Function at 0x42da60
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x238
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov edx, 0x80000
xor edi, edi
mov ebx, 0x80000
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x42e34c
mov esi, 0x80000
mov dword [esp + 0x3c], 0x80000
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0
jmp 0x42dacc
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x44]
mov eax, dword [esp + 4]
sub ebx, edi
mov dword [esp + 0x164], 0
cmp esi, ebx
ja 0x42db47
lea ecx, [esp + 0x164]
push ecx
push esi
mov dword [esp + 0xc], eax
push eax
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x42db63
mov edi, eax
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
push eax
push 0
call sub.oleaut32.dll_GetErrorInfo
mov eax, dword [esp + 0x78]
and edi, 0xefffffff
cmp edi, 0xc0000004
jne 0x42dd08
mov ecx, dword [esp + 0x164]
mov edx, esi
add edx, esi
lea esi, [ecx + 0x2800]
test ecx, ecx
cmove esi, edx
test eax, eax
je 0x42dac0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x42dac0
lea ecx, [esp + 0x3c]
mov edx, edi
push 1
push 1
push esi
call fcn.0042a6b0
add esp, 0xc
mov eax, dword [esp + 0x40]
jmp 0x42dadd
mov dword [esp + 0x44], esi
mov dword [esp + 0x60], 0
xor ecx, ecx
mov edx, 0x7d0
xor esi, esi
movzx eax, byte [0x4af0d4]
call fcn.0042bb70
test eax, eax
je 0x42e34c
mov edx, dword [esp + 4]
xor ebx, ebx
mov dword [esp + 0x48], 0x1f4
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], 0
jmp 0x42dbc1
lea ecx, [edx + ebx]
add ebx, edi
mov dword [eax + esi*4], ecx
inc esi
test edi, edi
mov dword [esp + 0x50], esi
je 0x42dbdd
mov edi, dword [edx + ebx]
cmp esi, dword [esp + 0x48]
jne 0x42dbb0
lea ecx, [esp + 0x48]
call fcn.0042e350
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x4c]
jmp 0x42dbb0
mov ebx, dword [esp + 0xc]
xor edi, edi
mov esi, 0
lea eax, [ebx + 0x20]
mov dword [esp + 0x58], eax
mov dword [esp + 0x64], eax
mov eax, dword [esp + 8]
cmp byte [eax], 1
mov eax, 0
jne 0x42dc0f
mov ecx, ebx
xor edx, edx
xor esi, esi
call fcn.0042e3e0
mov eax, dword [ebx + 8]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x78], 0
mov dword [esp + 0x6c], esi
mov dword [esp + 0x7c], 0
push eax
call sub.kernel32.dll_GetSystemTimePreciseAsFileTime
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
cmp ecx, 0xd53e8000
mov eax, edx
sbb eax, 0x19db1de
mov eax, 0
jl 0x42dc6c
add ecx, 0x2ac18000
adc edx, 0xfe624e21
push 0
push 0x989680
push edx
push ecx
call fcn.004490c0
add esp, 0x10
mov edi, edx
mov dword [esp + 0x74], edi
mov edi, dword [esp + 0x50]
movq xmm0, qword [esp + 0x48]
mov ecx, dword [esp + 8]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
lea edx, [esp + 0x64]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0
mov dword [esp + 0x80], edi
movq qword [esp + 0x78], xmm0
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], ecx
lea edx, [esp + 0x68]
lea ecx, [esp + 0x70]
mov dword [esp + 0x90], edx
mov dword [esp + 0x94], ecx
mov ebx, dword [esp + 0x78]
cmp ebx, edi
jb 0x42e34c
mov esi, dword [esp + 0x7c]
call fcn.0042c990
test eax, eax
je 0x42e34c
mov eax, dword [eax]
mov dword [esp + 4], ebx
test eax, eax
je 0x42dd26
add eax, 0x8c
jmp 0x42dd2b
test eax, eax
je 0x42dd12
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp + 0x3c], 0
je 0x42e344
push dword [esp + 4]
jmp 0x42e337
call fcn.00425f70
mov eax, dword [eax]
xor ecx, ecx
cmp edi, 0xffffffff
lea ebx, [esp + 0x84]
mov edx, edi
sete cl
mov eax, dword [eax + 0x104]
cmp ecx, eax
cmova eax, ecx
lea ecx, [esp + 0x164]
push ebx
push edi
push esi
push 1
push eax
push 0
call fcn.0042eb60
add esp, 0x18
cmp dword [esp + 4], 0
je 0x42dd75
push esi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [esp + 0x16c]
mov ebx, dword [esp + 0x164]
test eax, eax
sete cl
test ebx, ebx
sete dl
or dl, cl
jne 0x42ddd4
dec eax
xor esi, esi
mov ecx, ebx
nop word cs:[eax + eax]
add esi, dword [ecx + 8]
sub eax, 1
jb 0x42ddaf
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x42dda0
test esi, esi
je 0x42ddd4
lea ecx, [esp + 0x20]
xor edx, edx
push 0xe8
push 8
push esi
call fcn.0042a6b0
add esp, 0xc
jmp 0x42ddd4
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x42de83
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x42ddea
mov dword [eax + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov edi, dword [ebx]
mov esi, dword [ebx + 8]
mov dword [esp + 8], eax
push ebx
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, edi
neg eax
jo 0x42de7b
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x14], edi
sub eax, ebx
cmp eax, esi
jb 0x42de5f
imul eax, ebx, 0xe8
imul ecx, esi, 0xe8
add eax, dword [esp + 0x24]
push ecx
mov edi, dword [esp + 0xc]
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
add ebx, esi
cmp dword [esp + 0x14], 0
mov dword [esp + 0x28], ebx
je 0x42ddd0
push edi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x42ddd0
lea ecx, [esp + 0x20]
mov edx, ebx
push 0xe8
push 8
push esi
call fcn.0042a6b0
add esp, 0xc
mov ebx, dword [esp + 0x28]
jmp 0x42de20
mov eax, dword [esp + 4]
test eax, eax
jne 0x42ded4
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0xc]
imul edx, ecx, 0xe8
mov dword [esp + 0x5c], eax
mov dword [esp + 0x10], esi
add edx, esi
test ecx, ecx
mov dword [esp + 0x18], edx
je 0x42e18d
mov edi, dword [esp + 0x10]
lea eax, [ebx + 0x30]
mov dword [esp + 0x54], eax
jmp 0x42dfb2
push esi
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
test ebx, ebx
mov eax, ebx
je 0x42de83
mov ebx, dword [eax + 0xc]
test ebx, ebx
je 0x42dee2
mov dword [ebx + 0x10], 0
mov esi, dword [eax + 8]
mov ecx, dword [eax + 4]
mov dword [esp + 4], eax
test esi, esi
mov dword [esp + 8], ecx
je 0x42df10
mov edi, dword [esp + 8]
nop dword [eax + eax]
mov ecx, edi
call fcn.0042f560
add edi, 0xe8
dec esi
jne 0x42df00
mov esi, dword [esp + 4]
cmp dword [esi], 0
je 0x42dec0
push dword [esp + 8]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
jmp 0x42dec0
mov edx, dword [esp + 0xc]
and al, 1
movzx eax, al
sub dword [edx + 0x28], eax
lea eax, [edi - 0x10]
and eax, ecx
mov ecx, dword [esp + 0x34]
mov byte [ebx + edi], cl
mov byte [ebx + eax + 0x10], cl
mov eax, dword [esp + 0x1c]
inc dword [edx + 0x2c]
neg edi
imul edi, edi, 0xf0
mov dword [ebx + edi - 0xf0], esi
mov dword [ebx + edi - 0xe8], eax
lea eax, [ebx + edi - 0xe4]
push 0xd0
lea ecx, [esp + 0x168]
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebx + edi - 0x14], esi
movq xmm0, qword [esp + 0x20]
movq xmm1, qword [esp + 0x28]
movq qword [ebx + edi - 0x10], xmm0
movq qword [ebx + edi - 8], xmm1
nop
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
cmp edi, dword [esp + 0x18]
je 0x42e1c0
mov eax, dword [edi]
lea esi, [edi + 0xe8]
cmp eax, 2
je 0x42e18d
mov dword [esp + 0x14], esi
mov esi, dword [edi + 0xd4]
mov dword [esp + 0x1c], eax
lea eax, [edi + 4]
push 0xd0
push eax
lea eax, [esp + 0x16c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
movsd xmm0, qword [edi + 0xd8]
movsd xmm1, qword [edi + 0xe0]
mov ecx, dword [ebx + 0x30]
mov edx, dword [ebx + 0x34]
movsd qword [esp + 0x20], xmm0
movsd qword [esp + 0x28], xmm1
push esi
push dword [ebx + 0x3c]
push dword [ebx + 0x38]
call fcn.0042f700
add esp, 0xc
cmp dword [ebx + 0x28], 0
mov edi, eax
je 0x42e17b
mov eax, ebx
mov ebx, dword [ebx + 0x20]
xor edx, edx
mov dword [esp + 8], 0
mov ecx, dword [eax + 0x24]
mov eax, edi
shr eax, 0x19
movd xmm0, eax
mov dword [esp + 0x34], eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
and edi, ecx
mov dword [esp + 4], edx
movdqu xmm1, xmmword [ebx + edi]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb eax, xmm2
test eax, eax
je 0x42e093
nop
tzcnt edx, eax
add edx, edi
and edx, ecx
neg edx
imul edx, edx, 0xf0
cmp dword [ebx + edx - 0xf0], esi
je 0x42e0e0
lea edx, [eax - 1]
and dx, ax
mov eax, edx
jne 0x42e070
cmp dword [esp + 8], 1
mov edx, 1
je 0x42e0b6
pmovmskb eax, xmm1
xor edx, edx
test eax, eax
setne dl
tzcnt eax, eax
add eax, edi
and eax, ecx
mov dword [esp + 0x38], eax
pcmpeqd xmm2, xmm2
pcmpeqb xmm1, xmm2
pmovmskb eax, xmm1
test eax, eax
mov eax, dword [esp + 4]
jne 0x42e156
lea edi, [edi + eax + 0x10]
add eax, 0x10
mov dword [esp + 8], edx
mov edx, eax
jmp 0x42e054
add ebx, edx
lea eax, [ebx - 0xe8]
push 0xe8
push eax
lea eax, [esp + 0x80]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x1c]
mov dword [ebx - 0xe8], eax
lea eax, [ebx - 0xe4]
push 0xd0
lea ecx, [esp + 0x168]
push ecx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [ebx - 0x14], esi
movq xmm0, qword [esp + 0x20]
movq xmm1, qword [esp + 0x28]
movq qword [ebx - 8], xmm1
movq qword [ebx - 0x10], xmm0
cmp dword [esp + 0x78], 2
je 0x42dfa0
lea ecx, [esp + 0x78]
call fcn.0042f560
jmp 0x42dfa0
mov edi, dword [esp + 0x38]
movzx eax, byte [ebx + edi]
test al, al
js 0x42df2c
movdqa xmm0, xmmword [ebx]
pmovmskb eax, xmm0
tzcnt edi, eax
movzx eax, byte [ebx + edi]
jmp 0x42df2c
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x54]
call fcn.0042f9a0
jmp 0x42e027
mov ecx, dword [esp + 0x18]
mov edx, 0x8d3dcb09
mov eax, ecx
sub eax, esi
mul edx
cmp ecx, esi
je 0x42e1c0
mov edi, edx
shr edi, 7
nop word cs:[eax + eax]
nop
mov ecx, esi
call fcn.0042f560
add esi, 0xe8
dec edi
jne 0x42e1b0
cmp dword [esp + 0x5c], 0
je 0x42e1d8
push dword [esp + 0x10]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
mov eax, dword [ebx + 0x2c]
test eax, eax
mov dword [esp + 8], eax
je 0x42e32c
mov eax, dword [esp + 0xc]
pcmpeqd xmm1, xmm1
mov edi, dword [eax + 0x20]
mov ecx, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
movdqa xmm0, xmmword [edi]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 8]
lea ebx, [edi + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 4], edi
pmovmskb esi, xmm0
not esi
jmp 0x42e269
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x18]
mov byte [eax + ecx], dl
mov ecx, dword [esp + 0x38]
mov byte [eax + ecx + 0x10], dl
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
lea ecx, [edi + eax - 0xe8]
mov eax, dword [esp + 8]
dec eax
mov dword [esp + 8], eax
mov dword [edx + 0x2c], eax
call fcn.0042f560
mov ecx, dword [esp + 0x14]
pcmpeqd xmm1, xmm1
lea eax, [esi - 1]
and eax, esi
dec ecx
mov esi, eax
je 0x42e32c
test si, si
jne 0x42e28b
nop
movdqa xmm0, xmmword [ebx]
add edi, 0xfffff100
add ebx, 0x10
pmovmskb esi, xmm0
cmp esi, 0xffff
je 0x42e270
not esi
tzcnt eax, esi
neg eax
imul eax, eax, 0xf0
cmp byte [edi + eax - 8], 0
mov byte [edi + eax - 8], 0
jne 0x42e25b
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], eax
lea ecx, [edi + eax]
mov eax, dword [esp + 4]
mov edx, eax
sub edx, ecx
sar edx, 4
imul edx, edx, 0xeeeeeeef
lea ecx, [edx - 0x10]
and ecx, dword [esp + 0x34]
movdqu xmm0, xmmword [eax + ecx]
mov dword [esp + 0x38], ecx
pcmpeqb xmm0, xmm1
pmovmskb ecx, xmm0
test ecx, ecx
je 0x42e2e4
bsr cx, cx
xor ecx, 0xf
jmp 0x42e2e8
mov cx, 0x10
mov eax, dword [esp + 4]
mov dword [esp + 0x18], edx
movdqu xmm0, xmmword [eax + edx]
pcmpeqb xmm0, xmm1
pmovmskb edx, xmm0
or edx, 0x10000
tzcnt edx, edx
add ecx, edx
mov dl, pe_nt_image_headers32
cmp cx, 0xf
ja 0x42e220
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dl, 0xff
inc eax
mov dword [esp + 0x10], eax
mov dword [ecx + 0x28], eax
jmp 0x42e220
cmp dword [esp + 0x3c], 0
je 0x42e344
push dword [esp + 0x40]
push 0
push dword [0x4af0c0]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2