Function at 0x467980
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [0x5c7004]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, dword [edi + 8]
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x28]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
test eax, eax
je 0x4679f4
cmp dword ds:[eax], 0
je 0x4679f4
test dword [ebx + 0x74], 0x10000
jne 0x4679f4
push eax
call sym.ProcessHacker.exe_PhDoesFileExists
test al, al
je 0x4679f0
push 1
push dword [ebx + 0x30]
call sym.ProcessHacker.exe__PhImageListExtractIcon_8
push ecx
mov dword [edi + 0x10], eax
lea ecx, [edi + 0x14]
mov edx, dword [ebx + 0x30]
push 0
call fcn.004bb5e0
mov ecx, dword [esp + 0x18]
test esi, esi
je 0x467c5c
test dword [ebx + 0x74], 0x10000
jne 0x467acd
cmp dword [0x5c7aa8], 0x3f
mov byte [esp + 0x13], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
jb 0x467a37
mov eax, esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], eax
jmp 0x467a4e
push ecx
mov edx, 0x1010
lea ecx, [esp + 0x40]
call fcn.004d3720
test eax, eax
js 0x467abe
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x34]
push ecx
push eax
call sym.ProcessHacker.exe_PhGetProcessCommandLine
test eax, eax
js 0x467a8e
mov edx, dword [esp + 0x34]
xor ecx, ecx
test dword [edx], 0xfffffffe
jbe 0x467a8b
lea ebx, [ecx + 0x20]
mov edi, edi
mov eax, dword [edx + 4]
cmp word [eax + ecx*2], 0
jne 0x467a7e
mov word [eax + ecx*2], bx
mov eax, dword [edx]
inc ecx
shr eax, 1
cmp ecx, eax
jb 0x467a70
mov ebx, dword [esp + 0x1c]
mov dword [edi + 0xc], edx
push 0
lea eax, [esp + 0x17]
push eax
lfence
push dword [esp + 0x40]
push dword [esp + 0x48]
push dword [esp + 0x28]
call sym.ProcessHacker.exe_PhGetProcessIsDotNetEx
movzx eax, byte [esp + 0x13]
xor eax, dword [edi + 0x30]
and eax, 1
xor dword [edi + 0x30], eax
cmp dword [esp + 0x38], 0
jne 0x467acd
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x467acd
push eax
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [0x5cd6d4]
push 0
test eax, eax
je 0x467b78
push 0
push 0xc
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x999920d3
lea ecx, [esp + 0x40]
mov dword [esp + 0x34], esi
push ecx
push 0
push 0
push 0
push eax
mov dword [esp + 0x4c], 4
call dword [sym.imp.ntdll.dll_NtDeviceIoControlFile]
test eax, eax
js 0x467b67
lea esp, [esp]
cmp eax, 0x123
je 0x467b67
or dword ds:[edi + 0x30], 4
lea eax, [esp + 0x40]
push 0
push 0x30
push eax
push 2
push dword [esp + 0x48]
call dword [sym.imp.ntdll.dll_NtQueryInformationJobObject]
test eax, eax
js 0x467b67
xor ecx, ecx
mov eax, 8
cmp dword [esp + 0x50], 0x1000
cmovne ecx, eax
mov eax, dword [edi + 0x30]
and eax, 0xfffffff7
or ecx, eax
mov dword [edi + 0x30], ecx
mov eax, dword [esp + 0x38]
test eax, eax
je 0x467b9e
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x467b9e
push esi
call dword [sym.imp.ntdll.dll_NtIsProcessInJob]
nop
test eax, eax
js 0x467b9e
xor ecx, ecx
mov edx, 4
cmp eax, 0x124
mov eax, dword [edi + 0x30]
cmove ecx, edx
and eax, 0xfffffffb
or ecx, eax
mov dword [edi + 0x30], ecx
push 0
push 4
lea eax, [esp + 0x3c]
push eax
push 0x31
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x467bbb
mov eax, dword [esp + 0x34]
mov dword [edi + 0x24], eax
cmp dword [0x5c7aa8], 0x3e
jb 0x467c0d
mov esi, dword [0x5cd680]
test esi, esi
je 0x467bfa
test dword [ebx + 0x74], 0x10000
jne 0x467bfa
push dword ds:[esp + 0x14]
mov ecx, esi
call dword [0x55890c]
call esi
mov ecx, dword [edi + 0x30]
neg eax
sbb eax, eax
and ecx, 0xffffffdf
and eax, 0x20
or ecx, eax
mov dword [edi + 0x30], ecx
cmp dword [0x5c7aa8], 0x3e
mov esi, dword [esp + 0x14]
jb 0x467c0d
test byte [edi + 0x30], 0x20
jne 0x467c16
cmp dword [0x5c7aa8], 0x64
jb 0x467c20
mov ecx, esi
call fcn.004e4ac0
mov dword [edi + 0x28], eax
test byte [ebx + 0x74], 0x80
je 0x467c5c
push 0
push 0
push 0
push 0
lea eax, [esp + 0x80]
push eax
push 0
push 0
push 0xffffffffffffffff
push esi
push 0xffffffffffffffff
call sym.ProcessHacker.exe_PhGetHandleInformationEx
test eax, eax
js 0x467c58
mov eax, dword [esp + 0x74]
not eax
shr eax, 0xa
not al
test al, 1
jne 0x467c5c
or dword [edi + 0x30], 0x40
cmp dword [ebx + 0x28], 0
je 0x467c9a
test dword [ebx + 0x74], 0x10000
jne 0x467c9a
test byte [edi + 0x30], 0x40
jne 0x467c9a
cmp dword [ebx + 0x10], 4
je 0x467c9a
lea edx, ds:[esp + 0x13]
mov ecx, esi
call fcn.004d4040
test eax, eax
js 0x467c9a
movzx eax, byte [esp + 0x13]
shl eax, 4
xor eax, dword [edi + 0x30]
and eax, 0x10
xor dword [edi + 0x30], eax
cmp dword ds:[ebx + 0x10], 0
jle 0x467dc8
cmp dword [0x5c7aa8], 0x70
jb 0x467d7f
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x467d7f
push 0x14
push 4
push dword [0x5cd55c]
mov dword [esp + 0x20], eax
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push 0x14
push esi
push 4
lea eax, [esp + 0x24]
push eax
push 0xe6
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
cmp eax, 0xc0000023
jne 0x467d3a
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [esp + 0x18]
push esi
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
push esi
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x1c]
push esi
push 4
push eax
push 0xe6
call dword [sym.imp.ntdll.dll_NtQuerySystemInformationEx]
test eax, eax
js 0x467d70
mov edx, dword [esp + 0x18]
xor ecx, ecx
shr edx, 2
test edx, edx
je 0x467d70
jmp 0x467d50
mov eax, dword ds:[esi + ecx*4]
movzx ebx, ax
mov dword [esp + 0x34], ebx
mov ebx, dword [esp + 0x1c]
test eax, 0x80000
jne 0x467e09
inc ecx
cmp ecx, edx
jb 0x467d50
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x467dc8
test dword [ebx + 0x74], 0x10000
jne 0x467dc8
lea ecx, [esp + 0x40]
push ecx
push 0
push eax
call sym.ProcessHacker.exe_PhLoadMappedImageEx
lea esp, [esp]
test eax, eax
js 0x467dc8
mov eax, dword [esp + 0x4c]
push dword [esp + 0x44]
push 0xffffffffffffffff
movzx ecx, word [eax + 4]
mov eax, dword [edi + 0x30]
shl ecx, 7
and eax, 0xff80007f
or ecx, eax
mov dword [edi + 0x30], ecx
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
mov ecx, dword [ebx + 0x50]
test ecx, ecx
je 0x467df1
call fcn.00467840
mov ecx, dword [edi + 0x2c]
mov dword [edi + 0x2c], eax
test ecx, ecx
je 0x467df1
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x467df1
call fcn.004c1f60
mov ecx, dword ds:[esp + 0xac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push esi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esp + 0x34]
movzx ecx, ax
mov eax, dword [edi + 0x30]
shl ecx, 7
and eax, 0xff80007f
or ecx, eax
mov dword [edi + 0x30], ecx
jmp 0x467dc8