Function at 0x48c160
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x62d040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x633f88], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
je 0x48c1c5
movzx eax, word [0x633f8a]
push 0
shl eax, 3
push eax
push dword [0x633ca4]
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, dword [0x633ca4]
test eax, eax
jns 0x48c251
movzx eax, word [0x633f8a]
shl eax, 3
push eax
push 0
push esi
call fcn.00580b30
add esp, 0xc
jmp 0x48c251
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x633f8c]
jae 0x48c24b
lea esp, [esp]
push dword [ebp - 0xc]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x633ca4]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 0xc]
push eax
push 0x53
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x633ca4]
test eax, eax
jns 0x48c22c
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00580b30
add esp, 0xc
mov ax, word ds:[ebp - 0xc]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ebx
mov word [ebp - 0xc], ax
cmp ax, word [0x633f8c]
jb 0x48c1e0
jmp 0x48c251
mov esi, dword [0x633ca4]
movzx edi, word [0x633f8a]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x10], ecx
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
cmp edi, 2
jb 0x48c2a1
lea esi, [edi - 1]
xor edi, edi
mov dword [ebp - 0x14], esi
mov esi, dword [0x633ca4]
lea esp, [esp]
add ecx, dword [esi + eax*8]
adc edx, dword [esi + eax*8 + 4]
add ebx, dword [esi + eax*8 + 8]
adc edi, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x14]
jb 0x48c280
mov dword [ebp - 0x10], edi
movzx edi, word [0x633f8a]
cmp eax, edi
jae 0x48c2b8
mov edi, dword [esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 8], edi
movzx edi, word [0x633f8a]
jmp 0x48c2ba
xor esi, esi
add ecx, ebx
mov ebx, dword [ebp - 8]
adc edx, dword [ebp - 0x10]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x636e10]
mov edx, dword [ebp - 0x18]
mov eax, esi
sbb eax, dword [0x636e14]
cmp byte [0x633f88], 0
mov dword [0x636e18], ecx
mov dword [0x636e1c], eax
mov dword [0x636e10], ebx
mov dword [0x636e14], esi
mov dword [edx], ecx
mov dword [edx + 4], eax
je 0x48c33c
push 0
lea eax, [edi*8]
push eax
push dword [0x633cac]
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jns 0x48c3bb
movzx eax, word [0x633f8a]
mov esi, dword [0x633cac]
shl eax, 3
push eax
push 0
push esi
call fcn.00580b30
add esp, 0xc
jmp 0x48c3bb
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x633f8c]
jae 0x48c3bb
push dword [ebp - 8]
call sym.SystemInformer.exe_PhGetActiveProcessorCount
movzx eax, ax
movzx edi, ax
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [0x633cac]
movzx ebx, bx
shl edi, 3
push edi
shl ebx, 3
add eax, ebx
push eax
push 2
lea eax, [ebp - 8]
push eax
push 0x6c
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
mov esi, dword [0x633cac]
test eax, eax
jns 0x48c39f
push edi
lea eax, [ebx + esi]
push 0
push eax
call fcn.00580b30
add esp, 0xc
mov ax, word [ebp - 8]
mov ebx, dword [ebp - 0x10]
inc ax
add ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
mov word [ebp - 8], ax
cmp ax, word [0x633f8c]
jb 0x48c350
movzx eax, word [0x633f8a]
xor ebx, ebx
mov esi, dword [0x633cac]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x10], ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
cmp word [0x633f8a], 2
jb 0x48c40c
movzx ebx, word [0x633f8a]
dec ebx
mov dword [ebp - 0x18], ebx
mov ebx, eax
add edi, dword [esi + eax*8]
adc ebx, dword [esi + eax*8 + 4]
add ecx, dword [esi + eax*8 + 8]
adc edx, dword [esi + eax*8 + 0xc]
add eax, 2
cmp eax, dword [ebp - 0x18]
jb 0x48c3f2
mov dword [ebp - 0x10], ebx
cmp eax, dword [ebp - 0x1c]
jae 0x48c422
mov ebx, dword ds:[esi + eax*8]
mov esi, dword [esi + eax*8 + 4]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
jmp 0x48c424
xor esi, esi
add ecx, edi
pop edi
adc edx, ebx
mov ebx, dword [ebp - 0x14]
add ebx, ecx
mov ecx, ebx
adc esi, edx
sub ecx, dword [0x636e20]
mov eax, esi
mov dword [0x636e28], ecx
sbb eax, dword [0x636e24]
mov ecx, dword [ebp - 4]
mov dword [0x636e24], esi
xor ecx, ebp
pop esi
mov dword [0x636e20], ebx
mov dword [0x636e2c], eax
pop ebx
call fcn.0057e94f
mov esp, ebp
pop ebp
ret