Function at 0x4224b0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4224db
mov ecx, dword [ebp + 0x10]
mov edx, 0x57ce6c
test ecx, ecx
mov dword [esp + 0x10], ecx
jne 0x4224ed
jmp 0x422704
mov edx, 0x57ce54
mov eax, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x59fb24]
mov dword [esp + 4], edx
movzx eax, byte [eax]
push 1
push 0x80000
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x422a04
mov dword [esp + 0x20], 0x80000
mov dword [esp + 0x24], eax
mov edi, eax
xor eax, eax
mov ecx, 0x80000
lea esi, [esp + 0x14]
mov ebx, 0x80000
mov dword [esp + 0x28], 0
jmp 0x422548
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov dword [esp + 0x14], 0
cmp ecx, ebx
jb 0x4225af
push esi
push ebx
push edi
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x4225c8
or eax, 0x10000000
push eax
call fcn.00446800
add esp, 4
cmp eax, 0xd0000004
jne 0x4226d7
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov dword [esp + 0x50], 0xd0000004
mov dword [esp + 0x54], edx
add ecx, ebx
lea ebx, [eax + 0x2800]
test eax, eax
cmove ebx, ecx
test edx, edx
je 0x422540
lea eax, [esp + 0x54]
push eax
call fcn.004465e0
add esp, 4
jmp 0x422540
push 1
push 1
push ebx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004183d0
add esp, 0x14
mov edi, dword [esp + 0x24]
jmp 0x422556
mov eax, dword [0x59fb24]
mov dword [esp + 8], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], 0
movzx eax, byte [eax]
push 4
push 0x7d0
call fcn.0040cd10
add esp, 8
test eax, eax
je 0x422a10
mov dword [esp + 0x2c], 0x1f4
mov dword [esp + 0x30], eax
mov eax, dword [esp + 4]
mov esi, dword [esp + 0xc]
xor edi, edi
mov dword [esp + 0x34], 0
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
jmp 0x42263c
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0xc]
add edi, ebx
test ebx, ebx
je 0x422672
mov eax, dword [esp + 8]
mov ebx, dword [eax + edi]
push dword [esp + 0x10]
push esi
push dword [eax + edi + 0x44]
push 1
call dword [esp + 0x14]
add esp, 0x10
test al, al
je 0x422636
mov esi, dword [esp + 0x34]
cmp esi, dword [esp + 0x2c]
jne 0x422620
lea eax, [esp + 0x2c]
push eax
call fcn.00418170
add esp, 4
jmp 0x422620
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
xor eax, eax
mov esi, 0
cmp byte [ecx], 1
lea edi, [ebx + 0x20]
mov dword [esp + 0x3c], edi
jne 0x422699
mov ecx, ebx
xor edx, edx
xor esi, esi
call fcn.004153d0
mov eax, dword [ebx + 8]
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
call fcn.00496a40
lea ebx, [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0x19db1de
push 0xd53e8000
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00496a70
add esp, 0x10
test byte [esp + 0x50], 1
je 0x42270b
xor eax, eax
xor ecx, ecx
jmp 0x422713
test edx, edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edx
je 0x4226f0
lea eax, [esp + 0x54]
push eax
call fcn.004465e0
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x422704
push 1
push eax
push edi
call fcn.0040cd20
add esp, 0xc
xor eax, eax
jmp 0x4229fc
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 8
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x38]
movsd qword [esp + 0x50], xmm0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x6c], eax
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.004249d0
add esp, 8
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
imul ecx, edx, 0xe8
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
add ecx, esi
test edx, edx
mov dword [esp + 8], ecx
je 0x422997
mov esi, dword [esp + 4]
mov dword [esp + 0x10], edi
jmp 0x4227ba
cmp esi, dword [esp + 8]
je 0x4229c0
mov eax, esi
add esi, 0xe8
mov ecx, dword [eax]
cmp ecx, 2
je 0x422997
add eax, 4
mov dword [esp + 0x138], ecx
push 0xe4
push eax
lea eax, [esp + 0x144]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x138]
push eax
push dword [esp + 0x210]
push edi
push ebx
call fcn.00416b60
add esp, 0x10
cmp dword [esp + 0x50], 2
je 0x4227b0
mov eax, dword [esp + 0x60]
test eax, eax
je 0x422824
push 1
push eax
push dword [esp + 0x6c]
call fcn.0040cd20
add esp, 0xc
mov edi, dword [esp + 0x108]
test edi, edi
je 0x422860
mov ebx, dword [esp + 0x104]
add ebx, 4
jmp 0x422846
add ebx, 0x10
dec edi
je 0x422860
mov eax, dword [ebx - 4]
test eax, eax
je 0x422840
push 1
push eax
push dword [ebx]
call fcn.0040cd20
add esp, 0xc
jmp 0x422840
mov eax, dword [esp + 0x100]
test eax, eax
je 0x422880
shl eax, 4
push 4
push eax
push dword [esp + 0x10c]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x70]
mov ecx, eax
neg ecx
jo 0x42289b
jae 0x42289b
push 1
push eax
push dword [esp + 0x7c]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x118]
mov ecx, eax
neg ecx
jo 0x4228bc
jae 0x4228bc
push 1
push eax
push dword [esp + 0x124]
call fcn.0040cd20
add esp, 0xc
mov edi, dword [esp + 0x114]
test edi, edi
je 0x422900
mov ebx, dword [esp + 0x110]
add ebx, 4
jmp 0x4228e6
add ebx, 0x10
dec edi
je 0x422900
mov eax, dword [ebx - 4]
test eax, eax
je 0x4228e0
push 1
push eax
push dword [ebx]
call fcn.0040cd20
add esp, 0xc
jmp 0x4228e0
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x422920
shl eax, 4
push 4
push eax
push dword [esp + 0x118]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x50]
mov ecx, eax
neg ecx
jo 0x422949
jae 0x422949
push 1
push eax
push dword [esp + 0x8c]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x90]
mov ecx, eax
neg ecx
jo 0x42296a
jae 0x42296a
push 1
push eax
push dword [esp + 0x9c]
call fcn.0040cd20
add esp, 0xc
mov eax, dword [esp + 0x128]
test eax, eax
je 0x4227b0
lock dec dword [eax]
jne 0x4227b0
lea eax, [esp + 0x128]
push eax
call fcn.0040f930
add esp, 4
jmp 0x4227b0
mov ebx, dword [esp + 8]
mov ecx, 0x8d3dcb09
mov eax, ebx
sub eax, esi
mul ecx
cmp ebx, esi
je 0x4229c0
mov edi, edx
shr edi, 7
nop
mov ecx, esi
call fcn.004292f0
add esi, 0xe8
dec edi
jne 0x4229b0
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4229dd
imul eax, eax, 0xe8
push 8
push eax
push dword [esp + 0xc]
call fcn.0040cd20
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
test ecx, ecx
je 0x4229fc
push 1
push ecx
push dword [esp + 0x2c]
mov esi, eax
call fcn.0040cd20
mov eax, esi
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x80000
push 1
call fcn.004cf340
push 0x7d0
push 4
call fcn.004cf340
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2c], 0
je 0x422ade
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x30]
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.00427e60
add esp, 8
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
xor ebx, ebx
pcmpeqd xmm1, xmm1
mov edi, edx
mov dword [ebp - 0x10], ecx
and edi, eax
shr eax, 0x19
movd xmm0, eax
lea eax, [ecx - 0xf0]
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmm2, xmmword [ecx + edi]
mov dword [ebp - 0x14], ebx
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb ebx, xmm3
test ebx, ebx
je 0x422aaf
nop
tzcnt ecx, ebx
add ecx, edi
and ecx, edx
neg ecx
imul ecx, ecx, 0xf0
cmp dword [eax + ecx], esi
je 0x422acc
lea ecx, [ebx - 1]
and cx, bx
mov ebx, ecx
jne 0x422a90
mov ebx, dword [ebp - 0x14]
pcmpeqb xmm2, xmm1
pmovmskb ecx, xmm2
test ecx, ecx
jne 0x422af0
mov ecx, dword [ebp - 0x10]
lea edi, [edi + ebx + 0x10]
add ebx, 0x10
and edi, edx
jmp 0x422a77
mov eax, dword [ebp - 0x10]
add eax, ecx
lea edx, [eax - 0xf0]
test eax, eax
cmove edx, eax
jmp 0x422ae0
xor edx, edx
lea eax, [edx + 8]
test edx, edx
cmove eax, edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x422ad1