Function at 0x575ba0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x458
mov esi, esp
mov dword [esi + 0x10], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0x40], eax
mov eax, esp
mov dword [esi + 0x444], eax
mov dword [esi + 0x450], 0xffffffff
lea eax, [esi + 0x448]
mov dword [esi + 0x44c], 0x576a90
mov ecx, dword fs:[0]
mov dword [esi + 0x448], ecx
mov dword fs:[0], eax
mov byte [esi + 0x42b], 0
mov byte [esi + 0x42a], 0
mov byte [esi + 0x429], 0
mov dword [esi + 0x44], 0x80000
mov ecx, dword [esi + 0x44]
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x48]
mov dword [esi + 0x3c], ecx
mov dword [eax], ecx
mov dword [eax + 8], 0x60ac18
call fcn.0059e890
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x54], 0
mov edx, dword [esi + 0x44]
mov dword [esi + 0x450], 0
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
call fcn.005a0ab0
jmp 0x575c4c
mov eax, esp
lea ecx, [esi + 0x48]
mov dword [eax], ecx
call fcn.0059ed00
mov dword [esi + 0x38], eax
jmp 0x575c5d
mov edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x54]
mov dword [esp], 5
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
mov dword [esi + 0x42c], eax
cmp eax, 0xc0000004
jne 0x575c97
cmp dword [esi + 0x54], 0
je 0x575cb6
jmp 0x575cca
mov eax, esp
lea ecx, [esi + 0x58]
mov dword [eax], ecx
mov dword [eax + 8], 0x60ac48
mov dword [eax + 4], 0x1f4
call fcn.0059ea70
jmp 0x575d3c
mov eax, dword [esi + 0x44]
mov ecx, 2
mul ecx
mov dword [esi + 0x34], eax
seto al
jo 0x575cfc
jmp 0x575cdc
mov eax, dword [esi + 0x54]
add eax, 0x2800
mov dword [esi + 0x30], eax
setb al
jb 0x575d2d
jmp 0x575d0d
mov eax, dword [esi + 0x34]
mov dword [esi + 0x44], eax
mov dword [esi + 0x450], 0xffffffff
lea eax, [esi + 0x48]
mov dword [esp], eax
call fcn.005b0520
jmp 0x575c0b
mov eax, esp
mov dword [eax], 0x60ac28
call fcn.005f70d0
jmp 0x575d0b
ud2
mov eax, dword [esi + 0x30]
mov dword [esi + 0x44], eax
mov dword [esi + 0x450], 0xffffffff
lea eax, [esi + 0x48]
mov dword [esp], eax
call fcn.005b0520
jmp 0x575c0b
mov eax, esp
mov dword [eax], 0x60ac38
call fcn.005f7050
jmp 0x575d0b
mov byte [esi + 0x42b], 1
mov dword [esi + 0x64], 0
mov dword [esi + 0x450], 1
mov eax, esp
lea ecx, [esi + 0x48]
mov dword [eax], ecx
call fcn.005a06d0
mov dword [esi + 0x2c], eax
jmp 0x575d65
mov ecx, dword [esi + 0x2c]
mov edx, dword [esi + 0x64]
mov dword [esi + 0x24], edx
mov dword [esi + 0x438], ecx
mov dword [esi + 0x43c], edx
mov eax, esp
mov dword [eax + 4], edx
mov dword [eax], ecx
mov dword [eax + 8], 1
call fcn.0059a310
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x24]
add ecx, eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x430], ecx
mov dword [esi + 0x434], ecx
mov eax, esp
mov dword [eax + 4], ecx
lea ecx, [esi + 0x58]
mov dword [eax], ecx
mov dword [eax + 8], 0x60ac58
call fcn.0059ff00
jmp 0x575dbc
mov eax, dword [esi + 0x28]
cmp dword [eax], 0
jne 0x575ddb
mov ecx, dword [esi + 0x40]
add ecx, 0xd8
mov eax, esp
mov dword [eax], ecx
call fcn.0059f9d0
mov dword [esi + 0x20], eax
jmp 0x575df4
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
add eax, dword [esi + 0x64]
mov dword [esi + 0x1c], eax
seto al
jo 0x576089
jmp 0x57607e
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x440], eax
mov dword [esi + 0x74], eax
mov eax, esp
lea ecx, [esi + 0x78]
mov dword [eax], ecx
call fcn.00578ed0
jmp 0x575e1b
mov byte [esi + 0x42b], 0
mov eax, dword [esi + 0x60]
mov dword [esi + 0xb8], eax
movsd xmm0, qword [esi + 0x58]
movsd qword [esi + 0xb0], xmm0
mov eax, esp
lea ecx, [esi + 0xb0]
mov dword [eax + 4], ecx
lea ecx, [esi + 0xa4]
mov dword [eax], ecx
call fcn.00595e00
jmp 0x575e52
lea eax, [esi + 0x74]
mov dword [esi + 0xbc], eax
lea eax, [esi + 0x68]
mov dword [esi + 0xc0], eax
lea eax, [esi + 0x78]
mov dword [esi + 0xc4], eax
mov eax, esp
lea ecx, [esi + 0xbc]
mov dword [eax + 8], ecx
lea ecx, [esi + 0xa4]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x8c]
mov dword [eax], ecx
call fcn.0059a660
jmp 0x575e90
mov eax, esp
lea ecx, [esi + 0x8c]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x80]
mov dword [eax], ecx
call fcn.0059a690
jmp 0x575eaa
mov ecx, dword [esi + 0x40]
mov byte [esi + 0x42a], 1
mov dword [esi + 0x450], 2
mov eax, esp
mov dword [eax], ecx
call fcn.00581530
jmp 0x575ec9
mov byte [esi + 0x42a], 0
mov eax, dword [esi + 0x88]
mov dword [esi + 0xf0], eax
movsd xmm0, qword [esi + 0x80]
movsd qword [esi + 0xe8], xmm0
mov eax, esp
lea ecx, [esi + 0xe8]
mov dword [eax + 4], ecx
lea ecx, [esi + 0xd8]
mov dword [eax], ecx
call fcn.005a2110
jmp 0x575f06
mov eax, esp
lea ecx, [esi + 0xd8]
mov dword [eax + 4], ecx
lea ecx, [esi + 0xc8]
mov dword [eax], ecx
call fcn.00572080
jmp 0x575f20
mov eax, dword [esi + 0xc8]
mov dword [esi + 0xf8], eax
mov eax, dword [esi + 0xcc]
mov dword [esi + 0xfc], eax
mov eax, dword [esi + 0xd0]
mov dword [esi + 0x100], eax
mov eax, dword [esi + 0xd4]
mov dword [esi + 0x104], eax
mov dword [esi + 0x450], 3
mov eax, esp
lea ecx, [esi + 0xf8]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x108]
mov dword [eax], ecx
call fcn.0056f860
jmp 0x575f74
cmp dword [esi + 0x108], 2
sete al
test al, 1
jne 0x575f84
jmp 0x575f9f
mov dword [esi + 0x450], 2
mov eax, esp
lea ecx, [esi + 0xf8]
mov dword [eax], ecx
call fcn.0057e230
jmp 0x575fe3
mov byte [esi + 0x429], 1
mov eax, esp
lea ecx, [esi + 0x108]
mov dword [eax + 4], ecx
lea ecx, [esi + 0x1d0]
mov dword [esi + 0x14], ecx
mov dword [eax], ecx
mov dword [eax + 8], 0xc8
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x450], 4
mov eax, esp
mov dword [eax], ecx
call fcn.00578970
mov dword [esi + 0x18], eax
jmp 0x57601b
mov byte [esi + 0x42a], 0
mov byte [esi + 0x42b], 0
mov dword [esi + 0x450], 0xffffffff
mov eax, esp
lea ecx, [esi + 0x48]
mov dword [eax], ecx
call fcn.005b0520
mov eax, dword [esi + 0x448]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x429], 0
mov eax, esp
lea ecx, [esi + 0x1d0]
mov dword [eax + 4], ecx
lea edi, [esi + 0x360]
mov dword [eax], edi
mov dword [eax + 8], 0xc8
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x40]
mov eax, esp
mov dword [eax + 0xc], edi
mov dword [eax + 8], edx
mov dword [eax + 4], ecx
lea ecx, [esi + 0x298]
mov dword [eax], ecx
call fcn.00581490
jmp 0x576061
mov eax, esp
lea ecx, [esi + 0x298]
mov dword [eax], ecx
call fcn.0057de80
jmp 0x576072
mov byte [esi + 0x429], 0
jmp 0x575f50
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x64], eax
jmp 0x575d4a
mov eax, esp
mov dword [eax], 0x60ac68
call fcn.005f7050
jmp 0x575d0b