Function at 0x4d3860
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x62a040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
sub eax, 0x947
je 0x4d3c49
sub eax, 1
jne 0x4d3da4
mov ecx, dword ds:[edi + 0xc]
cmp ecx, dword [edi + 0x10]
jae 0x4d3da4
cmp dword [0x632a7c], ecx
je 0x4d3c28
add ecx, dword [0x633a8c]
mov eax, dword [0x633a90]
and ecx, dword [0x633a84]
push 0
push 0x10
mov dword [ebp - 0x1a0], 3
mov esi, dword [eax + ecx*4]
xor eax, eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x1b0]
push eax
push 0x6d
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1ac], 0x16
mov dword [ebp - 0x1a4], 0x18
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
js 0x4d3bac
cmp dword ds:[ebp - 0x194], 0
je 0x4d3bac
cmp dword [ebp - 0x190], 0
je 0x4d3bac
mov eax, dword ds:[ebp - 0x198]
fild dword [ebp - 0x198]
test eax, eax
jns 0x4d396a
fadd qword [0x61a518]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
fmul qword [0x61a460]
mov eax, dword [ebp - 0x194]
fild dword [ebp - 0x194]
test eax, eax
jns 0x4d3992
fadd qword [0x61a518]
fstp qword [ebp - 0x1a8]
fld qword [ebp - 0x1a8]
mov eax, dword [ebp - 0x190]
fmul st(1)
fild dword [ebp - 0x190]
test eax, eax
jns 0x4d39b6
fadd qword [0x61a518]
fstp qword [ebp - 0x1a8]
mov eax, esi
mov ecx, 0x1000
fdiv qword [ebp - 0x1a8]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x178], 0x22
mov dword [ebp - 0x174], 0x603e14
mov dword [ebp - 0x170], 0xc
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x130], 0x26
mov dword [ebp - 0x12c], str.Compressed_memory:
mul ecx
fld st(0)
fsub st(2)
fld qword [0x61a4f0]
fmul st(3), st(0)
mov dword [ebp - 0x160], eax
mov eax, 0xa
mov dword [ebp - 0x15c], edx
mov word [ebp - 0x148], ax
fmul st(3), st(0)
fmul st(2), st(0)
fmul st(2), st(0)
fmul st(1), st(0)
fmulp st(1)
fld qword [0x61a530]
fxch st(3)
fcomi st(3)
jb 0x4d3a6c
fsub st(3)
fxch st(3)
fcomi st(3)
jbe 0x4d3a6a
add esi, ebx
adc ebx, 0x80000000
fxch st(3)
call fcn.0059ce20
add eax, esi
mov dword [ebp - 0x128], 0xc
mov dword [ebp - 0x118], eax
fxch st(1)
adc edx, ebx
mov dword [ebp - 0x110], 0
mov eax, 0xa
mov dword [ebp - 0x114], edx
xor esi, esi
mov word [ebp - 0x100], ax
xor ebx, ebx
mov dword [ebp - 0xf8], 1
fcomi st(2)
mov dword [ebp - 0xe8], 0x24
mov dword [ebp - 0xe4], str.Total_compressed:
jb 0x4d3adb
fsub st(2)
fxch st(2)
fcomi st(2)
jbe 0x4d3ad9
add esi, ebx
adc ebx, 0x80000000
fxch st(2)
jmp 0x4d3ae0
call fcn.0059ce20
add eax, esi
mov dword [ebp - 0xe0], 0xc
mov dword [ebp - 0xd0], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0xc8], 0
xor esi, esi
mov dword [ebp - 0xcc], edx
xor ebx, ebx
mov word [ebp - 0xb8], ax
fcomi st(1)
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xa0], 0x28
mov dword [ebp - 0x9c], str.Total_memory_saved:
jb 0x4d3b4d
fsub st(1)
fxch st(1)
fcompi st(1)
jbe 0x4d3b4f
add esi, ebx
adc ebx, 0x80000000
jmp 0x4d3b4f
fstp st(1)
call fcn.0059ce20
push dword [edi + 0xc]
add eax, esi
mov dword [ebp - 0x98], 0xc
mov dword [ebp - 0x88], eax
mov eax, 0xa
adc edx, ebx
mov dword [ebp - 0x80], 0
push 0
mov dword [ebp - 0x84], edx
mov word [ebp - 0x70], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 0xd
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x58], ecx
jmp 0x4d3bfe
push dword [edi + 0xc]
mov ecx, 0x1000
mov dword [ebp - 0x50], 0xc
mov eax, esi
mov dword [ebp - 0x38], 0
mul ecx
push 0
mov dword [ebp - 0x40], eax
mov eax, 0xa
mov dword [ebp - 0x3c], edx
mov word [ebp - 0x28], ax
call sym.SystemInformer.exe__PhGetStatisticsTimeString_8
push eax
call sym.SystemInformer.exe_PhAutoDereferenceObject
push 0
push 3
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
push eax
call sym.SystemInformer.exe_PhFormat
mov ecx, dword [0x632a78]
mov dword [0x632a78], eax
test ecx, ecx
je 0x4d3c28
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4d3c28
call fcn.004f9e40
mov eax, dword [0x632a78]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057c26f
mov esp, ebp
pop ebp
ret
mov esi, dword [edi + 0xc]
mov ecx, 0x1003
cmp byte [0x6339a0], 0
mov eax, 3
cmovne eax, ecx
mov dword [esi + 8], eax
mov eax, dword [0x632a88]
mov eax, dword [eax + 0x40]
push dword [eax + 0x3c]
push 0
push dword [0x633900]
push esi
call sym.SystemInformer.exe__PhSiSetColorsGraphDrawInfo_16
push dword [0x633a88]
push dword [edi + 0xc]
push 0x632a64
call sym.SystemInformer.exe_PhGetDrawInfoGraphBuffers
cmp byte [0x632a70], 0
jne 0x4d3da4
cmp byte [0x6339c8], 0
mov eax, dword [esi + 0x14]
je 0x4d3cbb
push eax
push dword [0x632a64]
push 0x633a80
call sym.SystemInformer.exe_PhCopyConvertCircularBufferULONG
jmp 0x4d3d0a
xor edx, edx
test eax, eax
je 0x4d3d0a
jmp 0x4d3cd0
mov ecx, dword [0x633a8c]
mov eax, dword [0x633a90]
add ecx, edx
and ecx, dword [0x633a84]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
test eax, eax
jns 0x4d3cfc
fadd dword [0x61a544]
mov eax, dword [0x632a64]
fstp dword [eax + edx*4]
inc edx
cmp edx, dword [esi + 0x14]
jb 0x4d3cd0
mov eax, dword [0x63103c]
test eax, eax
je 0x4d3d45
push dword [esi + 0x14]
mov dword [ebp - 0x1a4], eax
fild dword [ebp - 0x1a4]
jns 0x4d3d2a
fadd dword [0x61a544]
fstp dword [ebp - 0x1a4]
fld dword [ebp - 0x1a4]
push ecx
fstp dword [esp]
push dword [0x632a64]
call sym.SystemInformer.exe_PhDivideSinglesBySingle
cmp byte [0x6339a0], 0
je 0x4d3d9d
mov dword [esi + 0x48], sym.SystemInformer.exe__PhSiSizeLabelYFunction_16
mov ecx, 0x1000
mov eax, dword [0x63103c]
mul ecx
mov dword [ebp - 0x1a8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x1a4], edx
fild qword [ebp - 0x1a8]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a8], 0
fild qword [ebp - 0x1a8]
fchs
faddp st(1)
fstp dword [esi + 0x4c]
mov byte [0x632a70], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057c26f
mov esp, ebp
pop ebp
ret