Function at 0x100216f0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1002171b
mov ecx, dword [ebp + 0x10]
mov edx, 0x10692fb4
test ecx, ecx
mov dword [esp + 0x10], ecx
jne 0x1002172d
jmp 0x10021901
mov edx, 0x10692f9c
mov eax, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x106b6680]
mov dword [esp + 4], edx
movzx eax, byte [eax]
push 1
push 0x80000
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10021c54
mov dword [esp + 0x20], 0x80000
mov dword [esp + 0x24], eax
mov edi, eax
xor eax, eax
mov ecx, 0x80000
lea esi, [esp + 0x14]
mov ebx, 0x80000
mov dword [esp + 0x28], 0
jmp 0x10021788
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov dword [esp + 0x14], 0
cmp ebx, ecx
ja 0x100217ef
push esi
push ebx
push edi
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x10021804
or eax, 0x10000000
push eax
call fcn.10047f90
add esp, 4
cmp eax, 0xd0000004
jne 0x100218d4
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov dword [esp + 0x50], 0xd0000004
mov dword [esp + 0x54], edx
add ecx, ebx
lea ebx, [eax + 0x2800]
test eax, eax
cmove ebx, ecx
test edx, edx
je 0x10021780
lea eax, [esp + 0x54]
push eax
call fcn.10047d70
add esp, 4
jmp 0x10021780
push ebx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.10023d30
add esp, 0xc
mov edi, dword [esp + 0x24]
jmp 0x10021796
mov eax, dword [0x106b6680]
mov dword [esp + 8], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], 0
movzx eax, byte [eax]
push 4
push 0x7d0
call fcn.1000d070
add esp, 8
test eax, eax
je 0x10021c60
mov dword [esp + 0x2c], 0x1f4
mov dword [esp + 0x30], eax
mov eax, dword [esp + 4]
mov esi, dword [esp + 0xc]
xor edi, edi
mov dword [esp + 0x34], 0
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
jmp 0x1002187c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0xc]
add edi, ebx
test ebx, ebx
je 0x100218b2
mov eax, dword [esp + 8]
mov ebx, dword [eax + edi]
push dword [esp + 0x10]
push esi
push dword [eax + edi + 0x44]
push 1
call dword [esp + 0x14]
add esp, 0x10
test al, al
je 0x10021876
mov esi, dword [esp + 0x34]
cmp esi, dword [esp + 0x2c]
jne 0x10021860
lea eax, [esp + 0x2c]
push eax
call fcn.10024210
add esp, 4
jmp 0x10021860
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
cmp byte [eax], 0
lea edi, [ebx + 0x20]
mov dword [esp + 0x3c], edi
je 0x10021908
mov ecx, ebx
xor edx, edx
xor esi, esi
call fcn.10016e10
mov eax, dword [ebx + 8]
jmp 0x1002190c
test edx, edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edx
je 0x100218ed
lea eax, [esp + 0x54]
push eax
call fcn.10047d70
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10021901
push 1
push eax
push edi
call fcn.1000d080
add esp, 0xc
xor eax, eax
jmp 0x10021c4c
xor eax, eax
xor esi, esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
call fcn.10097580
lea ebx, [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0x19db1de
push 0xd53e8000
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.100975b0
add esp, 0x10
mov eax, dword [esp + 0x50]
or eax, dword [esp + 0x54]
je 0x1002194d
xor eax, eax
xor ecx, ecx
jmp 0x10021955
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 8
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x38]
movsd qword [esp + 0x50], xmm0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x6c], eax
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.100181b0
add esp, 8
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
imul ecx, edx, 0xe8
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
add ecx, esi
test edx, edx
mov dword [esp + 8], ecx
je 0x10021bdd
mov esi, dword [esp + 4]
mov dword [esp + 0x10], edi
jmp 0x100219fa
cmp esi, dword [esp + 8]
je 0x10021c10
mov eax, esi
add esi, 0xe8
mov ecx, dword [eax]
cmp ecx, 2
je 0x10021bdd
add eax, 4
mov dword [esp + 0x138], ecx
push 0xe4
push eax
lea eax, [esp + 0x144]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x138]
push eax
push dword [esp + 0x210]
push edi
push ebx
call fcn.10025c90
add esp, 0x10
cmp dword [esp + 0x50], 2
je 0x100219f0
mov eax, dword [esp + 0x60]
test eax, eax
je 0x10021a64
push 1
push eax
push dword [esp + 0x6c]
call fcn.1000d080
add esp, 0xc
mov edi, dword [esp + 0x108]
test edi, edi
je 0x10021aa0
mov ebx, dword [esp + 0x104]
add ebx, 4
jmp 0x10021a86
add ebx, 0x10
dec edi
je 0x10021aa0
mov eax, dword [ebx - 4]
test eax, eax
je 0x10021a80
push 1
push eax
push dword [ebx]
call fcn.1000d080
add esp, 0xc
jmp 0x10021a80
mov eax, dword [esp + 0x100]
test eax, eax
je 0x10021ac0
shl eax, 4
push 4
push eax
push dword [esp + 0x10c]
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x10021ade
test eax, eax
je 0x10021ade
push 1
push eax
push dword [esp + 0x7c]
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x118]
cmp eax, 0x80000000
je 0x10021b02
test eax, eax
je 0x10021b02
push 1
push eax
push dword [esp + 0x124]
call fcn.1000d080
add esp, 0xc
mov edi, dword [esp + 0x114]
test edi, edi
je 0x10021b40
mov ebx, dword [esp + 0x110]
add ebx, 4
jmp 0x10021b26
add ebx, 0x10
dec edi
je 0x10021b40
mov eax, dword [ebx - 4]
test eax, eax
je 0x10021b20
push 1
push eax
push dword [ebx]
call fcn.1000d080
add esp, 0xc
jmp 0x10021b20
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x10021b60
shl eax, 4
push 4
push eax
push dword [esp + 0x118]
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x50]
cmp eax, 0x80000000
je 0x10021b8c
test eax, eax
je 0x10021b8c
push 1
push eax
push dword [esp + 0x8c]
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x90]
cmp eax, 0x80000000
je 0x10021bb0
test eax, eax
je 0x10021bb0
push 1
push eax
push dword [esp + 0x9c]
call fcn.1000d080
add esp, 0xc
mov eax, dword [esp + 0x128]
test eax, eax
je 0x100219f0
lock dec dword [eax]
jne 0x100219f0
lea eax, [esp + 0x128]
push eax
call fcn.100279a0
add esp, 4
jmp 0x100219f0
mov ebx, dword [esp + 8]
mov ecx, 0x8d3dcb09
mov eax, ebx
sub eax, esi
mul ecx
cmp ebx, esi
je 0x10021c10
mov edi, edx
shr edi, 7
nop word cs:[eax + eax]
nop
mov ecx, esi
call fcn.10010bf0
add esi, 0xe8
dec edi
jne 0x10021c00
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10021c2d
imul eax, eax, 0xe8
push 8
push eax
push dword [esp + 0xc]
call fcn.1000d080
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
test ecx, ecx
je 0x10021c4c
push 1
push ecx
push dword [esp + 0x2c]
mov esi, eax
call fcn.1000d080
mov eax, esi
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x80000
push 1
call fcn.100d0890
push 0x7d0
push 4
call fcn.100d0890
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2c], 0
je 0x10021d2e
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x30]
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.10025070
add esp, 8
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
xor ebx, ebx
pcmpeqd xmm1, xmm1
mov edi, edx
mov dword [ebp - 0x10], ecx
and edi, eax
shr eax, 0x19
movd xmm0, eax
lea eax, [ecx - 0xf0]
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmm2, xmmword [ecx + edi]
mov dword [ebp - 0x14], ebx
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb ebx, xmm3
test ebx, ebx
je 0x10021cff
nop
tzcnt ecx, ebx
add ecx, edi
and ecx, edx
neg ecx
imul ecx, ecx, 0xf0
cmp dword [eax + ecx], esi
je 0x10021d1c
lea ecx, [ebx - 1]
and cx, bx
mov ebx, ecx
jne 0x10021ce0
mov ebx, dword [ebp - 0x14]
pcmpeqb xmm2, xmm1
pmovmskb ecx, xmm2
test ecx, ecx
jne 0x10021d40
mov ecx, dword [ebp - 0x10]
lea edi, [edi + ebx + 0x10]
add ebx, 0x10
and edi, edx
jmp 0x10021cc7
mov eax, dword [ebp - 0x10]
add eax, ecx
lea edx, [eax - 0xf0]
test eax, eax
cmove edx, eax
jmp 0x10021d30
xor edx, edx
lea eax, [edx + 8]
test edx, edx
cmove eax, edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x10021d21