr ebx, 0xc
and ebx, 0xf0
or ecx, ebx
cmp edx, 0xf
jne 0x1000dbb8
mov edx, eax
shr edx, 0x14
movzx edx, dl
add edx, 0xf
jmp 0x1000dbb8
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf0
or edx, ecx
jmp 0x1000dce6
lea eax, [ebp - 0x13c]
mov dword [esp + 4], str.AuthenticAMD
mov esi, str.AMD64
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
test eax, eax
mov eax, str.Intel64
cmovne esi, eax
jmp 0x1000db7b
mov eax, 0x80000002
mov ecx, esi
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x19e], dx
inc eax
cmp eax, 0x10
jne 0x1000e210
xor edi, edi
mov eax, 0x80000003
xor ecx, ecx
mov word [ebp - 0x17e], di
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x17e], dx
inc eax
cmp eax, 0x10
jne 0x1000e258
xor esi, esi
mov eax, 0x80000004
xor ecx, ecx
mov word [ebp - 0x15e], si
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x15e], dx
inc eax
cmp eax, 0x10
jne 0x1000e2a0
xor ebx, ebx
mov word [ebp - 0x13e], bx
jmp 0x1000dc5d
mov eax, dword [ebp - 0x254]
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_processor
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10021048
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x1000e155
mov ebx, 1
jmp 0x1000e120
mov ebx, 0xffffffff
jmp 0x1000e164
mov edx, 0x3e8
jmp 0x1000df07
mov edx, 0x3e8
jmp 0x1000e059