Function at 0x504a00
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
push edi
mov dword [0x633a64], 0x60711c
mov dword [0x633a60], edx
call fcn.00504e60
push 0x2c
lea eax, [esp + 0x24]
push 0
push eax
call fcn.005861b0
add esp, 0xc
mov dword [sym.SystemInformer.exe_Ordinal_1267], 0x11000
lea eax, [esp + 0x20]
mov dword [0x633b98], 0xffffffff
mov esi, 1
mov dword [0x633b9c], 0x10000
mov dword [0x633ba0], 0x10000
push 0
push 0x2c
push eax
push 0
mov dword [0x633ba4], 0xffff
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp dword [0x62db64], 0x3e
movzx eax, word [esp + 0x28]
mov word [sym.SystemInformer.exe_Ordinal_1267], ax
movsx eax, byte [esp + 0x48]
mov word [0x633b96], ax
mov eax, dword [esp + 0x2c]
mov dword [0x633b98], eax
mov eax, dword [esp + 0x38]
mov dword [0x633b9c], eax
mov eax, dword [esp + 0x40]
mov dword [0x633ba0], eax
mov eax, dword [esp + 0x44]
mov dword [0x633ba4], eax
jb 0x504ae5
push 0
push 0
push 0
push 0
push 0
push 0x1102
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x633a74], eax
jmp 0x504aea
mov eax, dword [0x633a74]
test eax, eax
jne 0x504b2b
push eax
push eax
push 0x100000
push 0x200000
push eax
push 0x1002
call dword [sym.imp.ntdll.dll_RtlCreateHeap]
mov dword [0x633a74], eax
test eax, eax
je 0x504dda
push 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 2
push ecx
push 0
push eax
call dword [sym.imp.ntdll.dll_RtlSetHeapInformation]
push 0
push 0
push 0xf0003
push 0x635a64
call dword [sym.imp.ntdll.dll_NtCreateKeyedEvent]
nop
test eax, eax
js 0x504dda
mov ax, si
cmp ax, word [0x633b96]
sbb eax, eax
and eax, 0xfa0
mov dword [0x630918], eax
mov eax, 0x6364f8
test al, 7
jne 0x504dcf
mov eax, 0x6364e0
xorps xmm0, xmm0
movlpd qword [0x6364f8], xmm0
test al, 7
jne 0x504dcf
lea eax, [esp + 0x20]
movq qword [0x6364e0], xmm0
push eax
push 0x28
mov dword [0x6364e8], 0
mov dword [0x6364ec], 0x200
mov dword [0x6364f0], 0x38
movups xmmword [esp + 0x28], xmm0
mov dword [0x633a48], eax
movups xmmword [esp + 0x38], xmm0
mov dword [0x6360e0], eax
movq qword [esp + 0x48], xmm0
call sym.SystemInformer.exe_Ordinal_1240
mov edx, eax
mov ecx, esi
xor eax, eax
mov word [edx], ax
lock xadd dword [0x633a44], ecx
inc ecx
dec cl
mov dword [edx + 8], eax
movzx eax, cl
push edx
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Type
mov dword [eax*4 + 0x6360e0], edx
movzx eax, cl
push 0x28
mov dword [0x633a48], edx
mov word [edx - 8], ax
mov dword [edx + 4], esi
call sym.SystemInformer.exe_Ordinal_1240
mov edx, eax
mov ecx, esi
xor eax, eax
mov word [edx], ax
lock xadd dword [0x633a44], ecx
inc ecx
dec cl
mov dword [edx + 4], eax
mov dword [edx + 8], eax
movzx eax, cl
mov byte [edx + 2], cl
mov dword [edx + 0xc], str.Alloc
mov dword [0x633a40], edx
mov dword [eax*4 + 0x6360e0], edx
call fcn.00504840
mov dword [0x6356f0], eax
cmp eax, 0xffffffff
je 0x504dda
nop
call fcn.004fe5a0
test al, al
je 0x504dda
cmp byte [0x7ffe03c4], 1
jne 0x504c89
mov eax, dword ds:[0x7ffe03c0]
dec eax
cmp eax, 0x1f
jbe 0x504d8f
lea eax, ds:[esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
lea edx, [esp + 0x18]
mov ecx, 4
call fcn.0051e220
test eax, eax
js 0x504d8f
mov ebp, dword ds:[esp + 0x14]
xor eax, eax
movzx ebx, word [ebp + 0xa]
mov dword [esp + 0x14], ebx
movzx edi, bx
cmp ax, bx
jae 0x504dbe
mov si, word [esp + 0x18]
lea ecx, [ebp + 0x21]
mov edx, edi
movzx eax, byte ds:[ecx]
lea ecx, [ecx + 0x2c]
add si, ax
sub edx, 1
jne 0x504cd3
cmp ebx, 1
jbe 0x504d7b
lea eax, ds:[edi + edi]
push eax
push 4
lfence
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea edx, [ebp + 0x21]
mov dword [0x633a70], ebx
xor ecx, ecx
movzx eax, si
lea edx, [edx + 0x2c]
mov dword [esp + 0x18], eax
lea ecx, [ecx + 2]
movzx eax, byte [edx - 0x2c]
mov word [ecx + ebx - 2], ax
sub edi, 1
je 0x504d36
mov ebx, dword [0x633a70]
jmp 0x504d13
push ebp
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x18]
test ax, ax
je 0x504d8a
mov word [0x633a6a], ax
mov eax, dword [esp + 0x14]
mov word [0x633a6c], ax
xor eax, eax
mov byte [0x633a68], 0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f7f
add esp, 0x4c
ret
push ebp
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, 1
mov ax, word [0x633b96]
mov word [0x633a6a], ax
xor eax, eax
mov word [0x633a6c], si
mov byte [0x633a68], 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00583f7f
add esp, 0x4c
ret
push ebp
push 0
push dword [0x633a74]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x504d8f
push 0x80000002
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
mov ecx, dword [esp + 0x54]
mov eax, 0xc0000001
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f7f
add esp, 0x4c
ret