Function at 0x1916e
Capabilities:
Find process by pid
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push esi
push edi
mov dword [ebp - 0x18], 0x200
mov esi, 0x67426649
push esi
push dword [ebp - 0x18]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x2c], edi
push edi
push 0x10
call dword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [ebp - 0x10], eax
test eax, eax
jge 0x191c8
push esi
push edi
call ebx
mov eax, dword [ebp - 0x18]
add eax, eax
cmp dword [ebp - 0x10], 0xc0000004
mov dword [ebp - 0x18], eax
je 0x1918b
mov ecx, dword [edi]
lea eax, [edi + 4]
test ecx, ecx
jbe 0x19361
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
jmp 0x191e6
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax]
movzx eax, word [eax + 6]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x34], ecx
xor ecx, ecx
push 0x40
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x4c], 0x18
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x19351
push 2
push 0
push 0x1f0fff
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x24]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwDuplicateObject]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x1934c
mov eax, 0x400
push esi
push eax
push 1
mov dword [ebp - 0x14], eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push 0
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov dword [ebp - 0x10], eax
test eax, eax
jge 0x192da
cmp eax, 0xc0000004
je 0x192a2
push esi
push dword [ebp - 4]
jmp 0x19345
cmp dword [ebp - 4], 0
je 0x192ae
push esi
push dword [ebp - 4]
call ebx
push esi
push dword [ebp - 0x14]
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push eax
push 1
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x19299
mov eax, dword [ebp - 4]
test eax, eax
je 0x19343
cmp dword [eax + 4], 0
je 0x19343
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_RtlCompareUnicodeString]
test eax, eax
jne 0x19338
and dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
push eax
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [ebp - 0x10], eax
test eax, eax
jl 0x19299
push dword [ebp - 0x24]
push dword [ebp - 0x1c]
call fcn.000190d6
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
test eax, eax
jge 0x19332
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x19299
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [ebp - 4], 0
je 0x19347
jmp 0x19299
push esi
push eax
call ebx
push dword [ebp - 8]
call edi
push dword [ebp - 0xc]
call edi
add dword [ebp - 0x20], 0x10
dec dword [ebp - 0x28]
jne 0x191e3
mov edi, dword [ebp - 0x2c]
push esi
push edi
call ebx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4