Function at 0x48cea0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x34], eax
cmp byte [0x633a48], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x2c], ecx
je 0x48cf05
movzx eax, word [0x633a4a]
push 0
shl eax, 3
push eax
push dword [0x633760]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x633760]
test eax, eax
jns 0x48cf91
movzx eax, word [0x633a4a]
shl eax, 3
push eax
push 0
push esi
call fcn.005861d0
add esp, 0xc
jmp 0x48cf91
xor eax, eax
xor ebp, ebp
mov word [esp + 0x40], ax
cmp ax, word [0x633a4c]
jae 0x48cf8b
push dword ds:[esp + 0x40]
call sym.SystemInformer.exe_Ordinal_1505
movzx eax, ax
movzx edi, ax
push 0
mov dword [esp + 0x28], eax
mov eax, dword [0x633760]
movzx ebx, bp
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [esp + 0x50]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x633760]
test eax, eax
jns 0x48cf6b
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005861d0
add esp, 0xc
mov ax, word ds:[esp + 0x40]
add ebp, dword [esp + 0x24]
inc ax
mov word [esp + 0x40], ax
cmp ax, word [0x633a4c]
jb 0x48cf17
jmp 0x48cf91
mov esi, dword [0x633760]
movzx edx, word [0x633a4a]
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [esp + 0x18], xmm0
test edx, edx
je 0x48d005
cmp edx, 4
jb 0x48d005
mov edi, edx
lea eax, [esi + 0x10]
and edi, 0xfffffffc
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [eax + eax]
movq xmm0, qword [eax - 0x10]
lea eax, [eax + 0x20]
movhpd xmm0, qword [eax - 0x28]
add ecx, 4
paddq xmm2, xmm0
movq xmm0, qword [eax - 0x20]
movhpd xmm0, qword [eax - 0x18]
paddq xmm1, xmm0
cmp ecx, edi
jb 0x48cfc0
paddq xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movd ebx, xmm1
psrldq xmm1, 4
movd ebp, xmm1
jmp 0x48d00d
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x28], ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x18], xmm0
cmp ecx, edx
jae 0x48d0ce
mov edi, dword [esp + 0x1c]
mov eax, edx
sub eax, ecx
cmp eax, 2
jb 0x48d0a7
lea eax, [edx - 1]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
nop dword [eax + eax]
add edx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esi + ecx*8 + 8]
adc edi, dword [esi + ecx*8 + 0xc]
add ecx, 2
cmp ecx, dword [esp + 0x24]
jb 0x48d060
mov dword [esp + 0x3c], edx
mov dword [esp + 0x30], edx
mov edx, ebp
mov dword [esp + 0x34], edx
movzx edx, word [0x633a4a]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
cmp ecx, edx
jae 0x48d0c2
jmp 0x48d0bb
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
add ebx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esp + 0x3c]
adc edi, dword [esp + 0x14]
add ebx, eax
adc ebp, edi
mov esi, dword [esp + 0x2c]
mov ecx, ebx
sub ecx, dword [0x636950]
mov eax, ebp
mov dword [0x636958], ecx
sbb eax, dword [0x636954]
cmp byte [0x633a48], 0
mov dword [0x63695c], eax
mov dword [0x636950], ebx
mov dword [0x636954], ebp
mov dword [esi], ecx
mov dword [esi + 4], eax
je 0x48d14d
push 0
lea eax, [edx*8]
push eax
push dword [0x63376c]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x63376c]
test eax, eax
jns 0x48d1d4
movzx eax, word [0x633a4a]
shl eax, 3
push eax
push 0
push esi
call fcn.005861d0
add esp, 0xc
jmp 0x48d1d4
xor eax, eax
xor ebp, ebp
mov word [esp + 0x3c], ax
cmp ax, word [0x633a4c]
jae 0x48d1ce
nop
push dword [esp + 0x3c]
call sym.SystemInformer.exe_Ordinal_1505
movzx eax, ax
movzx edi, ax
push 0
mov dword [esp + 0x30], eax
mov eax, dword [0x63376c]
movzx ebx, bp
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [esp + 0x4c]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x63376c]
nop dword [eax]
test eax, eax
jns 0x48d1b3
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.005861d0
add esp, 0xc
mov ax, word [esp + 0x3c]
add ebp, dword [esp + 0x2c]
inc ax
mov word [esp + 0x3c], ax
cmp ax, word [0x633a4c]
jb 0x48d160
jmp 0x48d1d4
mov esi, dword [0x63376c]
movzx edi, word [0x633a4a]
xorps xmm0, xmm0
xor ecx, ecx
movlpd qword [esp + 0x18], xmm0
test edi, edi
je 0x48d245
cmp edi, 4
jb 0x48d245
mov edx, edi
lea eax, [esi + 0x10]
and edx, 0xfffffffc
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [eax]
movq xmm0, qword [eax - 0x10]
lea eax, [eax + 0x20]
movhpd xmm0, qword [eax - 0x28]
add ecx, 4
paddq xmm2, xmm0
movq xmm0, qword [eax - 0x20]
movhpd xmm0, qword [eax - 0x18]
paddq xmm1, xmm0
cmp ecx, edx
jb 0x48d200
paddq xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
paddq xmm1, xmm0
movd ebx, xmm1
psrldq xmm1, 4
movd ebp, xmm1
jmp 0x48d24d
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x24], ebp
xorps xmm0, xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x30], xmm0
cmp ecx, edi
jae 0x48d2fc
mov edx, dword [esp + 0x34]
mov eax, edi
sub eax, ecx
cmp eax, 2
jb 0x48d2d5
lea eax, [edi - 1]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
nop dword [eax + eax]
add edi, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esi + ecx*8 + 8]
adc edx, dword [esi + ecx*8 + 0xc]
add ecx, 2
cmp ecx, dword [esp + 0x2c]
jb 0x48d2a0
mov dword [esp + 0x28], edi
movzx edi, word [0x633a4a]
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
cmp ecx, edi
jae 0x48d2f0
jmp 0x48d2e9
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
add ebx, dword [esi + ecx*8]
adc ebp, dword [esi + ecx*8 + 4]
add eax, dword [esp + 0x28]
adc edx, dword [esp + 0x14]
add ebx, eax
adc ebp, edx
mov ecx, ebx
mov eax, ebp
sub ecx, dword [0x636960]
pop edi
sbb eax, dword [0x636964]
pop esi
mov dword [0x636964], ebp
mov dword [0x636968], ecx
mov ecx, dword [esp + 0x3c]
pop ebp
mov dword [0x636960], ebx
pop ebx
xor ecx, esp
mov dword [0x63696c], eax
call fcn.00583f9f
add esp, 0x3c
ret