Function at 0x48ce20
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x34], eax
cmp byte [0x633a68], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], ecx
je 0x48ce85
movzx eax, word [0x633a6a]
push 0
shl eax, 3
push eax
push dword [0x633780]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x633780]
test eax, eax
jns 0x48cf11
movzx eax, word [0x633a6a]
shl eax, 3
push eax
push 0
push esi
call fcn.005861b0
add esp, 0xc
jmp 0x48cf11
xor eax, eax
xor ebp, ebp
mov word [esp + 0x40], ax
cmp ax, word [0x633a6c]
jae 0x48cf0b
push dword ds:[esp + 0x40]
call sym.SystemInformer.exe_Ordinal_1505
movzx eax, ax
movzx edi, ax
push 0
mov dword [esp + 0x28], eax
mov eax, dword [0x633780]
movzx ebx, bp
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [esp + 0x50]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x633780]
test eax, eax
jns 0x48ceeb
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov ax, word ds:[esp + 0x40]
add ebp, dword [esp + 0x24]
inc ax
mov word [esp + 0x40], ax
cmp ax, word [0x633a6c]
jb 0x48ce97
jmp 0x48cf11
mov esi, dword [0x633780]
movzx edx, word [0x633a6a]
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [esp + 0x18], xmm0
test edx, edx
je 0x48cf85
cmp edx, 4
jb 0x48cf85
mov edi, edx
lea eax, [esi + 0x10]
and edi, 0xfffffffc
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movq xmm0, qword [eax - 0x10]
lea eax, [eax + 0x20]
movhpd xmm0, qword [eax - 0x28]
add ecx, 4
paddq xmm2, xmm0
movq xmm0, qword [eax - 0x20]
movhpd xmm0, qword [eax - 0x18]
paddq xmm1, xmm0
cmp ecx, edi
jb 0x48cf40
paddq xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movd ebx, xmm1
psrldq xmm1, 4
movd ebp, xmm1
jmp 0x48cf8d
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x28], ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x18], xmm0
cmp ecx, edx
jae 0x48d04e
mov edi, dword [esp + 0x1c]
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x48d027
lea eax, [edx - 1]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
nop dword [eax + eax]
add edx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esi + ecx*8 + 8]
adc edi, dword [esi + ecx*8 + 0xc]
add ecx, 2
cmp ecx, dword [esp + 0x24]
jb 0x48cfe0
mov dword [esp + 0x3c], edx
mov dword [esp + 0x30], edx
mov edx, ebp
mov dword [esp + 0x34], edx
movzx edx, word [0x633a6a]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
cmp ecx, edx
jae 0x48d042
jmp 0x48d03b
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
add ebx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esp + 0x3c]
adc edi, dword [esp + 0x14]
add ebx, eax
adc ebp, edi
mov esi, dword [esp + 0x2c]
mov ecx, ebx
sub ecx, dword [0x636970]
mov eax, ebp
mov dword [0x636978], ecx
sbb eax, dword [0x636974]
cmp byte [0x633a68], 0
mov dword [0x63697c], eax
mov dword [0x636970], ebx
mov dword [0x636974], ebp
mov dword [esi], ecx
mov dword [esi + 4], eax
je 0x48d0cd
push 0
lea eax, [edx*8]
push eax
push dword [0x63378c]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x63378c]
test eax, eax
jns 0x48d154
movzx eax, word [0x633a6a]
shl eax, 3
push eax
push 0
push esi
call fcn.005861b0
add esp, 0xc
jmp 0x48d154
xor eax, eax
xor ebp, ebp
mov word [esp + 0x3c], ax
cmp ax, word [0x633a6c]
jae 0x48d14e
nop
push dword [esp + 0x3c]
call sym.SystemInformer.exe_Ordinal_1505
movzx eax, ax
movzx edi, ax
push 0
mov dword [esp + 0x30], eax
mov eax, dword [0x63378c]
movzx ebx, bp
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [esp + 0x4c]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x63378c]
nop dword [eax]
test eax, eax
jns 0x48d133
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov ax, word [esp + 0x3c]
add ebp, dword [esp + 0x2c]
inc ax
mov word [esp + 0x3c], ax
cmp ax, word [0x633a6c]
jb 0x48d0e0
jmp 0x48d154
mov esi, dword [0x63378c]
movzx edi, word [0x633a6a]
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [esp + 0x18], xmm0
test edi, edi
je 0x48d1c5
cmp edi, 4
jb 0x48d1c5
mov edx, edi
lea eax, [esi + 0x10]
and edx, 0xfffffffc
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [eax]
movq xmm0, qword [eax - 0x10]
lea eax, [eax + 0x20]
movhpd xmm0, qword [eax - 0x28]
add ecx, 4
paddq xmm2, xmm0
movq xmm0, qword [eax - 0x20]
movhpd xmm0, qword [eax - 0x18]
paddq xmm1, xmm0
cmp ecx, edx
jb 0x48d180
paddq xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movd ebx, xmm1
psrldq xmm1, 4
movd ebp, xmm1
jmp 0x48d1cd
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x30], xmm0
cmp ecx, edi
jae 0x48d27c
mov edx, dword [esp + 0x34]
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x48d255
lea eax, [edi - 1]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
nop dword [eax + eax]
add edi, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esi + ecx*8 + 8]
adc edx, dword [esi + ecx*8 + 0xc]
add ecx, 2
cmp ecx, dword [esp + 0x2c]
jb 0x48d220
mov dword [esp + 0x28], edi
movzx edi, word [0x633a6a]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
cmp ecx, edi
jae 0x48d270
jmp 0x48d269
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add ebx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esp + 0x28]
adc edx, dword [esp + 0x14]
add ebx, eax
adc ebp, edx
mov ecx, ebx
mov eax, ebp
sub ecx, dword [0x636980]
pop edi
sbb eax, dword [0x636984]
pop esi
mov dword [0x636984], ebp
mov dword [0x636988], ecx
mov ecx, dword [esp + 0x3c]
pop ebp
mov dword [0x636980], ebx
pop ebx
xor ecx, esp
mov dword [0x63698c], eax
call fcn.00583f7f
add esp, 0x3c
ret