Function at 0x48bee0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62e040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x634f1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
je 0x48bf45
movzx eax, word [0x634f1e]
push 0
shl eax, 3
push eax
push dword [0x634c30]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x634c30]
test eax, eax
jns 0x48bfd1
movzx eax, word [0x634f1e]
shl eax, 3
push eax
push 0
push esi
call fcn.00582250
add esp, 0xc
jmp 0x48bfd1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x634f20]
jae 0x48bfcb
lea esp, [esp]
push dword [ebp - 0xc]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x634c30]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x634c30]
test eax, eax
jns 0x48bfac
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00582250
add esp, 0xc
mov ax, word ds:[ebp - 0xc]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x634f20]
jb 0x48bf60
jmp 0x48bfd1
mov esi, dword [0x634c30]
movzx edi, word [0x634f1e]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
cmp edi, 2
jb 0x48c021
lea esi, [edi - 1]
xor edi, edi
mov dword [ebp - 0x14], esi
mov esi, dword [0x634c30]
lea esp, [esp]
add ecx, dword [esi + eax*8]
adc edx, dword [esi + eax*8 + 4]
add ebx, dword [esi + eax*8 + 8]
adc edi, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x14]
jb 0x48c000
mov dword [ebp - 0x10], edi
movzx edi, word [0x634f1e]
cmp eax, edi
jae 0x48c038
mov edi, dword [esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 8], edi
movzx edi, word [0x634f1e]
jmp 0x48c03a
xor esi, esi
add ecx, ebx
mov ebx, dword [ebp - 8]
adc edx, dword [ebp - 0x10]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x637d30]
mov edx, dword [ebp - 0x18]
mov eax, esi
sbb eax, dword [0x637d34]
cmp byte [0x634f1c], 0
mov dword [0x637d38], ecx
mov dword [0x637d3c], eax
mov dword [0x637d30], ebx
mov dword [0x637d34], esi
mov dword [edx], ecx
mov dword [edx + 4], eax
je 0x48c0bc
push 0
lea eax, [edi*8]
push eax
push dword [0x634c3c]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x48c13b
movzx eax, word [0x634f1e]
mov esi, dword [0x634c3c]
shl eax, 3
push eax
push 0
push esi
call fcn.00582250
add esp, 0xc
jmp 0x48c13b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x634f20]
jae 0x48c13b
push dword [ebp - 8]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [0x634c3c]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 8]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x634c3c]
test eax, eax
jns 0x48c11f
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00582250
add esp, 0xc
mov ax, word [ebp - 8]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x634f20]
jb 0x48c0d0
movzx eax, word [0x634f1e]
xor ebx, ebx
mov esi, dword [0x634c3c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp word [0x634f1e], 2
jb 0x48c18c
movzx ebx, word [0x634f1e]
dec ebx
mov dword [ebp - 0x18], ebx
mov ebx, eax
add edi, dword [esi + eax*8]
adc ebx, dword [esi + eax*8 + 4]
add ecx, dword [esi + eax*8 + 8]
adc edx, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x18]
jb 0x48c172
mov dword [ebp - 0x10], ebx
cmp eax, dword [ebp - 0x1c]
jae 0x48c1a2
mov ebx, dword ds:[esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
jmp 0x48c1a4
xor esi, esi
add ecx, edi
pop edi
adc edx, ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x637d40]
mov eax, esi
mov dword [0x637d48], ecx
sbb eax, dword [0x637d44]
mov ecx, dword [ebp - 4]
mov dword [0x637d44], esi
xor ecx, ebp
pop esi
mov dword [0x637d40], ebx
mov dword [0x637d4c], eax
pop ebx
call fcn.005802ef
mov esp, ebp
pop ebp
ret