Function at 0x555030
Capabilities:
Create thread
Enumerate processes via ntquerysysteminformation
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x60]
push ebx
add esp, 0xffffff80
mov dword [ebp - 0x5c], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateEventW]
sub esp, 0x10
mov edi, eax
mov dword [ebp - 0x68], eax
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xb0
xor eax, eax
test edi, edi
setne al
mov dword [esp + 4], str.Cannot_create_event_n
xor ebx, ebx
mov dword [esp], eax
call fcn.00555010
mov edi, dword [sym.imp.kernel32.dll_CreateThread]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x68]
mov dword [esp + 8], 0x5547f0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call edi
sub esp, 0x18
mov dword [ebp + ebx*4 - 0x58], eax
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xb5
xor eax, eax
mov dword [esp + 4], str.Cannot_create_thread_n
mov edx, dword [ebp + ebx*4 - 0x58]
test edx, edx
setne al
mov dword [esp], eax
call fcn.00555010
mov eax, dword [ebp - 0x60]
mov dword [ebp + ebx*4 - 0x48], eax
add ebx, 1
cmp ebx, 4
jne 0x5550a1
mov dword [esp + 4], 0
lea edi, [ebp - 0x28]
mov ebx, 0xffffffff
mov dword [esp], 4
call dword [0x8c04d8]
sub esp, 8
mov esi, eax
mov dword [ebp - 0x64], eax
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xba
xor eax, eax
test esi, esi
setne al
mov dword [esp + 4], str.Cannot_create_snapshot_n
mov dword [esp], eax
call fcn.00555010
mov dword [ebp - 0x28], 0x1c
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xbe
mov dword [esp], esi
xor esi, esi
mov dword [esp + 4], edi
call dword [0x8c04c4]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], str.Thread_cannot_traverse_n
call fcn.00555010
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], eax
jmp 0x5551e2
cmp dword [ebp + 8], eax
jne 0x555210
mov eax, dword [ebp - 0x20]
cmp ebx, 0xffffffff
je 0x555200
lea edx, [ebx + 1]
mov dword [ebp + ebx*4 - 0x38], eax
cmp edx, 3
jg 0x555210
mov ebx, edx
mov dword [esp + 4], edi
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call dword [0x8c04c0]
sub esp, 8
test eax, eax
je 0x555210
mov eax, dword [ebp - 0x1c]
test esi, esi
jne 0x5551b0
cmp dword [ebp + 8], eax
jne 0x5551cb
mov eax, dword [ebp - 0x20]
mov esi, 1
mov dword [ebp - 0x70], eax
jmp 0x5551cb
mov ecx, dword [ebp - 0x6c]
cmp eax, ecx
jne 0x5551cb
mov dword [ebp - 0x38], ecx
mov ebx, esi
jmp 0x5551cb
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xd8
mov dword [esp + 4], str.Couldnt_find_self_and_or_sub_process_in_process_list_n
mov dword [esp], esi
call fcn.00555010
xor eax, eax
mov ecx, dword [ebp + eax*4 - 0x48]
cmp dword [ebp + eax*4 - 0x38], ecx
jne 0x5554c0
mov dword [ebp + eax*4 - 0x38], 0
add eax, 1
cmp eax, 4
jne 0x555234
mov ebx, 1
call fcn.0057d110
xor edi, edi
lea esi, [ebp - 0x5c]
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xe6
mov dword [esp], ebx
mov dword [esp + 4], str.The_thread_order_is_not_strictly_consistent_n
call fcn.00555010
mov ebx, dword [ebp - 0x5c]
jmp 0x55529f
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_free]
mov ebx, dword [ebp - 0x5c]
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], 5
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
sub esp, 0x10
cmp eax, 0xc0000004
je 0x555288
mov dword [ebp - 0x74], eax
call fcn.0057d110
mov ecx, dword [ebp - 0x74]
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xf0
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x5fc2d5
call fcn.00555010
mov ecx, dword [ebp + 8]
xor eax, eax
jmp 0x55530c
mov edx, dword [ebx]
add eax, edx
test edx, edx
je 0x5554a8
lea ebx, [edi + eax]
cmp dword [ebx + 0x44], ecx
jne 0x555300
mov esi, 1
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0xff
mov dword [esp + 4], str.No_process_found_n
mov dword [esp], esi
call fcn.00555010
mov edx, dword [ebx + 4]
test edx, edx
je 0x5554e4
mov dword [ebp - 0x74], edi
mov ecx, 0xffffffff
mov edi, dword [ebp - 0x6c]
xor eax, eax
jmp 0x555367
cmp esi, edi
je 0x555480
add eax, 1
cmp edx, eax
je 0x555390
mov esi, eax
shl esi, 6
mov esi, dword [ebx + esi + 0xdc]
test ecx, ecx
jle 0x555358
mov dword [ebp + ecx*4 - 0x38], esi
cmp ecx, 3
je 0x5554b0
add eax, 1
mov ecx, 3
cmp edx, eax
jne 0x555367
mov edi, dword [ebp - 0x74]
mov dword [ebp - 0x60], esi
xor ebx, ebx
test ecx, ecx
setg bl
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_free]
call fcn.0057d110
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0x110
mov dword [esp + 4], str.No_thread_id_match_found_n
mov dword [esp], ebx
call fcn.00555010
xor eax, eax
mov edx, dword [ebp + eax*4 - 0x48]
cmp dword [ebp + eax*4 - 0x38], edx
jne 0x5554d0
add eax, 1
cmp eax, 4
jne 0x5553ca
mov ebx, 1
call fcn.0057d110
lea esi, [ebp - 0x58]
mov dword [eax], 0x5fc207
mov dword [eax + 4], 0x11b
mov dword [esp], ebx
mov dword [esp + 4], str.wrong_order_in_NtQuerySystemInformation_function_n
call fcn.00555010
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetEvent]
lea eax, [ebp - 0x58]
sub esp, 4
mov dword [esp + 0xc], 0xea60
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 4
call dword [sym.imp.kernel32.dll_WaitForMultipleObjects]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 0x10
mov eax, dword [esi]
add esi, 4
mov dword [esp], eax
call ebx
lea eax, [ebp - 0x48]
sub esp, 4
cmp esi, eax
jne 0x555446
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x64]
sub esp, 4
mov dword [esp], eax
call ebx
mov eax, dword [ebp - 0x70]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
add eax, 1
mov dword [ebp - 0x38], edi
cmp edx, eax
je 0x5554d7
mov ecx, eax
shl ecx, 6
mov esi, dword [ebx + ecx + 0xdc]
mov ecx, 2
mov dword [ebp - 0x34], esi
jmp 0x555360
xor esi, esi
jmp 0x555319
mov dword [ebp - 0x60], esi
mov edi, dword [ebp - 0x74]
mov ebx, 1
jmp 0x55539d
xor ebx, ebx
jmp 0x555257
xor ebx, ebx
jmp 0x5553e5
mov edi, dword [ebp - 0x74]
mov ecx, 1
jmp 0x555393
xor ebx, ebx
jmp 0x55539d