Function at 0x45ce68
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x49
add esp, 0xfffff004
push eax
dec eax
jne 0x45ce71
mov eax, dword [ebp - 4]
add esp, 0xfffffc00
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x49404], edx
mov dword [ebp - 0x49400], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45d08e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x493e0
lea eax, [ebp - 0x493f4]
push eax
push 5
call sub.ntdll.dll_NtQuerySystemInformation
lea eax, [ebp - 0x493f4]
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x45d04b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x44]
call fcn.0045cda4
pop ecx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x45cf09
mov edx, dword [0x45c844]
mov eax, 0x30
call fcn.00405300
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x2a], 1
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x2b], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x44]
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x3c]
call fcn.00405324
push 0
push 0x989680
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x2c]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x30]
adc edx, dword [ecx + 0x34]
call fcn.004053ec
mov dword [ebp - 0x493fc], eax
mov dword [ebp - 0x493f8], edx
fild qword [ebp - 0x493fc]
fdiv dword [0x45d0a0]
mov eax, dword [ebp - 0x14]
fstp qword [eax + 0x10]
wait
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0045ccb8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x1c], 0
jne 0x45cfac
mov eax, dword [ebp - 0x14]
add eax, 0x1c
mov edx, 0x45d0ac
call fcn.00404480
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x18], 0x4000
lea edx, [ebp - 0x49400]
mov eax, ebx
call fcn.0045cd38
mov edx, dword [ebp - 0x49400]
mov eax, dword [ebp - 0x14]
add eax, 0x24
call fcn.00404480
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
call fcn.0045c884
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x28], al
lea edx, [ebp - 0x49404]
mov eax, ebx
call fcn.0045cc08
mov edx, dword [ebp - 0x49404]
mov eax, dword [ebp - 0x14]
add eax, 0x20
call fcn.00404480
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x20], 0
jne 0x45d013
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x24]
call fcn.00404480
mov eax, ebx
call fcn.0045cb1c
mov edx, dword [ebp - 0x14]
mov byte [edx + 0x29], al
push ebx
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x2a], 0
je 0x45d041
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x2a], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00417a48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45d055
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
test esi, esi
je 0x45d069
add esi, dword [ebp - 0xc]
mov dword [ebp - 0xc], esi
jmp 0x45cec4
push ebp
call fcn.0045ce04
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d095
lea eax, [ebp - 0x49404]
mov edx, 2
call fcn.00404450
ret