Function at 0x4ac700
Capabilities:
Enumerate processes
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x790
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x6e8], eax
xor eax, eax
push esi
push edi
mov dword [ebp - 0x6fc], eax
xor edi, edi
mov dword [ebp - 0x6f4], eax
mov byte [ebp - 0x6d1], al
mov eax, 1
push 0x1fe
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push edi
push eax
mov dword [ebp - 0x6ec], ebx
mov byte [ebp - 0x6dc], 0
mov dword [ebp - 0x70c], 0
call fcn.004c53a0
mov esi, dword [ebp + 0x10]
add esp, 0xc
test esi, esi
jne 0x4acec7
mov edx, dword [0x54b5e8]
test edx, edx
je 0x4acf5d
cmp byte [0x54f258], 0
je 0x4acf5d
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x6f0], ebx
mov dword [ebp - 0x704], eax
test edx, edx
jle 0x4ac8ba
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ecx*4 + 0x54b560]
cmp eax, 0x45b
je 0x4ac7ed
cmp eax, 0x45c
je 0x4ac7ed
cmp eax, 0x525
je 0x4ac7ed
cmp eax, 0x45e
je 0x4ac7ed
inc ecx
cmp ecx, edx
jl 0x4ac7c0
jmp 0x4ac8ba
mov eax, dword [ebp - 0x6e8]
push eax
push 0
push 0x410
mov dword [ebp - 0x738], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x6f8], eax
test eax, eax
jne 0x4ac848
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ac848
push 0
lea eax, [ebp - 0x72c]
push eax
push 4
lea eax, [ebp - 0x6f8]
push eax
push 4
lea eax, [ebp - 0x738]
push eax
push 0x8335003c
push dword [0x5355f4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x6d8], eax
test eax, eax
je 0x4ac8ba
push esi
push ebx
push eax
call sub.KERNEL32.dll_K32QueryWorkingSet
test eax, eax
je 0x4ac871
test ebx, ebx
je 0x4ac87e
mov eax, dword [ebx]
shl eax, 2
cmp esi, eax
jae 0x4ac8ae
test ebx, ebx
je 0x4ac87e
push ebx
call fcn.004c8d5f
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x4ac8a8
add esi, 0x4000
push esi
call fcn.004c8d7a
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x6f0], ebx
jmp 0x4ac858
mov dword [ebp - 0x6f0], edi
push dword [ebp - 0x6d8]
call dword [ebp - 0x704]
mov ebx, dword [ebp - 0x6e8]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x708], eax
cmp ebx, dword [0x532df0]
je 0x4ac93f
mov esi, dword [ebp - 0x6ec]
push 0
push 0
push 0xb
push esi
mov byte [ebp - 0x6d1], 1
call eax
push 0
push 0
push 0x1009
push esi
mov esi, dword [ebp - 0x708]
call esi
lea eax, [ebp - 0x304]
push eax
mov eax, dword [0x56a2e0]
dec eax
push eax
push 0x40d
push dword [0x54feb0]
call esi
mov eax, dword [0x56a2e0]
mov ecx, dword [0x54af08]
dec eax
push 0
push str.Refreshing_DLLs...
push eax
call fcn.00477f70
push dword [0x53263c]
push 0
call fcn.0046c9d0
add esp, 8
mov eax, dword [0x54af1c]
test eax, eax
je 0x4ac9b5
mov ebx, dword [ebp - 0x6ec]
xor edi, edi
mov esi, dword [eax + 0x188]
lea ecx, [ebp - 0x6dd]
push ecx
push eax
mov dword [ebp - 0x770], eax
lea eax, [ebp - 0x790]
push eax
push ebx
mov dword [ebp - 0x78c], 0xffffffff
call fcn.004a7780
mov ecx, dword [ebp - 0x6dc]
add esp, 0x10
test al, al
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
cmp byte [ebp - 0x6dd], 0
mov dword [ebp - 0x6dc], ecx
je 0x4ac9a1
inc edi
mov eax, esi
test esi, esi
jne 0x4ac950
mov ebx, dword [ebp - 0x6e8]
mov dword [ebp - 0x70c], edi
xor edi, edi
test ebx, ebx
je 0x4ace00
mov edi, dword [0x54af14]
mov dword [ebp - 0x714], edi
test edi, edi
je 0x4ac9eb
nop dword [eax]
cmp dword [edi + 0x24], ebx
je 0x4ac9e7
mov edi, dword [edi + 0x5c0]
mov dword [ebp - 0x714], edi
test edi, edi
jne 0x4ac9d0
jmp 0x4ac9eb
lock inc dword [edi + 0x20]
cmp ebx, 8
je 0x4ac9f9
cmp ebx, 4
jne 0x4ace00
push 0x3e8
mov dword [ebp - 0x6e4], 0x3e8
call fcn.004c8d7a
add esp, 4
mov dword [ebp - 0x710], eax
mov esi, eax
lea eax, [ebp - 0x6e4]
push eax
push dword [ebp - 0x6e4]
push esi
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x4aca72
push esi
call fcn.004c8d5f
mov eax, dword [ebp - 0x6e4]
add eax, 0x3e8
push eax
mov dword [ebp - 0x6e4], eax
call fcn.004c8d7a
add esp, 8
mov esi, eax
lea eax, [ebp - 0x6e4]
push eax
push dword [ebp - 0x6e4]
push esi
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4aca31
mov dword [ebp - 0x710], esi
xor ecx, ecx
mov dword [ebp - 0x6d8], ecx
cmp dword [esi], ecx
jbe 0x4acdf7
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ebx, [esi + 0x10]
mov dword [ebp - 0x73c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 0x718], eax
mov eax, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x71c], eax
mov eax, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x720], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x724], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 0x728], eax
mov eax, dword [0x54af1c]
test eax, eax
je 0x4acaf9
mov edx, dword [ebx - 4]
cmp dword [eax + 0xd0], edx
jne 0x4acae9
mov ecx, dword [eax + 0xe0]
cmp ecx, dword [ebx]
je 0x4acceb
mov eax, dword [eax + 0x188]
test eax, eax
jne 0x4acad3
mov ecx, dword [ebp - 0x6d8]
mov eax, dword [ebx - 4]
cmp eax, dword [0x54ff2c]
jbe 0x4acde2
push 0x190
lea eax, [ebp - 0x6d0]
push 0
push eax
call fcn.004c53a0
add esp, 0xc
call fcn.0042db70
test eax, eax
je 0x4acf70
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x700], eax
lea eax, [ebx + 0x10]
push eax
call fcn.0048dd30
mov esi, dword [ebp - 0x700]
push esi
call fcn.0047a730
mov dword [ebp - 0x61c], eax
add esp, 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4acb77
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx - 4]
mov dword [ebp - 0x600], eax
mov eax, dword [ebx]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebx - 4]
mov dword [ebp - 0x5f8], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x624]
push eax
push 0x41
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp - 0x61c]
call fcn.0047a870
push 0x4f9d20
lea eax, [ebp - 0x5dc]
push 0x41
push eax
call fcn.004c913a
add esp, 0x20
xorps xmm0, xmm0
movlpd qword [ebp - 0x5e8], xmm0
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp - 0x61c]
call dword [ebp - 0x73c]
mov esi, eax
cmp esi, 0xffffffff
je 0x4accbd
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x754]
push eax
push esi
call dword [ebp - 0x718]
push esi
call dword [ebp - 0x704]
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x734]
push eax
call dword [ebp - 0x71c]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x744]
push eax
call dword [ebp - 0x720]
push 0x40
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 1
push 0x400
call dword [ebp - 0x724]
push 0x40
lea eax, [ebp - 0x84]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 2
push 0x400
call dword [ebp - 0x728]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x5dc]
push str._s__s
push eax
call fcn.0048d7e0
add esp, 0x10
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x6c0], 0
cmp dword [0x532df0], eax
jne 0x4acd46
mov dword [ebp - 0x6c4], 2
jmp 0x4acd57
mov ecx, dword [ebp - 0x6fc]
inc ecx
mov dword [ebp - 0x6fc], ecx
mov dword [ebp - 0x6f4], ecx
xor cl, cl
cmp byte [eax + 0x14], cl
je 0x4acd25
mov ecx, dword [eax + 0x18]
cmp ecx, dword [0x54b0bc]
jge 0x4acd1f
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 2
jmp 0x4acddc
mov cl, 1
mov byte [eax + 0x14], 0
test cl, cl
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x6d8]
je 0x4acde2
mov byte [ebp - 0x6dc], 1
jmp 0x4acde2
mov byte [ebp - 0x6bc], 0
mov dword [ebp - 0x6c4], 0
lea eax, [ebp - 0x5f2]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 0x61c]
call fcn.00481b50
add esp, 0x10
test al, al
je 0x4acd85
or dword [ebp - 0x5fc], 4
test edi, edi
je 0x4acda3
push dword [ebp - 0x61c]
push dword [edi + 0xfc]
call fcn.00454690
add esp, 8
mov dword [ebp - 0x614], eax
sub esp, 0x190
lea esi, [ebp - 0x6d0]
mov edi, esp
mov ecx, 0x64
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x6ec]
call fcn.0046b370
mov edi, dword [ebp - 0x714]
add esp, 0x194
mov esi, dword [ebp - 0x710]
mov byte [ebp - 0x6dc], 1
mov ecx, dword [ebp - 0x6d8]
inc ecx
add ebx, 0x11c
mov dword [ebp - 0x6d8], ecx
cmp ecx, dword [esi]
jb 0x4acac7
push esi
call fcn.004c8d5f
add esp, 4
mov ebx, dword [ebp - 0x6f0]
lea eax, [ebp - 0x6f4]
mov esi, dword [ebp - 0x6e8]
push eax
push 0
push ebx
push esi
push edi
push 0
push dword [ebp - 0x6ec]
call fcn.004a1f20
add esp, 0x1c
test al, al
jne 0x4ace42
cmp byte [ebp - 0x6dc], al
jne 0x4ace42
mov eax, dword [ebp - 0x70c]
cmp dword [ebp - 0x6f4], eax
je 0x4ace49
mov byte [ebp - 0x6dc], 1
cmp word [ebp - 0x304], 1
mov dword [0x532df0], esi
je 0x4ace74
mov ecx, dword [0x54af08]
lea eax, [ebp - 0x304]
push 0
push eax
mov eax, dword [0x56a2e0]
dec eax
push eax
call fcn.00477f70
cmp byte [ebp - 0x6dc], 0
jne 0x4ace98
cmp byte [ebp - 0x6d1], 1
jne 0x4ace98
push 0
push 1
push 0xb
push dword [ebp - 0x6ec]
call dword [ebp - 0x708]
test ebx, ebx
je 0x4acea5
push ebx
call fcn.004c8d5f
add esp, 4
test edi, edi
je 0x4aceb0
mov ecx, edi
call fcn.00467470
mov al, byte [ebp - 0x6dc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0x228
lea eax, [ebp - 0x53c]
push 0
push eax
call fcn.004c53a0
mov eax, dword [0x534244]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4aceee
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [0x534244], eax
cmp eax, 0xffffffff
je 0x4acf5d
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x540], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4acf5d
nop dword [eax]
cmp byte [esi], 1
je 0x4acf5d
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0
push dword [ebp - 0x538]
push 0
push esi
push ebx
call fcn.004a1f20
add esp, 0x1c
lea eax, [ebp - 0x540]
push eax
push dword [0x534244]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4acf20
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0042d270
int3