Function at 0x40b530
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41811c
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xe4], edi
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov ecx, edi
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_10421]
test edi, edi
jne 0x40b588
xor eax, eax
jmp 0x40b58b
mov eax, dword [edi + 0x20]
push 0x4558544d
push 8
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
cmp dword [edi + 0x204], 0
je 0x40b5b7
push 0
push 0xf020
push 0x112
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4869]
mov esi, eax
mov dword [ebp - 0xe8], esi
test esi, esi
je 0x40b638
lea ecx, [ebp - 0x98]
call dword [sym.imp.mfc140.dll_Ordinal_316]
push 0x65
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_8426]
mov eax, dword [ebp - 0x98]
cmp dword [eax - 0xc], 0
je 0x40b628
push 0
push 0
push 0x800
push dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
call esi
push dword [ebp - 0x98]
mov eax, dword [ebp - 0xe8]
push 0x10
push 0
push dword [eax + 4]
call esi
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
call dword [sym.imp.mfc140.dll_Ordinal_2241]
push 0xbe
mov eax, dword [eax + 8]
push eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push dword [edi + 0x218]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push dword [edi + 0x20]
mov dword [edi + 0x510], eax
call esi
push dword [edi + 0x218]
push 0
push 0x80
push dword [edi + 0x20]
call esi
push 0
push 0x41bd28
lea ecx, [edi + 0x1fc]
push 0x50
call dword [sym.imp.mfc140.dll_Ordinal_3597]
lea eax, [edi + 0x1fc]
push 1
test eax, eax
jne 0x40b6ad
push eax
push 0x30
push dword [edi + 0xc8]
call esi
xor eax, eax
jmp 0x40b6c0
push dword [eax + 4]
push 0x30
push dword [edi + 0xc8]
call esi
mov eax, dword [edi + 0x200]
push 1
push eax
push 0x30
push dword [edi + 0x180]
call esi
mov esi, dword [sym.imp.USER32.dll_GetWindowLongA]
lea eax, [edi + 0xa8]
push 0xfffffffffffffff0
test eax, eax
jne 0x40b6ee
push eax
call esi
and eax, 0xfffffffd
or eax, 0x401
xor ecx, ecx
jmp 0x40b701
push dword [eax + 0x20]
call esi
mov ecx, dword [edi + 0xc8]
and eax, 0xfffffffd
or eax, 0x401
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0xffffffffffffffff
push 0x50
push 2
push 0x419912
push 0
lea ecx, [edi + 0xa8]
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe149
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x3c
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 1
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe147
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x50
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 2
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14a
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x50
push 1
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 3
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14b
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x46
push 1
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 4
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14c
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x46
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 5
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14e
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x78
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0xa8]
push 6
call dword [sym.imp.mfc140.dll_Ordinal_8026]
lea eax, [edi + 0x160]
push 0xfffffffffffffff0
test eax, eax
jne 0x40b841
push eax
call esi
and eax, 0xfffffffd
or eax, 0x101
xor ecx, ecx
jmp 0x40b854
push dword [eax + 0x20]
call esi
mov ecx, dword [edi + 0x180]
and eax, 0xfffffffd
or eax, 0x101
push eax
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x1036
push dword [edi + 0x180]
call esi
push 0xffffffffffffffff
push 0x14
push 2
push 0
push 0
lea ecx, [edi + 0x160]
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe148
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x3c
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 1
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe149
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x3c
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 2
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe147
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x50
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 3
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14a
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x50
push 1
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 4
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14b
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x46
push 1
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 5
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14c
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0x46
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 6
call dword [sym.imp.mfc140.dll_Ordinal_8026]
push 0xe14d
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_8426]
push 0xffffffffffffffff
push 0xc8
push 0
push dword [ebp - 0x94]
lea ecx, [edi + 0x160]
push 7
call dword [sym.imp.mfc140.dll_Ordinal_8026]
lea eax, [edi + 0x160]
test eax, eax
je 0x40b9c8
mov eax, dword [eax + 0x20]
push 0x20
push 0x20
push 0x1036
push eax
call esi
push 5
push 5
push 9
push 0x10
lea ecx, [edi + 0x4f0]
push 0x10
call dword [sym.imp.mfc140.dll_Ordinal_3177]
mov esi, 0x86
nop
xorps xmm0, xmm0
movlpd qword [ebp - 0xa4], xmm0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xa4], vtable.CBitmap.0
movzx eax, si
push eax
push 2
push eax
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140.dll_Ordinal_2210]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
lea ecx, [ebp - 0xa4]
call dword [sym.imp.mfc140.dll_Ordinal_2520]
test eax, eax
je 0x40ba58
push 0
push dword [ebp - 0xa0]
push dword [edi + 0x4f4]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [ebp - 0xa4]
call dword [sym.imp.mfc140.dll_Ordinal_3874]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], vtable.CBitmap.0
call fcn.0040a230
inc esi
cmp esi, 0x8a
jbe 0x40b9f0
lea eax, [edi + 0x4f0]
test eax, eax
je 0x40ba8b
mov eax, dword [eax + 4]
push eax
push 1
push 0x1003
push dword [edi + 0x180]
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4868]
mov eax, dword [edi + 0x420]
lea ecx, [edi + 0x420]
push 0xe801
push 0x50008200
push edi
call dword [eax + 0x1ac]
push 3
push 0x422438
lea ecx, [edi + 0x420]
call dword [sym.imp.mfc140.dll_Ordinal_13556]
lea eax, [ebp - 0xbc]
xorps xmm0, xmm0
push eax
push dword [edi + 0x20]
movups xmmword [ebp - 0xbc], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xb4]
lea ecx, [edi + 0x420]
sub eax, dword [ebp - 0xbc]
mov esi, dword [sym.imp.mfc140.dll_Ordinal_13724]
sub eax, 0xa0
push eax
push 0
push 0x67
push 0
call esi
push 0x84
push 0
push 0x68
push 1
lea ecx, [edi + 0x420]
call esi
push 0
push 0x8000000
push 0x69
push 2
lea ecx, [edi + 0x420]
call esi
push 1
push 0
push 0
push 0
push 0x69
push 0xe8ff
push 0xe800
mov ecx, edi
call dword [sym.imp.mfc140.dll_Ordinal_12734]
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0xa8], edx
call dword [sym.imp.mfc140.dll_Ordinal_316]
push str.Ready
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 3
push 0x41bd40
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
lea ecx, [edi + 0x420]
push 1
push dword [ebp - 0x9c]
push 0
call dword [sym.imp.mfc140.dll_Ordinal_13730]
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
add esp, 8
test eax, eax
jne 0x40bf96
mov esi, dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea eax, [ebp - 0xe0]
push eax
push 0x41bd44
lea eax, [ebp - 0x90]
push 0x80
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40bbfb
mov byte [ebp - 0x90], al
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x98]
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x9c]
push dword [ebp - 0x98]
push str.__3.3s
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4807]
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x98]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
add esp, 8
test eax, eax
jne 0x40bfa0
lea eax, [ebp - 0xe0]
push eax
push str.__d__Y__H:_M:_S
lea eax, [ebp - 0x90]
push 0x80
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40bc83
mov byte [ebp - 0x90], al
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x98]
call dword [sym.imp.mfc140.dll_Ordinal_310]
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x9c]
call dword [sym.imp.mfc140.dll_Ordinal_1692]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push 1
push dword [ebp - 0x9c]
lea ecx, [edi + 0x420]
push 1
call dword [sym.imp.mfc140.dll_Ordinal_13730]
push 0
push 0x3e8
push 0x68
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x20
push 0x112
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0x18
lea eax, [ebp - 0xd4]
push eax
push 7
call dword [sym.imp.ntdll.dll_ZwQuerySystemInformation]
test eax, eax
js 0x40bf5f
mov eax, dword [ebp - 0xd4]
mov dword [0x4236cc], eax
mov eax, dword [ebp - 0xcc]
mov dword [0x422b84], eax
call fcn.004028d0
call fcn.00403b90
call fcn.00405ef0
test eax, eax
je 0x40bdae
call fcn.004060f0
call fcn.00407630
call fcn.00403e70
call fcn.00406340
cmp dword [0x4236cc], 0
jbe 0x40bd83
xor esi, esi
xor edi, edi
nop dword [eax]
mov ecx, dword [0x425410]
lea ecx, [esi + ecx]
call fcn.00405c30
inc edi
lea esi, [esi + 0x188]
cmp edi, dword [0x4236cc]
jb 0x40bd60
mov edi, dword [ebp - 0xe4]
cmp dword [0x422090], 0
je 0x40bd91
call fcn.004087f0
mov esi, dword [0x422b80]
test esi, esi
je 0x40bdae
nop dword [eax + eax]
mov ecx, esi
call fcn.00405b30
mov esi, dword [esi + 4]
test esi, esi
jne 0x40bda0
lea ecx, [edi + 0x160]
mov dword [edi + 0x4fc], 1
call fcn.00406aa0
lea ecx, [edi + 0xa8]
call fcn.00407440
call dword [sym.imp.mfc140.dll_Ordinal_2251]
mov ecx, eax
test ecx, ecx
je 0x40bde5
mov eax, dword [ecx]
mov eax, dword [eax + 0x7c]
call eax
mov ecx, eax
jmp 0x40bde7
xor ecx, ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x74]
call eax
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_4869]
mov esi, eax
mov dword [ebp - 0x98], esi
test esi, esi
je 0x40be48
call fcn.004083d0
mov ecx, dword [esi + 4]
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
test eax, eax
je 0x40be2c
push 3
push 0x8014
push ecx
call esi
push 0
jmp 0x40be38
push 0
push 0x8014
push ecx
call esi
push 3
mov eax, dword [ebp - 0x98]
push 0x8015
push dword [eax + 4]
call esi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [edi + 0x1f4]
call dword [sym.imp.mfc140.dll_Ordinal_2524]
call dword [sym.imp.mfc140.dll_Ordinal_2241]
push 0x80
push 0xe
push 0x80
call dword [sym.imp.mfc140.dll_Ordinal_2210]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push ecx
push eax
sub esp, 8
lea ecx, [edi + 0x21c]
push edi
call fcn.00415970
cmp dword [edi + 0x210], 0
je 0x40bea9
push 0
push 0x8016
push 0x111
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
lea esi, [edi + 0x534]
push esi
lea ecx, [edi + 0x530]
push 0x20
call dword [sym.imp.mfc140.dll_Ordinal_5095]
mov ecx, dword [ebp - 0xe4]
push eax
push 0x20
lea ecx, [ecx + 0x52c]
call dword [sym.imp.mfc140.dll_Ordinal_5095]
push eax
push 0x20
lea ecx, [edi + 0x51c]
call dword [sym.imp.mfc140.dll_Ordinal_5095]
mov ecx, dword [ebp - 0xe4]
push eax
lea eax, [ecx + 0x520]
lea edx, [ecx + 0x524]
add ecx, 0x518
push eax
call fcn.00404e30
mov eax, dword [esi]
lea ecx, [edi + 0x51c]
add esp, 0x14
mov dword [0x425424], eax
push 0xffffffffffffffff
call dword [sym.imp.mfc140.dll_Ordinal_12503]
mov esi, dword [ebp - 0xe4]
push 0xffffffffffffffff
lea ecx, [esi + 0x52c]
call dword [sym.imp.mfc140.dll_Ordinal_12503]
push 0xffffffffffffffff
lea ecx, [esi + 0x530]
call dword [sym.imp.mfc140.dll_Ordinal_12503]
movups xmm0, xmmword [0x419bb8]
lea eax, [esi + 0x514]
mov ecx, esi
push eax
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.0040f730
mov esi, 1
jmp 0x40bf61
xor esi, esi
lea ecx, [ebp - 0x9c]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x94]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416a63
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00401050
push 0x80070057
call fcn.00401050
int3