Function at 0x100054b0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x19c]
lea edx, [ebp - 0x230]
push ebx
push ecx
sub esp, 0x26c
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x19e]
mov dword [ebp - 0x19e], 0
sub ecx, edi
add ecx, 0x62
mov dword [ebp - 0x254], eax
xor eax, eax
shr ecx, 2
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x140], 0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x234]
call sym._get_logical_processor_count
mov edx, dword [ebp - 0x230]
mov ecx, 0x40
mov dword [ebp - 0x25c], eax
mov eax, ebx
call sym._resize_table
test eax, eax
je 0x10005d61
lea eax, [ebp - 0x13c]
mov esi, 0x100236a6
call sym._get_processor_manufacturer.constprop.0
lea eax, [ebp - 0xd8]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov dword [ebp - 0x240], eax
call eax
mov edx, str.32_bit
mov eax, str.64_bit
sub esp, 4
cmp word [ebp - 0xd8], 9
cmovne eax, edx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_wcscmp]
mov dword [ebp - 0x23c], eax
call eax
test eax, eax
jne 0x10005be0
xor ecx, ecx
mov eax, 1
cpuid
mov dword [ebp - 0x1c4], edx
mov edx, eax
shr edx, 8
mov dword [ebp - 0x1c8], ecx
mov ecx, eax
shr ecx, 4
mov dword [ebp - 0x1cc], ebx
and edx, 0xf
mov ebx, 0x8040
and ecx, 0xf
bt ebx, edx
jb 0x10005bb0
and eax, 0xf
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
lea eax, [ebp - 0xd8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 8], str._s_Family__u_Model__u_Stepping__u
mov dword [esp + 4], 0x64
mov dword [esp], eax
call sym._swprintf
mov eax, 1
mov ecx, esi
cpuid
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x138], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1f2]
mov dword [esp + 0xc], edx
mov dword [esp + 8], str._08X_08X
mov dword [esp + 4], 0x11
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x228]
call sym._get_processor_manufacturer.constprop.0
mov eax, 0x80000000
mov ecx, esi
cpuid
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
cmp eax, 0x80000003
ja 0x10005c48
cmp word [ebp - 0x19e], 0
lea eax, [ebp - 0x19e]
je 0x100056b9
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x10005680
mov edx, eax
lea edi, [ebp - 0x19e]
sub edx, edi
test edx, edx
jg 0x100056b2
jmp 0x100056b9
xor esi, esi
sub eax, 2
lea edi, [ebp - 0x19e]
mov word [eax], si
cmp edi, eax
je 0x100056b9
cmp word [eax - 2], 0x20
je 0x100056a0
xor ecx, ecx
mov eax, 1
cpuid
mov dword [ebp - 0x1c8], ecx
mov ecx, eax
shr ecx, 8
mov dword [ebp - 0x1c4], edx
mov edx, eax
shr edx, 4
mov dword [ebp - 0x1cc], ebx
and ecx, 0xf
mov ebx, 0x8040
and edx, 0xf
bt ebx, ecx
jae 0x100056fb
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf0
or edx, ecx
and eax, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x13c]
mov dword [esp + 8], str.Model__u_Stepping__u
mov dword [esp + 4], 0x32
mov dword [esp], eax
call sym._swprintf
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x10005d50
mov ebx, dword [ebp - 0x254]
xor eax, eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x258], 0
mov edi, dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebp - 0x250], 0
test ebx, ebx
mov ebx, ecx
mov dword [ebp - 0x238], 0
setne al
mov dword [ebp - 0x260], eax
jmp 0x100057c8
mov eax, dword [ebp - 0x1d0]
or eax, dword [ebp - 0x1cc]
je 0x10005d30
add dword [ebp - 0x250], 0x40
mov esi, dword [ebp - 0x260]
add dword [ebp - 0x258], 1
add dword [ebp - 0x238], 1
mov ebx, dword [ebp - 0x230]
mov eax, dword [ebp - 0x238]
add dword [ebp - 0x244], 0x18
cmp eax, ebx
jae 0x10005b80
mov eax, dword [ebp - 0x248]
mov esi, dword [ebp - 0x250]
add esi, dword [eax + 0x14]
lea eax, [ebp - 0x1d0]
mov dword [esp], eax
mov eax, dword [ebp - 0x240]
call eax
mov ecx, str.64_bit
mov edx, str.32_bit
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmove edx, ecx
mov dword [esp + 4], str.32_bit
mov dword [esp], edx
mov edx, dword [ebp - 0x23c]
call edx
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi], ax
lea eax, [ebp - 0x1d0]
mov dword [esp], eax
mov eax, dword [ebp - 0x240]
call eax
mov ecx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmove eax, ecx
mov dword [esp + 4], str.32_bit
mov dword [esp], eax
mov edx, dword [ebp - 0x23c]
call edx
neg eax
sbb ax, ax
and eax, 9
mov word [esi + 2], ax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call edi
mov edx, 1
mov dword [esi + 4], eax
lea eax, [ebp - 0x1d0]
mov word [esi + 8], dx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, 0x18
sub esp, 0x10
test eax, eax
jne 0x100058c0
movzx eax, byte [ebp - 0x1a8]
lea ecx, [eax + eax*2]
shl ecx, 3
mov dword [esp], ecx
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10005d75
mov ecx, dword [ebp - 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [ebp - 0x24c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, dword [ebp - 0x24c]
mov ecx, eax
sub esp, 0x14
mov eax, 0x3e8
test ecx, ecx
jne 0x10005926
mov eax, dword [ebp - 0x244]
mov eax, dword [edx + eax + 8]
mov dword [ebp - 0x24c], eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0xa], eax
lea eax, [ebp - 0x1d0]
mov dword [esp], eax
mov eax, dword [ebp - 0x240]
call eax
mov edx, str.64_bit
mov eax, str.32_bit
sub esp, 4
cmp word [ebp - 0x1d0], 9
cmove eax, edx
mov dword [esp + 4], str.32_bit
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
cmp eax, 1
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x40
mov word [esi + 0xe], ax
lea eax, [ebp - 0xd8]
mov dword [esp], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], str.CPU_u
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20e]
mov dword [esp + 4], 0xe
mov dword [esp], eax
call sym._swprintf
lea eax, [ebp - 0x20e]
mov dword [esp], eax
call edi
mov dword [esi + 0x18], 0xf0002
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x228]
mov dword [esp], eax
call edi
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, 0x18
sub esp, 0x10
test eax, eax
jne 0x10005a22
movzx eax, byte [ebp - 0x1a8]
lea ecx, [eax + eax*2]
shl ecx, 3
mov dword [esp], ecx
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10005d6b
mov ecx, dword [ebp - 0x24c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [ebp - 0x24c], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xb
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edx, dword [ebp - 0x24c]
mov ecx, eax
sub esp, 0x14
mov eax, 0x3e8
test ecx, ecx
jne 0x10005a88
mov eax, dword [ebp - 0x244]
mov eax, dword [edx + eax + 4]
mov dword [ebp - 0x24c], eax
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x19e]
mov dword [esp], eax
call edi
xor edx, edx
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x234]
div ebx
xor edx, edx
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0x25c]
div ebx
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x1f2]
mov dword [esp], eax
call edi
xor ecx, ecx
mov dword [esi + 0x30], eax
mov eax, 3
mov word [esi + 0x34], ax
mov eax, 1
cpuid
mov dword [ebp - 0x1cc], ebx
mov dword [ebp - 0x1c8], ecx
mov dword [ebp - 0x1c4], edx
mov word [esi + 0x36], ax
lea eax, [ebp - 0x13c]
mov dword [esi + 0x38], 0
mov dword [esp], eax
call edi
mov ebx, dword [ebp - 0x254]
mov dword [esi + 0x3c], eax
test ebx, ebx
je 0x10005792
lea eax, [ebp - 0x22c]
mov dword [esp + 8], ebx
mov esi, 0xffffffff
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1d0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call sym._eval_cond
test eax, eax
je 0x10005780
mov eax, dword [ebp - 0x238]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x248]
mov dword [esp], eax
call sym._free_row_values
jmp 0x100057a6
mov ebx, esi
test byte [0x1002179c], 8
jne 0x10005c10
mov eax, dword [ebp - 0x248]
mov edi, dword [ebp - 0x258]
mov dword [eax + 0xc], edi
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov ebx, eax
shr ebx, 0xc
and ebx, 0xf0
or ecx, ebx
cmp edx, 0xf
jne 0x10005d40
mov edx, eax
shr edx, 0x14
movzx edx, dl
add edx, 0xf
jmp 0x100055c8
lea eax, [ebp - 0x13c]
mov dword [esp + 4], str.AuthenticAMD
mov esi, str.Intel64
mov dword [esp], eax
mov eax, dword [ebp - 0x23c]
call eax
test eax, eax
mov eax, str.AMD64
cmove esi, eax
jmp 0x1000558f
mov eax, dword [ebp - 0x258]
mov dword [esp + 0xc], str.created__u_rows_n
mov dword [esp + 8], str.fill_processor
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x1002179c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10005b8f
mov eax, 0x80000002
mov ecx, esi
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
nop
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x19e], dx
add eax, 1
cmp eax, 0x10
jne 0x10005c70
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x17e], ax
mov eax, 0x80000003
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x17e], dx
add eax, 1
cmp eax, 0x10
jne 0x10005cb8
xor eax, eax
xor ecx, ecx
mov word [ebp - 0x15e], ax
mov eax, 0x80000004
cpuid
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], eax
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax - 0x13c]
mov word [ebp + eax*2 - 0x15e], dx
add eax, 1
cmp eax, 0x10
jne 0x10005d00
xor edi, edi
mov word [ebp - 0x13e], di
jmp 0x1000566d
mov esi, 1
jmp 0x10005b5e
mov edx, 6
jmp 0x100055c8
mov dword [ebp - 0x258], 0
xor ebx, ebx
jmp 0x10005b82
mov ebx, 0xffffffff
jmp 0x10005b9e
mov eax, 0x3e8
jmp 0x10005a9d
mov eax, 0x3e8
jmp 0x1000593b