Function at 0x4d5040
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
sub eax, 0x947
je 0x4d5429
sub eax, 1
jne 0x4d5584
mov ecx, dword ds:[edi + 0xc]
cmp ecx, dword [edi + 0x10]
jae 0x4d5584
cmp dword [0x63521c], ecx
je 0x4d5408
add ecx, dword [0x63620c]
mov eax, dword [0x636210]
and ecx, dword [0x636204]
push 0
push 0x10
mov dword [ebp - 0x1a0], 3
mov esi, dword [eax + ecx*4]
xor eax, eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x6d
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1ac], 0x16
mov dword [ebp - 0x1a4], 0x18
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x4d538c
cmp dword ds:[ebp - 0x194], 0
je 0x4d538c
cmp dword [ebp - 0x190], 0
je 0x4d538c
mov eax, dword ds:[ebp - 0x198]
fild dword [ebp - 0x198]
test eax, eax
jns 0x4d514a
fadd qword [0x61d4a8]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
fmul qword [0x61d3f0]
mov eax, dword [ebp - 0x194]
fild dword [ebp - 0x194]
test eax, eax
jns 0x4d5172
fadd qword [0x61d4a8]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
mov eax, dword [ebp - 0x190]
fmul st(1)
fild dword [ebp - 0x190]
test eax, eax
jns 0x4d5196
fadd qword [0x61d4a8]
fstp qword [ebp - 0x1a8]
mov eax, esi
mov ecx, 0x1000
fdiv qword [ebp - 0x1a8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x178], 0x22
mov dword [ebp - 0x174], 0x606da4
mov dword [ebp - 0x170], 0xc
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x130], 0x26
mov dword [ebp - 0x12c], str.Compressed_memory:
mul ecx
fld st(0)
fsub st(2)
fld qword [0x61d480]
fmul st(3), st(0)
mov dword [ebp - 0x160], eax
mov eax, 0xa
mov dword [ebp - 0x15c], edx
mov word [ebp - 0x148], ax
fmul st(3), st(0)
fmul st(2), st(0)
fmul st(2), st(0)
fmul st(1), st(0)
fmulp st(1)
fld qword [0x61d4c0]
fxch st(3)
fcomi st(3)
jb 0x4d524c
fsub st(3)
fxch st(3)
fcomi st(3)
jbe 0x4d524a
add esi, ebx
adc ebx, 0x80000000
fxch st(3)
call fcn.005a0760
add eax, esi
mov dword [ebp - 0x128], 0xc
mov dword [ebp - 0x118], eax
fxch st(1)
adc edx, ebx
mov dword [ebp - 0x110], 0
mov eax, 0xa
mov dword [ebp - 0x114], edx
xor esi, esi
mov word [ebp - 0x100], ax
xor ebx, ebx
mov dword [ebp - 0xf8], 1
fcomi st(2)
mov dword [ebp - 0xe8], 0x24
mov dword [ebp - 0xe4], str.Total_compressed:
jb 0x4d52bb
fsub st(2)
fxch st(2)
fcomi st(2)
jbe 0x4d52b9
add esi, ebx
adc ebx, 0x80000000
fxch st(2)
jmp 0x4d52c0
call fcn.005a0760
add eax, esi
mov dword [ebp - 0xe0], 0xc
mov dword [ebp - 0xd0], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0xc8], 0
xor esi, esi
mov dword [ebp - 0xcc], edx
xor ebx, ebx
mov word [ebp - 0xb8], ax
fcomi st(1)
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x28
mov dword [ebp - 0x9c], str.Total_memory_saved:
jb 0x4d532d
fsub st(1)
fxch st(1)
fcompi st(1)
jbe 0x4d532f
add esi, ebx
adc ebx, 0x80000000
jmp 0x4d532f
fstp st(1)
call fcn.005a0760
push dword [edi + 0xc]
add eax, esi
mov dword [ebp - 0x98], 0xc
mov dword [ebp - 0x88], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0x80], 0
push 0
mov dword [ebp - 0x84], edx
mov word [ebp - 0x70], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 0xd
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x58], ecx
jmp 0x4d53de
push dword [edi + 0xc]
mov ecx, 0x1000
mov dword [ebp - 0x50], 0xc
mov eax, esi
mov dword [ebp - 0x38], 0
mul ecx
push 0
mov dword [ebp - 0x40], eax
mov eax, 0xa
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x28], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
push eax
call sym.SystemInformer.exe_PhFormat
mov ecx, dword [0x635218]
mov dword [0x635218], eax
test ecx, ecx
je 0x4d5408
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d5408
call fcn.004fbfa0
mov eax, dword [0x635218]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0xc]
mov ecx, 0x1003
cmp byte [0x636120], 0
mov eax, 3
cmovne eax, ecx
mov dword [esi + 8], eax
mov eax, dword [0x635228]
mov eax, dword [eax + 0x40]
push dword [eax + 0x3c]
push 0
push dword [0x636080]
push esi
call sym.SystemInformer.exe__PhSiSetColorsGraphDrawInfo_16
push dword [0x636208]
push dword [edi + 0xc]
push 0x635204
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
cmp byte [0x635210], 0
jne 0x4d5584
cmp byte [0x636148], 0
mov eax, dword [esi + 0x14]
je 0x4d549b
push eax
push dword [0x635204]
push 0x636200
call sym.SystemInformer.exe_PhCopyConvertCircularBufferULONG
jmp 0x4d54ea
xor edx, edx
test eax, eax
je 0x4d54ea
jmp 0x4d54b0
mov ecx, dword [0x63620c]
mov eax, dword [0x636210]
add ecx, edx
and ecx, dword [0x636204]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
test eax, eax
jns 0x4d54dc
fadd dword [0x61d4d4]
mov eax, dword [0x635204]
fstp dword [eax + edx*4]
inc edx
cmp edx, dword [esi + 0x14]
jb 0x4d54b0
mov eax, dword [0x6337dc]
test eax, eax
je 0x4d5525
push dword [esi + 0x14]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
jns 0x4d550a
fadd dword [0x61d4d4]
fstp dword [ebp - 0x1a4]
fld dword [ebp - 0x1a4]
push ecx
fstp dword [esp]
push dword [0x635204]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
cmp byte [0x636120], 0
je 0x4d557d
mov dword [esi + 0x48], sym.SystemInformer.exe__PhSiSizeLabelYFunction_16
mov ecx, 0x1000
mov eax, dword [0x6337dc]
mul ecx
mov dword [ebp - 0x1a8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x1a4], edx
fild qword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
fild qword [ebp - 0x1a8]
fchs
faddp st(1)
fstp dword [esi + 0x4c]
mov byte [0x635210], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret