Function at 0x408fe0
Capabilities:
Access peb ldr_data
Enumerate processes via ntquerysysteminformation
Get process heap flags
Get process heap force flags
Get session user name
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x580]
push ebx
push ecx
sub esp, 0x5e0
mov ebx, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x30
mov dword [esp + 4], eax
mov dword [esp], 3
call ebx
sub esp, 0x10
test eax, eax
je 0x409038
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
lea eax, [ebp - 0x550]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x138
mov dword [esp + 4], eax
mov dword [esp], 2
call ebx
sub esp, 0x10
test eax, eax
jne 0x409027
lea eax, [ebp - 0x5a4]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x24
mov dword [esp + 4], eax
mov dword [esp], 0x15
call ebx
sub esp, 0x10
test eax, eax
jne 0x409027
movzx eax, byte [0x411428]
mov dword [esp + 4], 0
mov edi, dword fs:[0x18]
lea eax, [eax + eax*2]
shl eax, 4
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x5bc], eax
call eax
sub esp, 0xc
mov esi, eax
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x5b0]
mov dword [esp + 0xc], eax
movzx eax, byte [0x411428]
mov dword [esp + 4], esi
xor esi, esi
lea eax, [eax + eax*2]
mov dword [esp], 8
shl eax, 4
mov dword [esp + 8], eax
call ebx
sub esp, 0x10
test eax, eax
jne 0x409a1d
add esi, 0x10000
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5bc]
call eax
lea edx, [ebp - 0x5b0]
sub esp, 0xc
mov dword [ebp - 0x5c8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0x10
call ebx
sub esp, 0x10
cmp eax, 0xc0000004
je 0x409810
mov edx, dword fs:[0x18]
xor esi, esi
mov edi, edx
add esi, 0x10000
mov dword [esp + 4], 0
mov dword [esp + 8], esi
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5bc]
call eax
lea edx, [ebp - 0x5b0]
sub esp, 0xc
mov dword [ebp - 0x5c0], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 5
call ebx
sub esp, 0x10
cmp eax, 0xc0000004
je 0x4097e0
mov dword [ebp - 0x5d8], edi
lea esi, [ebp - 0x550]
mov edi, 0x4114a0
mov dword [esp], 0x4110f4
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x5a4]
mov edx, dword [ebp - 0x5d8]
mov ecx, 0x4e
rep movsd dword es:[edi], dword [esi]
sub esp, 4
mov dword [0x411440], eax
mov eax, dword [ebp - 0x5a0]
mov dword [esp + 4], 0
mov dword [0x411444], eax
mov eax, dword [ebp - 0x59c]
mov dword [0x411448], eax
mov eax, dword [ebp - 0x598]
mov dword [0x41144c], eax
mov eax, dword [ebp - 0x594]
mov dword [0x411450], eax
mov eax, dword [ebp - 0x590]
mov dword [0x411454], eax
mov eax, dword [ebp - 0x58c]
mov dword [0x411458], eax
mov eax, dword [ebp - 0x588]
mov dword [0x41145c], eax
mov eax, dword [ebp - 0x584]
mov dword [0x411460], eax
mov eax, dword [0x4115e0]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebp - 0x5c8]
mov eax, dword [ebp - 0x5d0]
mov edx, dword [ebp - 0x5d8]
sub esp, 0xc
mov dword [0x4115e0], eax
mov eax, dword [esi]
mov dword [0x411480], eax
mov eax, dword [esi + 4]
mov dword [0x411484], eax
mov eax, dword [esi + 8]
mov dword [0x411488], eax
mov eax, dword [esi + 0xc]
mov dword [0x41148c], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 8], esi
mov dword [0x411490], eax
mov dword [esp + 4], 0
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
movzx edx, byte [0x411428]
sub esp, 0xc
mov ecx, edx
test edx, edx
je 0x409a46
mov eax, dword [0x4115e0]
lea edx, [edx + edx*2]
pxor xmm0, xmm0
shl edx, 4
add edx, eax
lea esi, [esi]
fild qword [eax + 8]
add eax, 0x30
fstp qword [ebp - 0x5c8]
fild qword [eax - 0x18]
addsd xmm0, qword [ebp - 0x5c8]
fstp qword [ebp - 0x5c8]
fild qword [eax - 0x10]
addsd xmm0, qword [ebp - 0x5c8]
fstp qword [ebp - 0x5c8]
addsd xmm0, qword [ebp - 0x5c8]
cmp edx, eax
jne 0x4092f0
mov edx, dword [0x41186c]
mov eax, dword [0x411868]
mov edi, edx
or edi, eax
jne 0x409955
mov eax, dword [ebp - 0x550]
mov edx, dword [ebp - 0x54c]
movsd qword [0x4110e8], xmm0
mov dword [0x411868], eax
mov eax, dword [ebp - 0x578]
mov dword [0x41186c], edx
mov edx, dword [ebp - 0x574]
mov dword [0x411870], eax
mov eax, dword [0x4113e0]
mov dword [0x411874], edx
mov dword [0x4113e4], eax
mov eax, dword [ebp - 0x5c0]
mov dword [0x4113e0], 0
test eax, eax
je 0x4093af
xor ecx, ecx
jmp 0x4093a2
add eax, edx
mov edx, dword [eax]
inc ecx
test edx, edx
jne 0x4093a0
mov dword [0x4113e0], ecx
mov eax, dword [0x4118a8]
mov dword [esp + 4], 0
mov ebx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [0x4118a4]
sub esp, 0xc
mov dword [0x4118a8], eax
imul eax, dword [0x4113e0], 0x4b8
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x5bc]
call eax
mov ebx, dword [0x4113e0]
mov esi, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c8], 0
mov dword [0x4118a4], eax
sub esp, 0xc
mov edx, eax
test ebx, ebx
je 0x4097a0
lea esi, [esi]
mov ecx, dword [0x4113e4]
test ecx, ecx
je 0x409840
mov edi, dword [esi + 0x44]
mov ebx, dword [0x4118a8]
xor eax, eax
jmp 0x409467
inc eax
add ebx, 0x4b8
cmp eax, ecx
je 0x409840
cmp dword [ebx + 0x208], edi
jne 0x409458
mov dword [ebp - 0x5bc], ebx
imul eax, dword [ebp - 0x5c8], 0x4b8
mov ecx, 0x12e
add edx, eax
mov dword [ebp - 0x5d0], eax
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov edi, dword [esi + 0x3c]
test edi, edi
je 0x409900
mov ebx, dword [ebp - 0x5bc]
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4094a8
mov eax, dword [esi + 0x44]
mov dword [ebp - 0x5bc], ebx
mov dword [edx + 0x208], eax
mov eax, dword [ebp - 0x5bc]
test eax, eax
je 0x409850
fild qword [esi + 0x30]
mov ecx, dword [eax + 0x4ac]
fstp qword [ebp - 0x5d8]
fild qword [esi + 0x28]
movsd xmm0, qword [ebp - 0x5d8]
fstp qword [ebp - 0x5e0]
addsd xmm0, qword [ebp - 0x5e0]
fild qword [eax + 0x4a8]
test ecx, ecx
jns 0x40950d
fadd dword [0x4161d8]
mov eax, dword [ebp - 0x5bc]
fstp qword [ebp - 0x5d8]
movsd xmm1, qword [ebp - 0x5d8]
fild qword [eax + 0x4a0]
mov eax, dword [eax + 0x4a4]
test eax, eax
jns 0x409537
fadd dword [0x4161d8]
fstp qword [ebp - 0x5d8]
movsd xmm2, qword [ebp - 0x5d8]
movzx eax, byte [0x411428]
pxor xmm5, xmm5
addsd xmm1, xmm2
movapd xmm2, xmmword [0x4161e0]
movapd xmm3, xmm2
subsd xmm0, xmm1
pxor xmm1, xmm1
divsd xmm0, qword [0x411798]
mulsd xmm0, qword [0x4161d0]
cvtsi2sd xmm1, eax
divsd xmm0, xmm1
movsd xmm5, xmm0
cmplepd xmm2, xmm5
andpd xmm3, xmm2
pslld xmm2, 0x1f
subpd xmm5, xmm3
cvttpd2dq xmm5, xmm5
pxor xmm5, xmm2
movd dword [edx + 0x418], xmm5
mov ecx, dword [esi + 0x28]
mov ebx, dword [esi + 0x2c]
add ecx, dword [esi + 0x30]
adc ebx, dword [esi + 0x34]
mov dword [edx + 0x424], ebx
mov ebx, dword [ebp - 0x5bc]
mov dword [edx + 0x420], ecx
mov eax, dword [esi + 0x68]
mov dword [edx + 0x454], eax
mov eax, dword [esi + 0x64]
mov dword [edx + 0x450], eax
mov ecx, dword [esi + 0x68]
mov eax, dword [ebx + 0x454]
mov edi, ecx
sub edi, dword [ebx + 0x454]
sub eax, ecx
cmp dword [ebx + 0x454], ecx
cmovb eax, edi
mov dword [edx + 0x43c], eax
mov eax, dword [esi + 0x60]
mov dword [edx + 0x44c], eax
mov ebx, dword [ebx + 0x44c]
mov edi, eax
mov ecx, ebx
sub edi, ebx
sub ecx, eax
cmp ebx, eax
cmovb ecx, edi
mov dword [edx + 0x440], ecx
mov eax, dword [esi + 0x5c]
mov dword [edx + 0x448], eax
mov eax, dword [esi + 0x70]
mov dword [edx + 0x45c], eax
mov eax, dword [esi + 0x78]
mov dword [edx + 0x464], eax
mov eax, dword [esi + 0x40]
mov dword [edx + 0x428], eax
mov eax, dword [esi + 0x4c]
mov dword [edx + 0x42c], eax
mov eax, dword [esi + 4]
mov dword [edx + 0x430], eax
mov eax, dword [esi + 0x50]
mov dword [edx + 0x414], eax
mov eax, dword [esi + 0x44]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x409754
lea eax, [ebp - 0x5ac]
mov dword [esp + 4], 0xe
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x4098a0
mov edx, dword [ebp - 0x5d0]
add edx, dword [0x4118a4]
mov dword [esp + 4], 1
mov edi, dword [sym.imp.user32.dll_GetGuiResources]
mov dword [ebp - 0x5bc], edx
mov dword [esp], ebx
call edi
mov edx, dword [ebp - 0x5bc]
sub esp, 8
mov dword [edx + 0x434], eax
mov edx, dword [ebp - 0x5d0]
add edx, dword [0x4118a4]
mov dword [esp + 4], 0
mov dword [ebp - 0x5bc], edx
mov dword [esp], ebx
call edi
mov edx, dword [ebp - 0x5bc]
mov edi, dword [ebp - 0x5d0]
sub esp, 8
mov dword [edx + 0x438], eax
mov eax, dword [0x4118a4]
mov dword [esp], ebx
add eax, edi
add eax, 0x470
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GetProcessIoCounters]
mov eax, dword [0x4118a4]
sub esp, 8
add eax, edi
mov dword [esp], ebx
add eax, 0x4b0
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsWow64Process]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov edx, dword [0x4118a4]
mov eax, dword [ebp - 0x5d0]
mov ecx, dword [esi + 0x28]
mov ebx, dword [esi + 0x2c]
add eax, edx
inc dword [ebp - 0x5c8]
mov dword [eax + 0x4a0], ecx
mov dword [eax + 0x4a4], ebx
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
mov dword [eax + 0x4a8], ecx
mov dword [eax + 0x4ac], ebx
mov eax, dword [ebp - 0x5c8]
add esi, dword [esi]
cmp dword [0x4113e0], eax
ja 0x409438
mov edi, dword [ebp - 0x5c0]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edi
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], 0x4110f4
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x409027
mov eax, dword [ebp - 0x5c0]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x409162
mov eax, dword [ebp - 0x5c8]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x409102
mov dword [ebp - 0x5bc], 0
jmp 0x409475
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
add ecx, dword [esi + 0x28]
adc ebx, dword [esi + 0x2c]
mov dword [edx + 0x424], ebx
mov dword [edx + 0x420], ecx
mov eax, dword [esi + 0x68]
mov dword [edx + 0x454], eax
mov eax, dword [esi + 0x64]
mov dword [edx + 0x43c], 0
mov dword [edx + 0x450], eax
mov eax, dword [esi + 0x60]
mov dword [edx + 0x440], 0
mov dword [edx + 0x44c], eax
jmp 0x40961a
mov eax, dword [ebp - 0x5ac]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_ImpersonateLoggedOnUser]
lea edx, [ebp - 0x218]
xor eax, eax
mov ecx, 0x82
mov dword [ebp - 0x5a8], 0x104
mov edi, edx
sub esp, 4
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5a8]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.advapi32.dll_GetUserNameW]
sub esp, 8
call dword [sym.imp.advapi32.dll_RevertToSelf]
mov eax, dword [ebp - 0x5ac]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x4096a8
mov eax, dword [0x4117cc]
lea edi, [ebp - 0x416]
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], edi
mov dword [esp + 4], 0x8063
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
mov ebx, dword [ebp - 0x5bc]
mov edx, dword [ebp - 0x5d0]
xor eax, eax
sub esp, 0x10
add edx, dword [0x4118a4]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x409940
jmp 0x4094b8
fild qword [ebp - 0x550]
movd xmm5, eax
movd xmm7, edx
movzx ecx, cl
punpckldq xmm5, xmm7
pxor xmm4, xmm4
movapd xmm2, xmm0
movq qword [ebp - 0x5b8], xmm5
cvtsi2sd xmm4, ecx
movsd xmm5, qword [0x4161d0]
subsd xmm2, qword [0x4110e8]
fstp qword [ebp - 0x5c8]
fild qword [ebp - 0x5b8]
movsd xmm1, qword [ebp - 0x5c8]
movapd xmm6, xmm5
fstp qword [ebp - 0x5d0]
fild qword [ebp - 0x578]
subsd xmm1, qword [ebp - 0x5d0]
fstp qword [ebp - 0x5c8]
fild qword [0x411870]
movsd xmm3, qword [ebp - 0x5c8]
fstp qword [ebp - 0x5d0]
subsd xmm3, qword [ebp - 0x5d0]
movsd qword [0x411798], xmm3
divsd xmm1, xmm3
divsd xmm2, xmm3
mulsd xmm1, xmm5
divsd xmm1, xmm4
subsd xmm6, xmm1
movapd xmm1, xmm2
mulsd xmm1, xmm5
movsd qword [0x411788], xmm6
divsd xmm1, xmm4
subsd xmm5, xmm1
movsd qword [0x411790], xmm5
jmp 0x40933f
mov eax, dword [ebp - 0x5d0]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x409027
pxor xmm0, xmm0
xor ecx, ecx
jmp 0x40932a