Function at 0x4d5420
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
sub eax, 0x947
je 0x4d5809
sub eax, 1
jne 0x4d5964
mov ecx, dword ds:[edi + 0xc]
cmp ecx, dword [edi + 0x10]
jae 0x4d5964
cmp dword [0x635b64], ecx
je 0x4d57e8
add ecx, dword [0x636b8c]
mov eax, dword [0x636b90]
and ecx, dword [0x636b84]
push 0
push 0x10
mov dword [ebp - 0x1a0], 3
mov esi, dword [eax + ecx*4]
xor eax, eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x6d
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1ac], 0x16
mov dword [ebp - 0x1a4], 0x18
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x4d576c
cmp dword ds:[ebp - 0x194], 0
je 0x4d576c
cmp dword [ebp - 0x190], 0
je 0x4d576c
mov eax, dword ds:[ebp - 0x198]
fild dword [ebp - 0x198]
test eax, eax
jns 0x4d552a
fadd qword [0x61c8f0]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
fmul qword [0x61c840]
mov eax, dword [ebp - 0x194]
fild dword [ebp - 0x194]
test eax, eax
jns 0x4d5552
fadd qword [0x61c8f0]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
mov eax, dword [ebp - 0x190]
fmul st(1)
fild dword [ebp - 0x190]
test eax, eax
jns 0x4d5576
fadd qword [0x61c8f0]
fstp qword [ebp - 0x1a8]
mov eax, esi
mov ecx, 0x1000
fdiv qword [ebp - 0x1a8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x178], 0x22
mov dword [ebp - 0x174], 0x606114
mov dword [ebp - 0x170], 0xc
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x130], 0x26
mov dword [ebp - 0x12c], str.Compressed_memory:
mul ecx
fld st(0)
fsub st(2)
fld qword [0x61c8c8]
fmul st(3), st(0)
mov dword [ebp - 0x160], eax
mov eax, 0xa
mov dword [ebp - 0x15c], edx
mov word [ebp - 0x148], ax
fmul st(3), st(0)
fmul st(2), st(0)
fmul st(2), st(0)
fmul st(1), st(0)
fmulp st(1)
fld qword [0x61c908]
fxch st(3)
fcomi st(3)
jb 0x4d562c
fsub st(3)
fxch st(3)
fcomi st(3)
jbe 0x4d562a
add esi, ebx
adc ebx, 0x80000000
fxch st(3)
call fcn.0059f9b0
add eax, esi
mov dword [ebp - 0x128], 0xc
mov dword [ebp - 0x118], eax
fxch st(1)
adc edx, ebx
mov dword [ebp - 0x110], 0
mov eax, 0xa
mov dword [ebp - 0x114], edx
xor esi, esi
mov word [ebp - 0x100], ax
xor ebx, ebx
mov dword [ebp - 0xf8], 1
fcomi st(2)
mov dword [ebp - 0xe8], 0x24
mov dword [ebp - 0xe4], str.Total_compressed:
jb 0x4d569b
fsub st(2)
fxch st(2)
fcomi st(2)
jbe 0x4d5699
add esi, ebx
adc ebx, 0x80000000
fxch st(2)
jmp 0x4d56a0
call fcn.0059f9b0
add eax, esi
mov dword [ebp - 0xe0], 0xc
mov dword [ebp - 0xd0], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0xc8], 0
xor esi, esi
mov dword [ebp - 0xcc], edx
xor ebx, ebx
mov word [ebp - 0xb8], ax
fcomi st(1)
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x28
mov dword [ebp - 0x9c], str.Total_memory_saved:
jb 0x4d570d
fsub st(1)
fxch st(1)
fcompi st(1)
jbe 0x4d570f
add esi, ebx
adc ebx, 0x80000000
jmp 0x4d570f
fstp st(1)
call fcn.0059f9b0
push dword [edi + 0xc]
add eax, esi
mov dword [ebp - 0x98], 0xc
mov dword [ebp - 0x88], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0x80], 0
push 0
mov dword [ebp - 0x84], edx
mov word [ebp - 0x70], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 0xd
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x58], ecx
jmp 0x4d57be
push dword [edi + 0xc]
mov ecx, 0x1000
mov dword [ebp - 0x50], 0xc
mov eax, esi
mov dword [ebp - 0x38], 0
mul ecx
push 0
mov dword [ebp - 0x40], eax
mov eax, 0xa
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x28], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
push eax
call sym.SystemInformer.exe_PhFormat
mov ecx, dword [0x635b60]
mov dword [0x635b60], eax
test ecx, ecx
je 0x4d57e8
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d57e8
call fcn.004fbe40
mov eax, dword [0x635b60]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0xc]
mov ecx, 0x1003
cmp byte [0x636aa0], 0
mov eax, 3
cmovne eax, ecx
mov dword [esi + 8], eax
mov eax, dword [0x635b70]
mov eax, dword [eax + 0x40]
push dword [eax + 0x3c]
push 0
push dword [0x636a00]
push esi
call sym.SystemInformer.exe__PhSiSetColorsGraphDrawInfo_16
push dword [0x636b88]
push dword [edi + 0xc]
push 0x635b4c
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
cmp byte [0x635b58], 0
jne 0x4d5964
cmp byte [0x636ac8], 0
mov eax, dword [esi + 0x14]
je 0x4d587b
push eax
push dword [0x635b4c]
push 0x636b80
call sym.SystemInformer.exe_PhCopyConvertCircularBufferULONG
jmp 0x4d58ca
xor edx, edx
test eax, eax
je 0x4d58ca
jmp 0x4d5890
mov ecx, dword [0x636b8c]
mov eax, dword [0x636b90]
add ecx, edx
and ecx, dword [0x636b84]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
test eax, eax
jns 0x4d58bc
fadd dword [0x61c91c]
mov eax, dword [0x635b4c]
fstp dword [eax + edx*4]
inc edx
cmp edx, dword [esi + 0x14]
jb 0x4d5890
mov eax, dword [0x6340b8]
test eax, eax
je 0x4d5905
push dword [esi + 0x14]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
jns 0x4d58ea
fadd dword [0x61c91c]
fstp dword [ebp - 0x1a4]
fld dword [ebp - 0x1a4]
push ecx
fstp dword [esp]
push dword [0x635b4c]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
cmp byte [0x636aa0], 0
je 0x4d595d
mov dword [esi + 0x48], sym.SystemInformer.exe__PhSiSizeLabelYFunction_16
mov ecx, 0x1000
mov eax, dword [0x6340b8]
mul ecx
mov dword [ebp - 0x1a8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x1a4], edx
fild qword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
fild qword [ebp - 0x1a8]
fchs
faddp st(1)
fstp dword [esi + 0x4c]
mov byte [0x635b58], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057ee0f
mov esp, ebp
pop ebp
ret