Function at 0x48b3da
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x250
mov al, byte [edx + 9]
mov edi, edx
mov esi, ecx
mov dword [esp + 4], ecx
cmp al, 2
je 0x48b4f4
mov bl, byte [edi + 0xa]
test al, al
je 0x48b45a
lea eax, [esp + 0x80]
xorps xmm0, xmm0
movaps xmmword [eax], xmm0
movaps xmmword [eax + 0x30], xmm0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
test eax, eax
jne 0x48b437
call fcn.0049e9ea
xor ecx, ecx
inc ecx
movsd xmm0, qword [esp + 0x88]
movsd xmm1, qword [esp + 0x90]
xor edx, edx
movsd qword [esi + 0x70], xmm0
movsd qword [esi + 0x78], xmm1
call fcn.004878c7
test bl, 1
je 0x48b4f4
lea eax, [esp + 0x80]
xorps xmm0, xmm0
and dword [eax + 0x34], 0
and dword [eax + 0x30], 0
movaps xmmword [eax + 0x20], xmm0
movaps xmmword [eax + 0x10], xmm0
movaps xmmword [eax], xmm0
push 0x38
push eax
call dword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x48b4f4
mov esi, edi
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x88]
xor ebx, ebx
mov edx, 0
mov ecx, dword [esp + 0xa8]
sub eax, edi
sbb edx, edx
cmovb eax, ebx
mov ebx, dword [esp + 4]
mul ecx
mov dword [ebx + 0x84], edx
mov edx, dword [esp + 4]
mov dword [edx + 0x80], eax
mov eax, dword [esp + 0x84]
mov edx, 0
sub eax, edi
mov edi, esi
mov esi, dword [esp + 4]
sbb edx, edx
mov edx, 0
cmovb eax, edx
mul ecx
mov dword [esi + 0x8c], edx
mov dword [esi + 0x88], eax
cmp byte [edi + 0xb], 2
je 0x48b867
mov al, byte [edi + 0xc]
cmp dword [esi + 0x90], 0
lea ebx, [esi + 0x90]
mov dword [esp + 0xc], edi
mov byte [esp + 0x14], al
jne 0x48b75e
lea eax, [esp + 0x168]
and dword [eax], 0
push eax
push 0
push 0
call dword [sym.imp.pdh.dll_PdhOpenQueryA]
mov edi, eax
test eax, eax
je 0x48b53b
xor eax, eax
jmp 0x48b57e
mov eax, dword [esp + 0x168]
lea ecx, [esp + 0x80]
mov dword [esp], eax
call fcn.0048eba7
lea esi, [esp + 0x238]
lea edx, [esp + 0x80]
mov ecx, esi
call fcn.0048b395
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
mov eax, 0x4e1930
mov esi, dword [esp + 4]
and dword [esi + 0x9c], 0
and dword [esi + 0x94], 0
and dword [esi + 0x98], 0
and dword [esi + 0xb4], 0
mov dword [esi + 0x90], eax
mov dword [esi + 0xa4], edx
mov edx, dword [esp + 0x10]
test edi, edi
mov dword [esi + 0xa0], ecx
mov edi, dword [esp + 8]
mov dword [esi + 0xa8], edx
mov edx, dword [esp]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edx
jne 0x48b752
mov al, byte [esp + 0x14]
and al, 1
mov byte [esp], al
push 0x1e
pop ecx
call fcn.00435565
mov edi, esi
mov dword [esp + 8], eax
mov esi, edx
push 0x1e
pop eax
push eax
push 0x4e1764
push edx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 8]
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], esi
push 0x1e
pop eax
mov dword [esp + 0x170], eax
lea esi, [edi + 0x2c]
push 5
pop ecx
call fcn.00435565
lea edi, [esp + 0x80]
mov dword [edx], 0x5f746f74
mov byte [edx + 4], 0x30
lea ecx, [esp + 0x168]
mov dword [esp + 8], ebx
mov dword [edi], eax
mov dword [edi + 4], edx
mov dword [edi + 8], 5
mov edx, ebx
push edi
push esi
call fcn.0048c71a
pop eax
pop ecx
movzx edx, byte [esp]
mov ecx, dword [esp + 4]
call fcn.0048ca09
mov edi, eax
mov dword [esp + 0x10], edx
mov dword [esp], 0
cmp edi, dword [esp + 0x10]
je 0x48b748
mov eax, dword [esp]
mov ebx, fcn.0040d0b0
mov dword [esp + 0x80], 0x4e179c
mov dword [esp + 0x38], eax
inc eax
mov dword [esp], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
push 2
pop eax
mov dword [esp + 0x84], eax
and dword [esp + 0x90], 0
lea eax, [esp + 0x18]
lea esi, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [esp + 0x88], eax
xor eax, eax
mov edx, esi
inc eax
mov dword [esp + 0x8c], eax
call fcn.00487536
lea eax, [esp + 0x38]
mov dword [esp + 0x80], 0x4e17b0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
push 2
pop eax
mov dword [esp + 0x84], eax
and dword [esp + 0x90], 0
lea eax, [esp + 0x18]
lea ebx, [esp + 0x168]
mov edx, esi
mov dword [esp + 0x88], eax
xor eax, eax
mov ecx, ebx
inc eax
mov dword [esp + 0x8c], eax
call fcn.00487536
mov edx, dword [esp + 8]
lea eax, [edi + 0x2c]
lea ecx, [esp + 0x28]
push ebx
push eax
call fcn.0048c71a
pop eax
pop ecx
add edi, 0x40
jmp 0x48b674
mov ebx, dword [esp + 8]
mov esi, dword [esp + 4]
mov eax, dword [ebx]
mov edi, dword [esp + 0xc]
test eax, eax
je 0x48b867
push dword [esi + 0xb0]
call dword [sym.imp.pdh.dll_PdhCollectQueryData]
cmp dword [esi + 0x2c], 0x80000000
je 0x48b796
lea edx, [esi + 0x2c]
mov ecx, ebx
call fcn.0048ca1e
test eax, eax
je 0x48bf92
movss xmm1, dword [0x4a56c8]
subss xmm1, xmm0
movss dword [esi + 0x38], xmm1
mov al, byte [esp + 0x14]
mov ecx, esi
and al, 1
movzx edx, al
call fcn.0048ca09
mov esi, eax
mov edi, edx
add esi, 0x2c
lea eax, [esi - 0x2c]
cmp eax, edi
je 0x48b7e3
cmp dword [esi], 0x80000000
je 0x48b7de
mov ecx, ebx
mov edx, esi
call fcn.0048ca1e
test eax, eax
je 0x48bf61
movss xmm1, dword [0x4a56c8]
subss xmm1, xmm0
movss dword [esi + 0xc], xmm1
add esi, 0x40
jmp 0x48b7ad
test byte [esp + 0x14], 1
mov esi, dword [esp + 4]
mov edi, dword [esp + 0xc]
je 0x48b867
cmp byte [esi + 0x4c], 0
jne 0x48b867
mov edi, dword [esi + 0x48]
lea ecx, [esp + 0x80]
mov edx, edi
call fcn.0048c5b6
lea eax, [esp + 0x80]
mov ebx, dword [esi + 0x44]
mov dword [esp], edi
shl edi, 6
xor esi, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
shl eax, 3
test edi, edi
je 0x48b840
cmp eax, esi
je 0x48b840
movsd xmm0, qword [edx + esi]
add edi, 0xffffffc0
movsd qword [ebx + esi*8], xmm0
add esi, 8
jmp 0x48b826
call fcn.0048ab6f
cmp dword [esp], 0
je 0x48b852
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
jmp 0x48b856
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 4]
mov edi, dword [esp + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
mov byte [edx + 0x4c], 1
mov al, byte [edi]
cmp al, 2
je 0x48bf59
mov ecx, dword [edi + 1]
mov edx, dword [edi + 5]
mov byte [esp + 0x4f], al
mov edi, 0x80000
mov dword [esp + 0x50], ecx
mov ecx, 0x80000
mov dword [esp + 0x54], edx
call fcn.00435565
lea esi, [esp + 0x68]
mov dword [esi], eax
mov dword [esi + 4], edx
and dword [esi + 8], 0
and dword [esp + 0x168], 0
mov ecx, esi
mov edx, edi
call fcn.0049e584
mov ebx, dword [esp + 0x6c]
lea eax, [esp + 0x168]
push eax
push edi
push ebx
push 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea ecx, [esp + 0x80]
mov edx, eax
call fcn.00489424
cmp dword [esp + 0x80], 0
je 0x48b918
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x84], 0xd0000004
jne 0x48b99b
mov ecx, dword [esp + 0x168]
mov edx, edi
add edx, edi
lea edi, [ecx + 0x2800]
test ecx, ecx
cmove edi, edx
test eax, eax
je 0x48b89f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x48b89f
mov dword [esp + 0x70], edi
push 4
pop ecx
mov edx, 0x7d0
call fcn.0040c443
test eax, eax
je 0x48bf73
lea ecx, [esp + 0x38]
xor edx, edx
xor edi, edi
mov dword [ecx], 0x1f4
mov dword [ecx + 4], eax
and dword [ecx + 8], 0
mov esi, dword [ebx + edi]
cmp edx, dword [esp + 0x38]
jne 0x48b960
lea ecx, [esp + 0x38]
call fcn.0047691b
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
lea ecx, [ebx + edi]
add edi, esi
mov dword [eax + edx*4], ecx
mov edx, dword [esp + 0x40]
inc edx
test esi, esi
mov dword [esp + 0x40], edx
jne 0x48b946
mov esi, dword [esp + 4]
cmp byte [esp + 0x4f], 0
lea eax, [esi + 0x50]
mov dword [esp + 0x24], eax
mov dword [esp + 0x74], eax
je 0x48b9b0
mov ecx, esi
xor edx, edx
xor edi, edi
call fcn.0048bfa4
mov eax, dword [esi + 0x48]
jmp 0x48b9b4
test eax, eax
je 0x48b9a5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 0x68]
mov edx, ebx
jmp 0x48bf54
xor eax, eax
xor edi, edi
lea ecx, [esp + 0x78]
and dword [esp + 0x80], 0
and dword [esp + 0x84], 0
mov dword [ecx], eax
mov dword [ecx + 4], edi
lea ecx, [esp + 0x80]
mov eax, dword [0x50c1bc]
push ecx
call eax
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
mov esi, 0x19db1de
mov ebx, 0xd53e7fff
mov eax, ecx
mov edi, edx
add eax, 0x2ac18000
mov dword [esp], eax
mov eax, 0xd53e8000
adc edi, 0xfe624e21
sub eax, ecx
sbb esi, edx
cmp ebx, ecx
mov ecx, 0x19db1de
sbb ecx, edx
cmovl eax, dword [esp]
cmovl esi, edi
setl bl
push 0
push 0x989680
push esi
push eax
call fcn.0049f3c0
mov edi, dword [esp + 0x40]
movsd xmm0, qword [esp + 0x38]
test bl, bl
mov ecx, 0
lea esi, [esp + 0x160]
cmove eax, ecx
test bl, bl
mov dword [esi], eax
lea eax, [esp + 0x74]
cmove edx, ecx
and dword [esp + 0x18], 0
mov dword [esp + 0x1c], 8
and dword [esp + 0x20], 0
mov dword [esi + 4], edx
mov dword [esp + 0x88], edi
movsd qword [esp + 0x80], xmm0
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x4f]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], esi
mov eax, dword [esp + 0x80]
cmp eax, edi
mov dword [esp], eax
jb 0x48bf80
lea eax, [esp + 0x8c]
mov eax, dword [eax - 8]
mov dword [esp + 8], eax
call fcn.00436790
xor ecx, ecx
cmp edi, 0xffffffff
lea esi, [esp + 0x28]
lea ebx, [esp + 0x8c]
mov edx, edi
sete cl
cmp ecx, eax
cmova eax, ecx
mov ecx, esi
push ebx
push edi
mov edi, dword [esp + 0x10]
push edi
push 1
push eax
push 0
call fcn.004897bd
add esp, 0x18
mov eax, dword [esp]
test eax, eax
je 0x48bb0a
shl eax, 2
push 4
pop edx
mov ecx, edi
push eax
call fcn.0040240f
pop eax
mov eax, dword [esp + 0x30]
xor edx, edx
sub eax, 1
jb 0x48bb23
mov esi, dword [esi]
test esi, esi
je 0x48bb23
add edx, dword [esi + 8]
add esi, 0xc
jmp 0x48bb10
lea ecx, [esp + 0x18]
call fcn.0048ac1c
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x28]
lea ecx, [esp + 0x168]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
lea ecx, [esp + 0x168]
call fcn.0048a565
test eax, eax
je 0x48bbda
movsd xmm0, qword [eax + 4]
mov esi, dword [eax]
mov ecx, eax
movsd qword [esp + 0x44], xmm0
call fcn.0040c35d
cmp esi, 0x80000000
je 0x48bbda
mov dword [esp + 0x80], esi
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
lea ecx, [esp + 0x18]
mov edx, esi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], esi
call fcn.0048ac1c
mov ebx, dword [esp + 0x20]
imul ecx, esi, 0xe0
imul eax, ebx, 0xe0
add eax, dword [esp + 0x1c]
push ecx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
and dword [esp + 0x88], 0
add ebx, esi
lea ecx, [esp + 0x80]
mov dword [esp + 0x20], ebx
call fcn.00487679
jmp 0x48bb44
lea ecx, [esp + 0x168]
call fcn.0048a541
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
imul edx, dword [esp + 0x20], 0xe0
mov esi, dword [esp + 4]
mov dword [esp + 0x64], eax
lea ecx, [edi + edx]
lea eax, [esi + 0x60]
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], eax
test edx, edx
je 0x48be17
mov eax, dword [edi]
cmp eax, 2
je 0x48be0d
mov ebx, dword [edi + 0xd0]
mov dword [esp + 8], eax
mov dword [esp + 0x14], edx
lea eax, [edi + 4]
push 0xcc
push eax
lea eax, [esp + 0x170]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm0, qword [edi + 0xd4]
mov esi, dword [esp + 4]
mov dword [esp + 0x10], edi
mov dword [esp], ebx
movsd qword [esp + 0x28], xmm0
mov ecx, dword [esi + 0x60]
mov edx, dword [esi + 0x64]
mov eax, dword [edi + 0xdc]
mov dword [esp + 0x44], ebx
mov dword [esp + 0x30], eax
push ebx
push dword [esi + 0x6c]
push dword [esi + 0x68]
call fcn.00416c52
add esp, 0xc
cmp dword [esi + 0x58], 0
mov ebx, eax
lea eax, [esp + 0x44]
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], eax
je 0x48bdfb
mov edi, dword [esp + 0x24]
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
lea eax, [esp + 0x18]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], edi
push 0x48b2eb
lea eax, [esp + 0x84]
push eax
push dword [esp + 0x14]
push ebx
call fcn.00448b8f
add esp, 0x10
test eax, eax
je 0x48bd5d
mov eax, dword [esi + 0x50]
mov edi, dword [esp + 0x44]
shr ebx, 0x19
movzx ecx, byte [eax + edx]
mov dword [esp + 0xc], edi
and ecx, 1
sub dword [esi + 0x58], ecx
lea ecx, [edx - 0x10]
and ecx, dword [esi + 0x54]
mov byte [eax + edx], bl
neg edx
mov byte [ecx + eax + 0x10], bl
imul ecx, edx, 0xe8
inc dword [esi + 0x5c]
lea edi, [eax + ecx - 0xdc]
mov eax, dword [esp + 0xc]
mov dword [edi - 0xc], eax
mov eax, dword [esp + 8]
mov dword [edi - 4], eax
push 0xcc
lea eax, [esp + 0x16c]
push eax
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
mov dword [edi + 0xcc], eax
movsd xmm0, qword [esp + 0x28]
movsd qword [edi + 0xd0], xmm0
mov eax, dword [esp + 0x30]
mov dword [edi + 0xd8], eax
jmp 0x48bdde
mov esi, dword [edi]
neg edx
imul ebx, edx, 0xe8
lea edi, [esi + ebx - 0xe0]
push pe_nt_image_headers32
push edi
lea eax, [esp + 0x88]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 8]
lea esi, [esi + ebx - 0xdc]
mov dword [edi], eax
push 0xcc
lea eax, [esp + 0x16c]
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esp]
lea ecx, [esp + 0x80]
mov dword [esi + 0xcc], eax
movsd xmm0, qword [esp + 0x28]
movsd qword [esi + 0xd0], xmm0
mov eax, dword [esp + 0x30]
mov dword [esi + 0xd8], eax
cmp dword [esp + 0x80], 2
je 0x48bdde
call fcn.004876ce
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 4]
add edi, 0xe0
add edx, 0xffffff20
jmp 0x48bc10
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x58]
call fcn.004a398f
jmp 0x48bc9e
mov esi, dword [esp + 4]
add edi, 0xe0
mov eax, dword [esp + 0x5c]
mov ecx, pe_nt_image_headers32
xor edx, edx
sub eax, edi
div ecx
mov ecx, edi
mov edx, eax
call fcn.004876b1
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
call fcn.00487696
mov edx, esi
mov esi, dword [esi + 0x50]
lea edi, [esp + 0x80]
mov ebx, dword [edx + 0x54]
movdqa xmm0, xmmword [esi]
lea ecx, [esi + 0x10]
mov dword [edi], esi
mov dword [edi + 4], ecx
lea eax, [ebx + esi + 1]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x5c]
pmovmskb ecx, xmm0
not ecx
mov word [edi + 0xc], cx
mov ecx, dword [edx + 0x58]
mov dword [esp], eax
mov dword [edi + 0x10], eax
mov dword [esp + 0x10], ecx
mov ecx, edi
call fcn.0048b085
test eax, eax
je 0x48bf4c
cmp byte [eax - 4], 0
mov ecx, eax
mov byte [eax - 4], 0
jne 0x48be78
mov eax, esi
mov dword [esp + 0x24], esi
mov esi, ebx
mov ebx, 0xe8
pcmpeqd xmm1, xmm1
sub eax, ecx
cdq
idiv ebx
mov dword [esp + 0x14], esi
mov edx, eax
mov dword [esp + 8], eax
add eax, 0xfffffff0
and eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], eax
movdqu xmm0, xmmword [esi + eax]
pcmpeqb xmm0, xmm1
psllw xmm0, 7
pmovmskb edx, xmm0
test edx, edx
je 0x48bedf
bsr bx, dx
xor ebx, 0xf
jmp 0x48bee3
mov bx, 0x10
mov eax, dword [esp + 8]
movdqu xmm0, xmmword [esi + eax]
pcmpeqb xmm0, xmm1
pmovmskb edx, xmm0
or edx, 0x10000
bsf edx, edx
add ebx, edx
mov dl, 0x80
cmp bx, 0xf
jbe 0x48bf0d
mov ebx, dword [esp + 4]
jmp 0x48bf1f
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 4]
inc edx
mov dword [esp + 0x10], edx
mov dword [ebx + 0x58], edx
mov dl, 0xff
mov eax, dword [esp + 8]
add ecx, 0xffffff20
mov byte [esi + eax], dl
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 0x10], dl
mov edx, dword [esp]
dec edx
mov dword [esp], edx
mov dword [ebx + 0x5c], edx
call fcn.004876ce
mov ebx, dword [esp + 0x14]
jmp 0x48be78
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
call fcn.0049eabd
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x14
pop edx
mov ecx, str.key_used_disappeared
push 0x4e185c
call fcn.004a0680
push 4
pop ecx
mov edx, 0x7d0
call fcn.0049ff70
push 0x2f
pop edx
mov ecx, str.assertion_failed:_vec.capacity_____start___len.cargo_registry_srcindex.crates.io_1cd66030c949c28d_rayon_1.10.0_src_vec.rs
push 0x4e13e4
call fcn.004a0350
push 0x1b
pop edx
mov ecx, str.global_key_idle_disappeared.cargo_registry_srcindex.crates.io_1cd66030c949c28d_sysinfo_0.30.7_srcwindows_system.rs
push 0x4e1838
call fcn.004a0680