Function at 0x1abf0
Capabilities:
Attach user process memory
Enumerate processes via ntquerysysteminformation
Find process by pid
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x30f04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
xor edi, edi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
mov dword [ebp - 0x210], edi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
push dword [ebp - 0x210]
push edi
call fcn.0001762c
mov esi, eax
mov dword [ebp - 0x21c], esi
cmp esi, edi
jne 0x1ac64
mov dword [ebp - 0x214], 0xc000009a
jmp 0x1aead
push dword [ebp - 0x210]
push edi
push esi
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x210]
push esi
push 5
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [ebp - 0x214], eax
cmp eax, edi
jne 0x1aea0
push ebx
mov ebx, 0xfffe
mov ecx, dword [esi + 0x3c]
cmp ecx, edi
je 0x1ae90
movzx eax, word [esi + 0x38]
mov edx, eax
and edx, ebx
cmp dx, 0x16
jae 0x1acbd
movzx eax, ax
shr eax, 1
jmp 0x1acc0
push 0xb
pop eax
mov edi, dword [sym.imp.ntoskrnl.exe__wcsnicmp]
push eax
push 0x2966a
push ecx
call edi
add esp, 0xc
test eax, eax
je 0x1ad5c
movzx eax, word [esi + 0x38]
mov ecx, eax
and ecx, ebx
cmp cx, 0x18
jae 0x1acef
movzx eax, ax
shr eax, 1
jmp 0x1acf2
push 0xc
pop eax
push eax
push 0x296b0
push dword [esi + 0x3c]
call edi
add esp, 0xc
test eax, eax
je 0x1ad5c
movzx eax, word [esi + 0x38]
mov ecx, eax
and ecx, ebx
cmp cx, 0x12
jae 0x1ad19
movzx eax, ax
shr eax, 1
jmp 0x1ad1c
push 9
pop eax
push eax
push 0x2969c
push dword [esi + 0x3c]
call edi
add esp, 0xc
test eax, eax
je 0x1ad5c
movzx eax, word [esi + 0x38]
mov ecx, eax
and ecx, ebx
cmp cx, 0x18
jae 0x1ad43
movzx eax, ax
shr eax, 1
jmp 0x1ad46
push 0xc
pop eax
push eax
push 0x29682
push dword [esi + 0x3c]
call edi
add esp, 0xc
test eax, eax
jne 0x1ae90
push 0x103
lea eax, [ebp - 0x20c]
push eax
push dword [esi + 0x44]
call fcn.00019b94
test eax, eax
jne 0x1ad83
mov dword [ebp - 0x214], 0xc0000001
jmp 0x1ae90
lea eax, [ebp - 0x20c]
push eax
call fcn.000184ce
test eax, eax
je 0x1ad9f
push 2
push 1
push dword [esi + 0x44]
call fcn.00021384
lea eax, [ebp - 0x20c]
push eax
call fcn.000192f0
test al, al
je 0x1ae3b
and dword [ebp - 0x234], 0
and dword [ebp - 0x218], 0
xor eax, eax
lea edi, [ebp - 0x230]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x64
push dword [esi + 0x44]
stosd dword es:[edi], eax
call fcn.00026ae0
lea eax, [ebp - 0x218]
push eax
push dword [esi + 0x44]
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x214], eax
test eax, eax
jl 0x1ae90
cmp dword [ebp - 0x218], 0
je 0x1ae90
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push dword [esi + 0x44]
call fcn.0001d7be
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0x1ae3b
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea eax, [ebp - 0x20c]
push eax
call fcn.00019536
test eax, eax
je 0x1ae78
call fcn.0001dc40
push dword [esi + 0x44]
call fcn.0001971e
xor ecx, ecx
mov eax, 0x340ec
inc ecx
lock xadd dword [eax], ecx
inc ecx
cmp ecx, 1
jg 0x1ae78
cmp byte [0x353e0], 0
je 0x1ae78
call fcn.000272fc
lea eax, [ebp - 0x20c]
push eax
call fcn.0001764c
test al, al
je 0x1ae90
mov eax, dword [esi + 0x44]
mov dword [0x33de0], eax
mov eax, dword [esi]
xor edi, edi
cmp eax, edi
je 0x1ae9f
add esi, eax
jmp 0x1ac9d
pop ebx
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
xor ecx, ebp
pop esi
call fcn.0002738c
leave
ret