Function at 0x48c2e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62f040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x635f1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
je 0x48c345
movzx eax, word [0x635f1e]
push 0
shl eax, 3
push eax
push dword [0x635c30]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x635c30]
test eax, eax
jns 0x48c3d1
movzx eax, word [0x635f1e]
shl eax, 3
push eax
push 0
push esi
call fcn.005826f0
add esp, 0xc
jmp 0x48c3d1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x635f20]
jae 0x48c3cb
lea esp, [esp]
push dword [ebp - 0xc]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x635c30]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x635c30]
test eax, eax
jns 0x48c3ac
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005826f0
add esp, 0xc
mov ax, word ds:[ebp - 0xc]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x635f20]
jb 0x48c360
jmp 0x48c3d1
mov esi, dword [0x635c30]
movzx edi, word [0x635f1e]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
cmp edi, 2
jb 0x48c421
lea esi, [edi - 1]
xor edi, edi
mov dword [ebp - 0x14], esi
mov esi, dword [0x635c30]
lea esp, [esp]
add ecx, dword [esi + eax*8]
adc edx, dword [esi + eax*8 + 4]
add ebx, dword [esi + eax*8 + 8]
adc edi, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x14]
jb 0x48c400
mov dword [ebp - 0x10], edi
movzx edi, word [0x635f1e]
cmp eax, edi
jae 0x48c438
mov edi, dword [esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 8], edi
movzx edi, word [0x635f1e]
jmp 0x48c43a
xor esi, esi
add ecx, ebx
mov ebx, dword [ebp - 8]
adc edx, dword [ebp - 0x10]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x638d30]
mov edx, dword [ebp - 0x18]
mov eax, esi
sbb eax, dword [0x638d34]
cmp byte [0x635f1c], 0
mov dword [0x638d38], ecx
mov dword [0x638d3c], eax
mov dword [0x638d30], ebx
mov dword [0x638d34], esi
mov dword [edx], ecx
mov dword [edx + 4], eax
je 0x48c4bc
push 0
lea eax, [edi*8]
push eax
push dword [0x635c3c]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x48c53b
movzx eax, word [0x635f1e]
mov esi, dword [0x635c3c]
shl eax, 3
push eax
push 0
push esi
call fcn.005826f0
add esp, 0xc
jmp 0x48c53b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x635f20]
jae 0x48c53b
push dword [ebp - 8]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [0x635c3c]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 8]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x635c3c]
test eax, eax
jns 0x48c51f
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005826f0
add esp, 0xc
mov ax, word [ebp - 8]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x635f20]
jb 0x48c4d0
movzx eax, word [0x635f1e]
xor ebx, ebx
mov esi, dword [0x635c3c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp word [0x635f1e], 2
jb 0x48c58c
movzx ebx, word [0x635f1e]
dec ebx
mov dword [ebp - 0x18], ebx
mov ebx, eax
add edi, dword [esi + eax*8]
adc ebx, dword [esi + eax*8 + 4]
add ecx, dword [esi + eax*8 + 8]
adc edx, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x18]
jb 0x48c572
mov dword [ebp - 0x10], ebx
cmp eax, dword [ebp - 0x1c]
jae 0x48c5a2
mov ebx, dword ds:[esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
jmp 0x48c5a4
xor esi, esi
add ecx, edi
pop edi
adc edx, ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x638d40]
mov eax, esi
mov dword [0x638d48], ecx
sbb eax, dword [0x638d44]
mov ecx, dword [ebp - 4]
mov dword [0x638d44], esi
xor ecx, ebp
pop esi
mov dword [0x638d40], ebx
mov dword [0x638d4c], eax
pop ebx
call fcn.0058078f
mov esp, ebp
pop ebp
ret