Function at 0x48a6e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62a040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x630f0c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
je 0x48a745
movzx eax, word [0x630f0e]
push 0
shl eax, 3
push eax
push dword [0x630c24]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x630c24]
test eax, eax
jns 0x48a7d1
movzx eax, word [0x630f0e]
shl eax, 3
push eax
push 0
push esi
call fcn.0057e450
add esp, 0xc
jmp 0x48a7d1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x630f10]
jae 0x48a7cb
lea esp, [esp]
push dword [ebp - 0xc]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x630c24]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x630c24]
test eax, eax
jns 0x48a7ac
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.0057e450
add esp, 0xc
mov ax, word ds:[ebp - 0xc]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x630f10]
jb 0x48a760
jmp 0x48a7d1
mov esi, dword [0x630c24]
movzx edi, word [0x630f0e]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
cmp edi, 2
jb 0x48a821
lea esi, [edi - 1]
xor edi, edi
mov dword [ebp - 0x14], esi
mov esi, dword [0x630c24]
lea esp, [esp]
add ecx, dword [esi + eax*8]
adc edx, dword [esi + eax*8 + 4]
add ebx, dword [esi + eax*8 + 8]
adc edi, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x14]
jb 0x48a800
mov dword [ebp - 0x10], edi
movzx edi, word [0x630f0e]
cmp eax, edi
jae 0x48a838
mov edi, dword [esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 8], edi
movzx edi, word [0x630f0e]
jmp 0x48a83a
xor esi, esi
add ecx, ebx
mov ebx, dword [ebp - 8]
adc edx, dword [ebp - 0x10]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x633d10]
mov edx, dword [ebp - 0x18]
mov eax, esi
sbb eax, dword [0x633d14]
cmp byte [0x630f0c], 0
mov dword [0x633d18], ecx
mov dword [0x633d1c], eax
mov dword [0x633d10], ebx
mov dword [0x633d14], esi
mov dword [edx], ecx
mov dword [edx + 4], eax
je 0x48a8bc
push 0
lea eax, [edi*8]
push eax
push dword [0x630c2c]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x48a93b
movzx eax, word [0x630f0e]
mov esi, dword [0x630c2c]
shl eax, 3
push eax
push 0
push esi
call fcn.0057e450
add esp, 0xc
jmp 0x48a93b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x630f10]
jae 0x48a93b
push dword [ebp - 8]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [0x630c2c]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 8]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x630c2c]
test eax, eax
jns 0x48a91f
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.0057e450
add esp, 0xc
mov ax, word [ebp - 8]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x630f10]
jb 0x48a8d0
movzx eax, word [0x630f0e]
xor ebx, ebx
mov esi, dword [0x630c2c]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp word [0x630f0e], 2
jb 0x48a98c
movzx ebx, word [0x630f0e]
dec ebx
mov dword [ebp - 0x18], ebx
mov ebx, eax
add edi, dword [esi + eax*8]
adc ebx, dword [esi + eax*8 + 4]
add ecx, dword [esi + eax*8 + 8]
adc edx, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x18]
jb 0x48a972
mov dword [ebp - 0x10], ebx
cmp eax, dword [ebp - 0x1c]
jae 0x48a9a2
mov ebx, dword ds:[esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
jmp 0x48a9a4
xor esi, esi
add ecx, edi
pop edi
adc edx, ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x633d20]
mov eax, esi
mov dword [0x633d28], ecx
sbb eax, dword [0x633d24]
mov ecx, dword [ebp - 4]
mov dword [0x633d24], esi
xor ecx, ebp
pop esi
mov dword [0x633d20], ebx
mov dword [0x633d2c], eax
pop ebx
call fcn.0057c26f
mov esp, ebp
pop ebp
ret