Function at 0x4944c0
Capabilities:
Get system information on windows

Disassembly:
mov edx, dword [0x5eda98]
sub esp, 0x64
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
jne 0x4944f7
push 0x5000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov ecx, 0x400
xor eax, eax
mov dword [0x5eda98], edi
rep stosd dword es:[edi], eax
mov edx, dword [0x5eda98]
mov edi, dword [esp + 0x7c]
xor esi, esi
mov eax, edx
cmp dword [eax], edi
je 0x494565
inc esi
add eax, 0x14
cmp esi, 0x400
jl 0x4944ff
xor ecx, ecx
mov eax, edx
cmp dword [eax], ebx
je 0x494532
inc ecx
add eax, 0x14
cmp ecx, 0x400
jl 0x494513
call fcn.004944a0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret
lea eax, [ecx + ecx*4]
mov esi, ecx
shl eax, 2
mov dword [eax + edx], edi
mov edx, dword [0x5eda98]
mov dword [eax + edx + 4], ebx
mov edx, dword [0x5eda98]
mov dword [eax + edx + 8], ebx
mov edx, dword [0x5eda98]
mov dword [eax + edx + 0xc], ebx
mov edx, dword [0x5eda98]
mov dword [eax + edx + 0x10], ebx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x44]
push edx
mov edx, dword [esp + 0x80]
lea ecx, [esp + 0x50]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x4946e7
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x64]
lea ecx, [esp + 0x20]
push ecx
call fcn.00494700
mov ebp, edx
lea edx, [esp + 0x2c]
push edx
mov ebx, eax
call fcn.00494700
add esp, 8
add ebx, eax
mov eax, edi
adc ebp, edx
cdq
push edx
push eax
push ebp
push ebx
call fcn.004d9700
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x18], edx
call fcn.00494700
lea esi, [esi + esi*4]
mov dword [esp + 0x20], edx
mov edx, dword [0x5eda98]
mov ebx, eax
shl esi, 2
add esp, 4
mov dword [esp + 0x18], ebx
mov ecx, dword [esi + edx + 4]
mov eax, dword [esi + edx + 8]
lea edi, [esi + edx + 4]
mov ebp, ecx
or ebp, eax
je 0x4946c3
mov ebp, dword [esi + edx + 0xc]
mov edx, dword [esi + edx + 0x10]
mov dword [esp + 0x38], ebp
or ebp, edx
je 0x4946c3
mov ebp, dword [esp + 0x38]
sub ebx, ebp
mov ebp, dword [esp + 0x1c]
sbb ebp, edx
mov edx, ebx
or edx, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebp
je 0x4946e7
mov edx, dword [esp + 0x10]
push 0
sub edx, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, eax
push 0x64
push ecx
push edx
call fcn.004d9850
push 0
push 2
mov ecx, eax
push ebp
push ebx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], edx
call fcn.004d97a0
mov ecx, dword [esp + 0x7c]
add ecx, eax
mov eax, dword [esp + 0x78]
adc eax, edx
mov edx, ebp
push edx
mov edx, ebx
push edx
push eax
push ecx
call fcn.004d97a0
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, dword [0x5eda98]
mov edx, dword [esp + 0x18]
pop edi
mov dword [esi + ecx + 0xc], edx
mov ecx, dword [0x5eda98]
mov edx, dword [esp + 0x18]
mov dword [esi + ecx + 0x10], edx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edx, dword [0x5eda98]
mov ecx, dword [esp + 0x1c]
mov dword [esi + edx + 0xc], ebx
mov eax, dword [0x5eda98]
mov dword [esi + eax + 0x10], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret