Function at 0x48b6e0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x6336ac], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
je 0x48b745
movzx eax, word [0x6336ae]
push 0
shl eax, 3
push eax
push dword [0x6333c4]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x6333c4]
test eax, eax
jns 0x48b7d1
movzx eax, word [0x6336ae]
shl eax, 3
push eax
push 0
push esi
call fcn.00581cf0
add esp, 0xc
jmp 0x48b7d1
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x6336b0]
jae 0x48b7cb
lea esp, [esp]
push dword [ebp - 0xc]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x6333c4]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x6333c4]
test eax, eax
jns 0x48b7ac
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00581cf0
add esp, 0xc
mov ax, word ds:[ebp - 0xc]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x6336b0]
jb 0x48b760
jmp 0x48b7d1
mov esi, dword [0x6333c4]
movzx edi, word [0x6336ae]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
cmp edi, 2
jb 0x48b821
lea esi, [edi - 1]
xor edi, edi
mov dword [ebp - 0x14], esi
mov esi, dword [0x6333c4]
lea esp, [esp]
add ecx, dword [esi + eax*8]
adc edx, dword [esi + eax*8 + 4]
add ebx, dword [esi + eax*8 + 8]
adc edi, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x14]
jb 0x48b800
mov dword [ebp - 0x10], edi
movzx edi, word [0x6336ae]
cmp eax, edi
jae 0x48b838
mov edi, dword [esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 8], edi
movzx edi, word [0x6336ae]
jmp 0x48b83a
xor esi, esi
add ecx, ebx
mov ebx, dword [ebp - 8]
adc edx, dword [ebp - 0x10]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x636490]
mov edx, dword [ebp - 0x18]
mov eax, esi
sbb eax, dword [0x636494]
cmp byte [0x6336ac], 0
mov dword [0x636498], ecx
mov dword [0x63649c], eax
mov dword [0x636490], ebx
mov dword [0x636494], esi
mov dword [edx], ecx
mov dword [edx + 4], eax
je 0x48b8bc
push 0
lea eax, [edi*8]
push eax
push dword [0x6333cc]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x48b93b
movzx eax, word [0x6336ae]
mov esi, dword [0x6333cc]
shl eax, 3
push eax
push 0
push esi
call fcn.00581cf0
add esp, 0xc
jmp 0x48b93b
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x6336b0]
jae 0x48b93b
push dword [ebp - 8]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [0x6333cc]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 8]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x6333cc]
test eax, eax
jns 0x48b91f
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00581cf0
add esp, 0xc
mov ax, word [ebp - 8]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x6336b0]
jb 0x48b8d0
movzx eax, word [0x6336ae]
xor ebx, ebx
mov esi, dword [0x6333cc]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp word [0x6336ae], 2
jb 0x48b98c
movzx ebx, word [0x6336ae]
dec ebx
mov dword [ebp - 0x18], ebx
mov ebx, eax
add edi, dword [esi + eax*8]
adc ebx, dword [esi + eax*8 + 4]
add ecx, dword [esi + eax*8 + 8]
adc edx, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x18]
jb 0x48b972
mov dword [ebp - 0x10], ebx
cmp eax, dword [ebp - 0x1c]
jae 0x48b9a2
mov ebx, dword ds:[esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
jmp 0x48b9a4
xor esi, esi
add ecx, edi
pop edi
adc edx, ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x6364a0]
mov eax, esi
mov dword [0x6364a8], ecx
sbb eax, dword [0x6364a4]
mov ecx, dword [ebp - 4]
mov dword [0x6364a4], esi
xor ecx, ebp
pop esi
mov dword [0x6364a0], ebx
mov dword [0x6364ac], eax
pop ebx
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret