Function at 0x6a681df0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get process heap flags
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xb8
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x88], ecx
test byte [0x6a685018], 8
jne 0x6a682150
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x6a682128
mov edi, dword [ebp - 0x88]
test edi, edi
je 0x6a682128
cmp ebx, 0xfffffffe
je 0x6a681eb0
test byte [0x6a685018], 1
jne 0x6a681e88
mov eax, dword [esi]
test eax, eax
je 0x6a681ef0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
xor edx, edx
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.ignoring_session_id__lx_n
mov dword [esp + 8], str.WTSEnumerateProcessesExW
mov dword [esp + 4], 0x6a685018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov eax, dword [esi]
test eax, eax
je 0x6a681ef0
test byte [0x6a685018], 1
je 0x6a681e62
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unhandled_level__lu_n
mov dword [esp + 8], str.WTSEnumerateProcessesExW
mov dword [esp + 4], 0x6a685018
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x6a681e62
mov dword [esp], 0x1000
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x6a682210
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, 0x1000
jmp 0x6a681f31
add ebx, ebx
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.ucrtbase.dll_realloc]
test eax, eax
je 0x6a682207
mov edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], 5
call esi
sub esp, 0x10
cmp eax, 0xc0000004
je 0x6a681f18
mov edx, eax
test eax, eax
jne 0x6a6821d0
movzx esi, word [edi + 0x38]
mov ecx, dword [edi]
add esi, 0x56
test ecx, ecx
je 0x6a6821fd
mov eax, edi
mov ebx, 1
lea esi, [esi]
lea esi, [esi]
add eax, ecx
inc ebx
movzx ecx, word [eax + 0x38]
lea esi, [esi + ecx + 0x56]
mov ecx, dword [eax]
test ecx, ecx
jne 0x6a681f80
mov ecx, dword fs:[0x18]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x80], edx
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x7c], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x90], eax
je 0x6a682224
shl ebx, 4
mov dword [ebp - 0x80], 0
mov esi, ebx
mov ebx, dword [ebp - 0x90]
add esi, ebx
jmp 0x6a68200e
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
mov eax, dword [edi]
inc dword [ebp - 0x80]
add ebx, 0x10
test eax, eax
je 0x6a682190
add edi, eax
mov eax, dword [edi + 0x50]
mov ecx, dword [edi + 0x3c]
mov dword [ebx + 8], esi
mov dword [ebx], eax
mov eax, dword [edi + 0x44]
mov dword [ebx + 4], eax
movzx eax, word [edi + 0x38]
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [ebp - 0x7c], eax
call sym._memcpy
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebx + 8]
xor ecx, ecx
shr dx, 1
movzx edx, dx
mov word [eax + edx*2], cx
movzx eax, word [edi + 0x38]
mov dword [ebx + 0xc], 0
lea esi, [esi + eax + 2]
mov eax, dword [ebx + 4]
mov dword [esp + 4], 0
mov dword [esp], 0x400
mov dword [esp + 8], eax
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6a681ffc
lea eax, [ebp - 0x6c]
mov dword [esp], edx
mov dword [ebp - 0x7c], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 8
call dword [sym.imp.advapi32.dll_OpenProcessToken]
mov edx, dword [ebp - 0x7c]
sub esp, 0xc
test eax, eax
je 0x6a681ff0
lea eax, [ebp - 0x68]
mov dword [ebp - 0x8c], edx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x64]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0xc], 0x4c
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x64]
mov dword [ebx + 0xc], esi
sub esp, 0x14
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_GetLengthSid]
sub esp, 4
mov dword [ebp - 0x68], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], esi
mov dword [esp + 4], eax
call sym._memcpy
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x6c]
add esi, ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, dword [ebp - 0x8c]
sub esp, 4
jmp 0x6a681ff0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
lea esp, [ebp - 0x10]
xor edx, edx
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], str.server__p__level__lu__session_id__lx__ret_info__p__ret_count__p_n
mov dword [esp + 8], str.WTSEnumerateProcessesExW
mov dword [esp + 4], 0x6a685018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x6a681e2e
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x90]
mov edx, 1
mov dword [eax], esi
mov eax, dword [ebp - 0x88]
mov esi, dword [ebp - 0x80]
mov dword [eax], esi
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [ebp - 0x7c], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov edx, dword [ebp - 0x7c]
mov dword [esp], edx
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], edx
xor edx, edx
jmp 0x6a681e71
mov ebx, 1
jmp 0x6a681f91
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword fs:[0x18]
xor edx, edx
mov dword [eax + 0x34], 0xe
jmp 0x6a681e71
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], edx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x7c]
mov dword [ecx + 0x34], 0xe
jmp 0x6a681e71