diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index 05df658ce..91c03c2d9 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -6,6 +6,7 @@
 enum {
     SystemModuleInformation = 11,
     SystemBootEnvironmentInformation = 90,
+    SystemLogicalProcessorAndGroupInformation = 107,
     SystemSecureBootInformation = 146,
 };
 
@@ -395,3 +396,12 @@ typedef struct _SYSTEM_SECUREBOOT_INFORMATION
     BOOLEAN SecureBootEnabled;
     BOOLEAN SecureBootCapable;
 } SYSTEM_SECUREBOOT_INFORMATION, *PSYSTEM_SECUREBOOT_INFORMATION;
+
+NTSTATUS NTAPI NtQuerySystemInformationEx(
+    _In_ SYSTEM_INFORMATION_CLASS SystemInformationClass,
+    _In_reads_bytes_(InputBufferLength) PVOID InputBuffer,
+    _In_ ULONG InputBufferLength,
+    _Out_writes_bytes_opt_(SystemInformationLength) PVOID SystemInformation,
+    _In_ ULONG SystemInformationLength,
+    _Out_opt_ PULONG ReturnLength
+);
diff --git a/src/detection/cpu/cpu_windows.c b/src/detection/cpu/cpu_windows.c
index 1e1333d9c..c0555ec21 100644
--- a/src/detection/cpu/cpu_windows.c
+++ b/src/detection/cpu/cpu_windows.c
@@ -6,6 +6,7 @@
 
 #include <windows.h>
 #include "common/windows/perflib_.h"
+#include "common/windows/nt.h"
 #include <wchar.h>
 
 static inline void ffPerfCloseQueryHandle(HANDLE* phQuery)
@@ -212,15 +213,16 @@ static const char* detectMaxSpeedBySmbios(FFCPUResult* cpu)
 
 static const char* detectNCores(FFCPUResult* cpu)
 {
-    DWORD length = 0;
-    GetLogicalProcessorInformationEx(RelationAll, NULL, &length);
+    LOGICAL_PROCESSOR_RELATIONSHIP lpr = RelationAll;
+    ULONG length = 0;
+    NtQuerySystemInformationEx(SystemLogicalProcessorAndGroupInformation, &lpr, sizeof(lpr), NULL, 0, &length);
     if (length == 0)
         return "GetLogicalProcessorInformationEx(RelationAll, NULL, &length) failed";
 
     SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX* FF_AUTO_FREE
         pProcessorInfo = (SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX*)malloc(length);
 
-    if (!pProcessorInfo || !GetLogicalProcessorInformationEx(RelationAll, pProcessorInfo, &length))
+    if (!NT_SUCCESS(NtQuerySystemInformationEx(SystemLogicalProcessorAndGroupInformation, &lpr, sizeof(lpr), pProcessorInfo, length, &length)))
         return "GetLogicalProcessorInformationEx(RelationAll, pProcessorInfo, &length) failed";
 
     for(
diff --git a/src/detection/cpucache/cpucache_windows.c b/src/detection/cpucache/cpucache_windows.c
index e04f276e0..537a69a75 100644
--- a/src/detection/cpucache/cpucache_windows.c
+++ b/src/detection/cpucache/cpucache_windows.c
@@ -1,19 +1,19 @@
 #include "cpucache.h"
 #include "common/mallocHelper.h"
-
-#include <windows.h>
+#include "common/windows/nt.h"
 
 const char* ffDetectCPUCache(FFCPUCacheResult* result)
 {
+    LOGICAL_PROCESSOR_RELATIONSHIP lpr = RelationCache;
     DWORD length = 0;
-    GetLogicalProcessorInformationEx(RelationCache, NULL, &length);
+    NtQuerySystemInformationEx(SystemLogicalProcessorAndGroupInformation, &lpr, sizeof(lpr), NULL, 0, &length);
     if (length == 0)
         return "GetLogicalProcessorInformationEx(RelationCache, NULL, &length) failed";
 
     SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX* FF_AUTO_FREE
         pProcessorInfo = (SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX*)malloc(length);
 
-    if (!pProcessorInfo || !GetLogicalProcessorInformationEx(RelationCache, pProcessorInfo, &length))
+    if (!NT_SUCCESS(NtQuerySystemInformationEx(SystemLogicalProcessorAndGroupInformation, &lpr, sizeof(lpr), pProcessorInfo, length, &length)))
         return "GetLogicalProcessorInformationEx(RelationCache, pProcessorInfo, &length) failed";
 
     for(