Function at 0x10008f11
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
cmp dword [0x1002d570], 0xa
jl 0x10008f35
mov eax, dword [0x1002d574]
lea edx, [eax + 1]
imul edx, eax
and edx, 1
je 0x10008f35
jmp 0x10008f33
mov dword [ebp - 0x10], ecx
push eax
mov ecx, esp
xor eax, eax
mov dword [ecx], eax
mov dword [ebp - 0x1c], ecx
push ecx
push eax
mov dword [ebp - 0x18], 0
push eax
push 5
call sub.NTDLL.dll_NtQuerySystemInformation
mov ecx, dword [0x1002d574]
mov edx, dword [0x1002d570]
cmp edx, 0xa
jl 0x10008fab
lea edi, [ecx + 1]
imul edi, ecx
and edi, 1
je 0x10008fab
xor edi, edi
mov ebx, 5
mov esi, dword [ebp - 0x1c]
mov dword [esi], edi
push esi
push edi
push edi
push ebx
call sub.NTDLL.dll_NtQuerySystemInformation
mov dword [esi], edi
push esi
push edi
push edi
push ebx
call sub.NTDLL.dll_NtQuerySystemInformation
mov ecx, dword [0x1002d574]
mov edx, dword [0x1002d570]
cmp edx, 0xa
jl 0x10008fab
lea esi, [ecx + 1]
imul esi, ecx
and esi, 1
jne 0x10008f76
cmp eax, 0xc0000004
jne 0x10009017
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x10009017
push 4
push 0x1000
push eax
push 0
call fcn.10010832
test eax, eax
je 0x10008ff0
mov esi, eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
cmp dword [0x1002d570], 0xa
jl 0x10009034
mov eax, dword [0x1002d574]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009060
jmp 0x10009034
mov ecx, dword [0x1002d574]
mov edx, dword [0x1002d570]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
mov dword [ebp - 0x18], 0
cmp edx, 0xa
jl 0x10009017
test eax, eax
je 0x10009017
jmp 0x10009015
cmp edx, 0xa
jl 0x10009029
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
je 0x10009029
jmp 0x10009027
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [ebp - 0x1c]
push edi
push esi
push 5
call sub.NTDLL.dll_NtQuerySystemInformation
mov ebx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
lea edx, [ebx + 1]
imul edx, ebx
mov ebx, edx
and ebx, 1
cmp ecx, 0xa
jl 0x1000906e
test ebx, ebx
je 0x1000906e
push dword [ebp - 0x1c]
push edi
push esi
push 5
call sub.NTDLL.dll_NtQuerySystemInformation
jmp 0x10009034
mov dword [ebp - 0x18], 0
test eax, eax
mov dword [ebp - 0x24], esi
js 0x100093d4
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
je 0x100093d4
cmp ecx, 0xa
jl 0x10009098
and edx, 1
je 0x10009098
jmp 0x10009096
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
mov ebx, dword [esi + 0x44]
call fcn.1001205d
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
cmp ecx, 0xa
jl 0x100090eb
lea edi, [edx + 1]
imul edi, edx
and edi, 1
je 0x100090eb
call fcn.1001205d
call fcn.1001205d
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
cmp ecx, 0xa
jl 0x100090eb
lea esi, [edx + 1]
imul esi, edx
and esi, 1
jne 0x100090c5
cmp ebx, eax
jne 0x1000935a
mov esi, dword [ebp - 0x14]
cmp dword [esi + 4], 0
mov edi, dword [ebp - 0x10]
je 0x1000936b
mov dword [ebp - 0x20], 0
cmp ecx, 0xa
jl 0x1000911e
lea eax, [edx + 1]
imul eax, edx
and eax, 1
jne 0x100093ad
mov eax, dword [ebp - 0x20]
shl eax, 6
mov esi, dword [esi + eax + 0xdc]
call fcn.10013473
mov edx, dword [0x1002d574]
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
mov ecx, dword [0x1002d570]
mov dword [ebp - 0x30], esi
cmp eax, esi
jne 0x10009154
mov esi, dword [ebp - 0x14]
jmp 0x100092f0
cmp ecx, 0xa
jl 0x10009161
test ebx, ebx
jne 0x100093b3
mov eax, dword [edi]
test eax, eax
je 0x100091e3
mov edx, dword [edi + 4]
cmp dword [edi + 8], edx
mov esi, dword [ebp - 0x14]
jb 0x100092a5
lea ecx, [edx + edx]
shl edx, 3
mov dword [ebp - 0x28], ecx
mov dword [edi + 4], ecx
mov dword [ebp - 0x2c], edx
push edx
push eax
push 0
push dword [0x1002ca34]
call fcn.10015135
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
cmp ecx, 0xa
jl 0x10009274
test ebx, ebx
je 0x10009274
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x10]
mov dword [esi + 4], edi
mov ebx, dword [ebp - 0x2c]
push ebx
push dword [esi]
xor eax, eax
push eax
push dword [0x1002ca34]
call fcn.10015135
mov eax, dword [esi]
mov dword [esi + 4], edi
push ebx
push eax
xor eax, eax
push eax
jmp 0x10009189
mov dword [edi + 4], 0x80
push 0x200
push 0
push dword [0x1002ca34]
call fcn.1001500a
mov dword [edi], eax
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
cmp ecx, 0xa
jl 0x1000925e
lea edi, [edx + 1]
imul edi, edx
and edi, 1
mov edi, dword [ebp - 0x10]
mov ebx, 0x200
je 0x1000925e
push ebx
xor esi, esi
push esi
push dword [0x1002ca34]
call fcn.1001500a
mov dword [edi], eax
push ebx
push esi
push dword [0x1002ca34]
call fcn.1001500a
mov dword [edi], eax
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
cmp ecx, 0xa
jl 0x1000925e
lea esi, [edx + 1]
imul esi, edx
and esi, 1
jne 0x10009222
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
test eax, eax
je 0x10009329
mov esi, dword [ebp - 0x14]
jmp 0x100092b2
test eax, eax
je 0x10009337
mov edi, dword [ebp - 0x10]
mov dword [edi], eax
mov eax, dword [0x1002d574]
mov ecx, dword [0x1002d570]
lea ebx, [eax + 1]
imul ebx, eax
and ebx, 1
cmp ecx, 0xa
mov esi, dword [ebp - 0x14]
jl 0x100092a5
test ebx, ebx
jne 0x100093bd
cmp ecx, 0xa
jl 0x100092b2
test ebx, ebx
jne 0x100093b9
cmp ecx, 0xa
jl 0x100092bf
test ebx, ebx
jne 0x100093b7
mov eax, dword [edi]
mov edx, edi
mov edi, dword [edi + 8]
lea ecx, [edi + 1]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + edi*4], ecx
mov edx, dword [0x1002d574]
mov ecx, dword [0x1002d570]
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
cmp ecx, 0xa
jl 0x100092f0
test ebx, ebx
jne 0x100092cc
mov al, 1
cmp ecx, 0xa
jl 0x10009303
test ebx, ebx
mov edi, dword [ebp - 0x10]
je 0x10009306
jmp 0x100093b1
mov edi, dword [ebp - 0x10]
cmp ecx, 0xa
jl 0x10009313
test ebx, ebx
jne 0x100093af
test al, al
je 0x10009374
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [esi + 4]
jb 0x1000910a
jmp 0x10009374
xor eax, eax
mov dword [ebp - 0x18], 0
mov esi, dword [ebp - 0x14]
jmp 0x10009306
xor eax, eax
cmp ecx, 0xa
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
jl 0x10009351
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x10009306
jmp 0x100093bd
mov dword [ebp - 0x18], 0
jmp 0x10009306
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
jmp 0x1000937d
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
cmp ecx, 0xa
jl 0x1000937d
test ebx, ebx
jne 0x100093bb
cmp ecx, 0xa
jl 0x10009386
test ebx, ebx
jne 0x100093b5
mov eax, dword [esi]
lea ebx, [edx + 1]
imul ebx, edx
and ebx, 1
test eax, eax
je 0x100093bf
add esi, eax
cmp ecx, 0xa
jl 0x1000909e
test ebx, ebx
je 0x1000909e
jmp 0x10009096
jmp 0x100093ad
jmp 0x100093af
jmp 0x100093b1
jmp 0x100093b3
jmp 0x100093b5
jmp 0x100093b7
jmp 0x100093b9
jmp 0x100093bb
jmp 0x100093bd
cmp dword [ebp - 0x18], 0
je 0x10009484
cmp ecx, 0xa
jl 0x100093d4
test ebx, ebx
je 0x100093d4
jmp 0x100093d2
test ebx, ebx
sete dl
cmp ecx, 0xa
setl al
or al, dl
test al, al
je 0x100093e1
mov eax, dword [ebp - 0x1c]
mov esi, dword [eax]
push 0x8000
push esi
push dword [ebp - 0x24]
call fcn.1000a058
mov ecx, dword [0x1002d574]
mov edx, dword [0x1002d570]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
cmp edx, 0xa
jl 0x1000900c
test eax, eax
je 0x1000900c
mov ebx, 0x8000
mov edi, dword [ebp - 0x24]
push ebx
push esi
push edi
call fcn.1000a058
push ebx
push esi
push edi
call fcn.1000a058
cmp dword [0x1002d570], 0xa
jl 0x1000944f
mov eax, dword [0x1002d574]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009426
push 0x8000
push esi
push dword [ebp - 0x24]
call fcn.1000a058
mov ecx, dword [0x1002d574]
mov edx, dword [0x1002d570]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
cmp edx, 0xa
jl 0x1000900c
test eax, eax
jne 0x10009426
jmp 0x1000900c
cmp ecx, 0xa
jl 0x1000948f
test ebx, ebx
je 0x1000948f
jmp 0x1000948d
mov esi, dword [edi]
test esi, esi
je 0x100093c9
mov ebx, dword [0x1002ca34]
push esi
push 0
push ebx
call fcn.1001763e
cmp dword [0x1002d570], 0xa
jl 0x100094ec
mov eax, dword [0x1002d574]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x100094ec
xor edi, edi
push esi
push edi
push ebx
call fcn.1001763e
push esi
push edi
push ebx
call fcn.1001763e
cmp dword [0x1002d570], 0xa
jl 0x100094ec
mov eax, dword [0x1002d574]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100094c3
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [0x1002d574]
mov ecx, dword [0x1002d570]
lea ebx, [eax + 1]
imul ebx, eax
and ebx, 1
cmp ecx, 0xa
jl 0x100093c9
test ebx, ebx
je 0x100093c9
jmp 0x1000951a