Function at 0x40948b
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0040948b
xor esi, esi
mov ecx, 0x66
push esi
dec ecx
jne 0x4094a5
xor eax, eax
call fcn.00418024
push 0
push 0x10000
push 1
push 0x1000000
push 0
lea ebx, [ebp - 0x21c]
call fcn.0040e2a5
xor eax, eax
add eax, dword [ebp - 0x21c]
mov ebx, eax
mov eax, ebx
mov dword [ebp - 0xa0], eax
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov dword [ebx], eax
push 0x10000
push dword [ebp - 0xa0]
push 5
call dword [sym.imp.NTDLL.DLL_NtQuerySystemInformation]
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
mov eax, esi
push eax
call fcn.00408091
not eax
test eax, eax
je 0x409523
cmp esi, 0xc0000004
jne 0x409523
cmp esi, 0
jne 0x409523
jmp 0x40984e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x3c]
mov ecx, eax
mov ebx, dword [ebp - 0xa0]
movzx eax, word [ebx + 0x38]
call fcn.00413530
xor eax, eax
call fcn.00412b6a
lea ebx, [ebp - 0x1a4]
mov ecx, 0x104
call fcn.00417e54
lea ebx, [ebp - 0x1a4]
call fcn.00417e0b
xor eax, eax
call fcn.00410eb6
lea ebx, [ebp - 0x98]
call fcn.004173d3
mov edx, 0x41bae8
call fcn.00417ff9
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
xor eax, eax
call fcn.00410eb6
call fcn.00417697
lea ebx, [ebp - 0x1a8]
call fcn.004173d3
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
mov edx, 0x41b920
call fcn.00417ff9
call fcn.0041772c
je 0x409801
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
mov edx, 0x41bc98
call fcn.00417ff9
call fcn.0041772c
je 0x409801
xor eax, eax
mov edx, dword [0x419f4c]
call fcn.00417fe2
mov ecx, 1
mov edx, dword [ebp - 0x1a8]
call fcn.00417fe2
xchg ecx, eax
call fcn.0040f1de
cmp eax, ecx
jle 0x409801
mov edx, dword [0x419740]
call fcn.00417fe2
mov edx, 0x41b920
call fcn.00417ff9
call fcn.0041772c
jne 0x4096eb
xor eax, eax
mov edx, dword [0x419740]
call fcn.00417fe2
mov ecx, 1
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
mov edx, 0x41bb70
call fcn.00417ff9
call fcn.00417697
mov ebx, dword [ebp - 0xa0]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x44]
call fcn.004173a5
call fcn.004161dc
call fcn.00417697
mov eax, ecx
call fcn.0040f1de
cmp eax, dword [ebp - 0x30]
jne 0x4096e6
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
mov edx, 0x41bb70
call fcn.00417ff9
call fcn.00417697
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x44]
call fcn.004173a5
call fcn.004161dc
call fcn.00417697
mov edx, 0x41b928
call fcn.00417ff9
call fcn.00417697
call sym.iPush.Dll_Now
call fcn.00418010
call fcn.00417697
mov ebx, 0x419740
call fcn.004173d3
jmp 0x4097bb
xor eax, eax
mov edx, dword [0x419740]
call fcn.00417fe2
mov ecx, 1
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
mov edx, 0x41bb70
call fcn.00417ff9
call fcn.00417697
mov ebx, dword [ebp - 0xa0]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x44]
call fcn.004173a5
call fcn.004161dc
call fcn.00417697
mov eax, ecx
call fcn.0040f1de
cmp eax, dword [ebp - 0x30]
jne 0x4097bb
mov edx, dword [0x419740]
call fcn.00417fe2
mov edx, 0x41b930
call fcn.00417ff9
call fcn.00417697
mov edx, dword [ebp - 0x98]
call fcn.00417fe2
call fcn.00417697
mov edx, 0x41bb70
call fcn.00417ff9
call fcn.00417697
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x44]
call fcn.004173a5
call fcn.004161dc
call fcn.00417697
mov edx, 0x41b928
call fcn.00417ff9
call fcn.00417697
call sym.iPush.Dll_Now
call fcn.00418010
call fcn.00417697
mov ebx, 0x419740
call fcn.004173d3
cmp dword [0x41a754], 0
jne 0x409801
push 1
mov edx, dword [0x41a76c]
call fcn.00417fe2
push 0
mov ebx, esp
call fcn.004173d3
call fcn.004082e1
call fcn.00418010
mov ebx, 0x419f50
mov ecx, 0x800
call fcn.00417e54
mov dword [0x41a754], 1
fild dword [0x41c14c]
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx]
call fcn.004173a5
fcompp
fnstsw ax
sahf
jne 0x409829
jmp 0x40984e
mov ebx, dword [ebp - 0xa0]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0xa0]
add eax, ecx
mov dword [ebp - 0xa0], eax
mov eax, 1
call fcn.00412985
jmp 0x409530
call fcn.00417eaa
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret