Function at 0x4889c0
Capabilities:
Get memory capacity
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push edi
mov ecx, 0x10
xor eax, eax
xor edx, edx
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x198]
mov edi, ebx
sub esp, 0x260
rep stosd dword es:[edi], eax
mov dword [ebp + eax - 0x214], edx
add eax, 4
cmp eax, 0x20
jb 0x4889ea
mov eax, dword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
mov esi, dword fs:[0x18]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], ebx
mov dword [ebp - 0x238], eax
call eax
sub esp, 4
mov edi, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe00
xor eax, eax
test edi, edi
sete al
mov dword [esp + 4], str.GlobalMemoryStatusEx_succeeded_n
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe01
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5a0e90
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esi + 0x34], 0x57
sete al
mov dword [esp], eax
call fcn.00488240
mov ecx, dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
lea edx, [ebp - 0x214]
mov dword [esi + 0x34], 0xdeadbeef
mov dword [esp], edx
mov dword [ebp - 0x240], ecx
call ecx
sub esp, 4
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe04
mov eax, dword [esi + 0x34]
mov dword [esp + 4], 0x5a0e90
mov dword [esp + 8], eax
xor eax, eax
cmp dword [esi + 0x34], 0xdeadbeef
sete al
mov dword [esp], eax
call fcn.00488240
lea eax, [ebp - 0x1f4]
mov edi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x2c
mov dword [esp + 4], eax
mov dword [esp], 0
call edi
sub esp, 0x10
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe07
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtQuerySystemInformation_returned__lx_n
call fcn.00488240
lea eax, [ebp - 0x158]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x148
mov dword [esp + 4], eax
mov dword [esp], 2
call edi
sub esp, 0x10
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe09
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtQuerySystemInformation_returned__lx_n
call fcn.00488240
lea eax, [ebp - 0x1c8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], eax
mov dword [esp + 4], 3
mov dword [esp], 0xffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
sub esp, 0x14
mov esi, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe0b
xor eax, eax
test esi, esi
sete al
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], str.NtQueryInformationProcess_returned__lx_n
call fcn.00488240
lea edx, [ebp - 0x214]
mov dword [ebp - 0x214], 0x20
mov dword [esp], edx
mov ecx, dword [ebp - 0x240]
call ecx
mov dword [ebp - 0x198], 0x40
sub esp, 4
mov dword [esp], ebx
mov eax, dword [ebp - 0x238]
call eax
sub esp, 4
mov ebx, eax
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe10
mov dword [esp], ebx
mov dword [esp + 4], str.GlobalMemoryStatusEx_succeeded_n
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe12
mov dword [esp + 4], str.got_0_PageSize_n
mov eax, dword [ebp - 0x1ec]
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe13
mov dword [esp + 4], str.got_0_MmNumberOfPhysicalPages_n
mov eax, dword [ebp - 0x1e8]
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe14
xor eax, eax
mov dword [esp + 4], str.got_0_HighestUserAddress_n
mov esi, dword [ebp - 0x1d4]
test esi, esi
setne al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe15
xor eax, eax
mov dword [esp + 4], str.got_0_LowestUserAddress_n
mov edi, dword [ebp - 0x1d8]
test edi, edi
setne al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe16
mov dword [esp + 4], str.got_0_TotalCommittedPages_n
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe17
mov dword [esp + 4], str.got_0_TotalCommitLimit_n
mov eax, dword [ebp - 0x124]
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe18
mov dword [esp + 4], str.got_0_AvailablePages_n
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
call fcn.00488240
mov ecx, dword [ebp - 0x190]
mov ebx, dword [ebp - 0x18c]
mov eax, ecx
sub eax, dword [ebp - 0x188]
mov edx, ebx
mov esi, ecx
mov dword [ebp - 0x238], eax
mov eax, ecx
sbb edx, dword [ebp - 0x184]
mov edi, ebx
shrd eax, ebx, 0x14
shr edi, 8
and esi, 0xfffff
mov dword [ebp - 0x234], edx
and eax, 0xfffff
add esi, eax
mov eax, edi
mov edi, ebx
and eax, 0xfffff
shr edi, 0x1c
add esi, eax
mov eax, 0x51eb851f
add esi, edi
xor edi, edi
mul esi
shr edx, 3
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
sub esi, eax
sub ecx, esi
sbb ebx, edi
imul eax, ecx, 0x8f5c28f5
imul ebx, ebx, 0xc28f5c29
add ebx, eax
mov eax, 0xc28f5c29
mul ecx
add edx, ebx
shrd eax, edx, 2
shr edx, 2
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x238]
mov edx, dword [ebp - 0x234]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.0057e760
mov ecx, dword [ebp - 0x1ec]
mov ebx, dword [ebp - 0x124]
mov dword [ebp - 0x218], eax
mov eax, ecx
mul dword [ebp - 0x1e8]
mov dword [ebp - 0x238], eax
mov eax, ecx
mov dword [ebp - 0x234], edx
mul dword [ebp - 0x12c]
mov esi, eax
mov eax, ecx
mov edi, edx
mul ebx
sub ebx, dword [ebp - 0x128]
mov dword [ebp - 0x240], eax
mov eax, ebx
mov ebx, dword [ebp - 0x1d4]
mov dword [ebp - 0x23c], edx
mul ecx
mov dword [ebp - 0x248], eax
lea eax, [ebx + 1]
sub eax, dword [ebp - 0x1d8]
xor ebx, ebx
mov ecx, eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x244], edx
xor edx, edx
mov dword [ebp - 0x250], ecx
sub ecx, eax
mov dword [ebp - 0x24c], ebx
sbb ebx, edx
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], ebx
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe26
mov eax, dword [ebp - 0x194]
mov dword [esp + 4], str.got_dwMemoryLoad__lu_n
mov dword [esp + 8], eax
cmp dword [ebp - 0x218], eax
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe27
mov ecx, dword [ebp - 0x190]
mov ebx, dword [ebp - 0x18c]
mov dword [esp + 4], str.got_ullTotalPhys__I64x_n
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x238]
mov edx, dword [ebp - 0x234]
xor eax, ecx
xor edx, ebx
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe28
mov ecx, dword [ebp - 0x188]
mov ebx, dword [ebp - 0x184]
mov dword [esp + 4], str.got_ullAvailPhys__I64x_n
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov edx, dword [ebp - 0x1ec]
shl edx, 8
mov eax, edx
xor edx, edx
add eax, ecx
adc edx, ebx
sub eax, esi
sbb edx, edi
mov edi, dword [ebp - 0x1ec]
xor ebx, ebx
shl edi, 9
cmp edi, eax
mov edi, ebx
sbb edi, edx
setae al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe29
mov ecx, dword [ebp - 0x180]
mov ebx, dword [ebp - 0x17c]
mov dword [esp + 4], str.got_ullTotalPageFile__I64x_n
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov esi, dword [ebp - 0x240]
mov edi, dword [ebp - 0x23c]
xor esi, ecx
xor edi, ebx
mov eax, esi
or eax, edi
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
xor edx, edx
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe2a
mov esi, dword [ebp - 0x1ec]
mov ecx, dword [ebp - 0x178]
mov ebx, dword [ebp - 0x174]
mov dword [esp + 4], str.got_ullAvailPageFile__I64x_n
mov edi, esi
shl edi, 8
mov dword [esp + 8], ecx
mov eax, edi
mov dword [esp + 0xc], ebx
add eax, ecx
adc edx, ebx
sub eax, dword [ebp - 0x248]
sbb edx, dword [ebp - 0x244]
xor ebx, ebx
shl esi, 9
mov edi, ebx
cmp esi, eax
sbb edi, edx
setae al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe2b
mov ecx, dword [ebp - 0x170]
mov ebx, dword [ebp - 0x16c]
mov dword [esp + 4], str.got_ullTotalVirtual__I64x_n
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ebx
mov eax, dword [ebp - 0x250]
mov edx, dword [ebp - 0x24c]
xor eax, ecx
xor edx, ebx
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe2c
mov edx, dword [ebp - 0x168]
mov eax, dword [ebp - 0x164]
mov dword [esp + 4], str.got_ullAvailVirtual__I64x_n
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov ecx, dword [ebp - 0x258]
mov ebx, dword [ebp - 0x254]
cmp ecx, edx
mov edi, ebx
sbb edi, eax
setae al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe2d
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
mov dword [esp + 4], str.got_ullAvailExtendedVirtual__I64x_n
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe2f
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], str.got_dwMemoryLoad__lu_n
mov dword [esp + 8], eax
cmp dword [ebp - 0x194], eax
sete al
xor ebx, ebx
movzx eax, al
mov edi, ebx
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe30
mov esi, dword [ebp - 0x190]
mov eax, 0x7fffffff
mov edx, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x20c]
cmp eax, esi
sbb edi, edx
cmovae eax, esi
cmovb edx, ebx
mov ebx, 1
xor eax, ecx
or eax, edx
je 0x48919c
mov ebx, dword [0x8f0770]
test ebx, ebx
sete al
xor ebx, ebx
cmp ecx, 0xffffffff
sete bl
and ebx, eax
mov dword [esp + 8], ecx
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], str.got_dwTotalPhys__Ix_n
call fcn.00488240
call fcn.0057d110
mov edx, 0x7fffffff
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe33
mov edi, dword [ebp - 0x1ec]
mov esi, dword [ebp - 0x208]
mov eax, edi
shl eax, 8
mov ecx, eax
xor eax, eax
cmp edx, dword [ebp - 0x188]
mov edx, eax
sbb edx, dword [ebp - 0x184]
mov edx, 0x7fffffff
cmovae eax, dword [ebp - 0x184]
cmovae edx, dword [ebp - 0x188]
mov dword [ebp - 0x21c], eax
mov eax, esi
mov dword [ebp - 0x220], edx
sub ecx, dword [ebp - 0x220]
sbb ebx, dword [ebp - 0x21c]
xor edx, edx
add eax, ecx
adc edx, ebx
shl edi, 9
xor ebx, ebx
cmp edi, eax
mov edi, ebx
mov eax, 1
sbb edi, edx
jae 0x489246
mov edx, dword [0x8f0770]
test edx, edx
sete dl
xor eax, eax
cmp esi, 0xffffffff
sete al
and eax, edx
mov dword [esp], eax
mov ebx, 0
mov dword [esp + 8], esi
mov dword [esp + 4], str.got_dwAvailPhys__Ix_n
call fcn.00488240
mov eax, 0xfff7ffff
cmp eax, dword [ebp - 0x180]
mov eax, 0
sbb eax, dword [ebp - 0x17c]
jae 0x489283
mov eax, dword [0x8f0770]
xor ebx, ebx
test eax, eax
setne bl
call fcn.0057d110
mov edi, dword [eax + 0x10]
mov dword [eax + 0x14], 1
lea edx, [edi + edi]
or edx, ebx
mov dword [eax + 0x10], edx
jmp 0x489308
call fcn.0057d110
xor edx, edx
mov ecx, 0xffffffff
mov dword [eax], 0x5a0c14
mov ebx, edx
mov dword [eax + 4], 0xe39
mov eax, dword [ebp - 0x204]
mov dword [esp + 4], str.got_dwTotalPageFile__Ix_n
mov dword [esp + 8], eax
cmp ecx, dword [ebp - 0x180]
sbb ebx, dword [ebp - 0x17c]
cmovae edx, dword [ebp - 0x17c]
cmovae ecx, dword [ebp - 0x180]
mov edi, edx
xor edx, edx
mov ebx, edi
xor ecx, eax
xor eax, eax
xor ebx, edx
or ecx, ebx
sete al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
shr dword [eax + 0x10], 1
call fcn.0057d110
mov edx, dword [eax + 0x14]
mov dword [eax + 0x14], 0
test edx, edx
jne 0x4892a0
call fcn.0057d110
xor ecx, ecx
xor edx, edx
mov ebx, 0xffffffff
mov dword [eax], 0x5a0c14
mov edi, ecx
mov dword [eax + 4], 0xe3a
mov esi, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], str.got_dwAvailPageFile__Ix_n
mov dword [esp + 8], eax
mov eax, esi
shl eax, 8
cmp ebx, dword [ebp - 0x178]
sbb edi, dword [ebp - 0x174]
cmovae ecx, dword [ebp - 0x174]
cmovae ebx, dword [ebp - 0x178]
mov dword [ebp - 0x224], ecx
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x228], ebx
sub eax, dword [ebp - 0x228]
sbb edx, dword [ebp - 0x224]
xor ebx, ebx
add ecx, eax
adc ebx, edx
xor edx, edx
shl esi, 9
cmp esi, ecx
mov eax, edx
sbb eax, ebx
setae al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
xor edx, edx
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe3b
mov eax, dword [ebp - 0x1fc]
mov dword [esp + 4], str.got_dwTotalVirtual__Ix_n
mov dword [esp + 8], eax
xor edx, dword [ebp - 0x16c]
xor eax, dword [ebp - 0x170]
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
call fcn.0057d110
xor edx, edx
mov dword [eax], 0x5a0c14
mov dword [eax + 4], 0xe3c
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], str.got_dwAvailVirtual__Ix_n
mov dword [esp + 8], eax
xor eax, dword [ebp - 0x168]
xor edx, dword [ebp - 0x164]
or eax, edx
sete al
movzx eax, al
mov dword [esp], eax
call fcn.00488240
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret