Function at 0x4c11f0
Capabilities:
Get system information on windows

Disassembly:
mov edx, dword [0x5863dc]
sub esp, 0x64
push ebx
xor ebx, ebx
push ebp
push esi
cmp edx, ebx
push edi
jne 0x4c1227
push 0x5000
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov edi, eax
mov ecx, 0x400
xor eax, eax
mov dword [0x5863dc], edi
rep stosd dword es:[edi], eax
mov edx, dword [0x5863dc]
mov edi, dword [esp + 0x7c]
xor esi, esi
mov eax, edx
cmp dword [eax], edi
je 0x4c1295
inc esi
add eax, 0x14
cmp esi, 0x400
jl 0x4c122f
xor ecx, ecx
mov eax, edx
cmp dword [eax], ebx
je 0x4c1262
inc ecx
add eax, 0x14
cmp ecx, 0x400
jl 0x4c1243
call fcn.004c11d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret
lea eax, [ecx + ecx*4]
mov esi, ecx
shl eax, 2
mov dword [eax + edx], edi
mov edx, dword [0x5863dc]
mov dword [eax + edx + 4], ebx
mov edx, dword [0x5863dc]
mov dword [eax + edx + 8], ebx
mov edx, dword [0x5863dc]
mov dword [eax + edx + 0xc], ebx
mov edx, dword [0x5863dc]
mov dword [eax + edx + 0x10], ebx
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x44]
push edx
mov edx, dword [esp + 0x80]
lea ecx, [esp + 0x50]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x4c1417
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [esp + 0x64]
lea ecx, [esp + 0x20]
push ecx
call fcn.004c1c90
mov ebp, edx
lea edx, [esp + 0x2c]
push edx
mov ebx, eax
call fcn.004c1c90
add esp, 8
add ebx, eax
mov eax, edi
adc ebp, edx
cdq
push edx
push eax
push ebp
push ebx
call fcn.0051c720
mov dword [esp + 0x10], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x18], edx
call fcn.004c1c90
lea esi, [esi + esi*4]
mov dword [esp + 0x20], edx
mov edx, dword [0x5863dc]
mov ebx, eax
shl esi, 2
add esp, 4
mov dword [esp + 0x18], ebx
mov ecx, dword [esi + edx + 4]
mov eax, dword [esi + edx + 8]
lea edi, [esi + edx + 4]
mov ebp, ecx
or ebp, eax
je 0x4c13f3
mov ebp, dword [esi + edx + 0xc]
mov edx, dword [esi + edx + 0x10]
mov dword [esp + 0x38], ebp
or ebp, edx
je 0x4c13f3
mov ebp, dword [esp + 0x38]
sub ebx, ebp
mov ebp, dword [esp + 0x1c]
sbb ebp, edx
mov edx, ebx
or edx, ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebp
je 0x4c1417
mov edx, dword [esp + 0x10]
push 0
sub edx, ecx
mov ecx, dword [esp + 0x18]
sbb ecx, eax
push 0x64
push ecx
push edx
call fcn.0051c6e0
push 0
push 2
mov ecx, eax
push ebp
push ebx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x88], edx
call fcn.0051c630
mov ecx, dword [esp + 0x7c]
add ecx, eax
mov eax, dword [esp + 0x78]
adc eax, edx
mov edx, ebp
push edx
mov edx, ebx
push edx
push eax
push ecx
call fcn.0051c630
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov ecx, dword [0x5863dc]
mov edx, dword [esp + 0x18]
pop edi
mov dword [esi + ecx + 0xc], edx
mov ecx, dword [0x5863dc]
mov edx, dword [esp + 0x18]
mov dword [esi + ecx + 0x10], edx
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ecx
mov edx, dword [0x5863dc]
mov ecx, dword [esp + 0x1c]
mov dword [esi + edx + 0xc], ebx
mov eax, dword [0x5863dc]
mov dword [esi + eax + 0x10], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x64
ret