Function at 0x4ac5a0
Capabilities:
Enumerate processes
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x790
mov eax, dword [0x53ba20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x6f0], eax
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0x6d8], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0x700], eax
mov byte [ebp - 0x6d1], al
mov eax, 1
push 0x1fe
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push ebx
push eax
mov dword [ebp - 0x6e8], edi
mov dword [ebp - 0x6fc], 0
call fcn.004c52c0
mov esi, dword [ebp + 0x10]
add esp, 0xc
test esi, esi
jne 0x4acd4b
mov edx, dword [0x551618]
test edx, edx
je 0x4acde2
cmp byte [0x555288], bl
je 0x4acde2
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x6ec], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x70c], eax
test edx, edx
jle 0x4ac744
mov eax, dword [ecx*4 + 0x551590]
cmp eax, 0x45b
je 0x4ac67f
cmp eax, 0x45c
je 0x4ac67f
cmp eax, 0x525
je 0x4ac67f
cmp eax, 0x45e
je 0x4ac67f
inc ecx
cmp ecx, edx
jl 0x4ac652
jmp 0x4ac744
push edi
push 0
push 0x410
mov dword [ebp - 0x738], edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x6f8], edi
test edi, edi
jne 0x4ac6df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4ac6d5
push edi
lea eax, [ebp - 0x728]
push eax
push 4
lea eax, [ebp - 0x6f8]
push eax
push 4
lea eax, [ebp - 0x738]
push eax
push 0x8335003c
push dword [0x53b5e4]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [ebp - 0x6f8]
test edi, edi
je 0x4ac73e
xor eax, eax
push esi
push eax
push edi
call sub.KERNEL32.dll_K32QueryWorkingSet
mov ecx, dword [ebp - 0x6ec]
test eax, eax
je 0x4ac700
test ecx, ecx
je 0x4ac70d
mov eax, dword [ecx]
shl eax, 2
cmp esi, eax
jae 0x4ac737
test ecx, ecx
je 0x4ac70d
push ecx
call fcn.004c8c7f
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x4ac72f
add esi, 0x4000
push esi
call fcn.004c8c9a
add esp, 4
mov dword [ebp - 0x6ec], eax
jmp 0x4ac6e1
xor eax, eax
mov dword [ebp - 0x6ec], eax
push edi
call dword [ebp - 0x70c]
mov edi, dword [ebp - 0x6e8]
cmp edi, dword [0x538de0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [ebp - 0x6f0]
mov dword [ebp - 0x724], esi
je 0x4ac7be
push 0
push 0
push 0xb
push edi
mov byte [ebp - 0x6d1], 1
call esi
push 0
push 0
push 0x1009
push edi
call esi
lea eax, [ebp - 0x304]
push eax
mov eax, dword [0x570310]
dec eax
push eax
push 0x40d
push dword [0x555ed8]
call esi
mov eax, dword [0x570310]
mov ecx, dword [0x550f38]
dec eax
push 0
push 0x514058
push eax
call fcn.00477e80
push dword [0x53862c]
push 0
call fcn.0046d020
add esp, 8
mov eax, dword [0x550f4c]
test eax, eax
je 0x4ac828
mov ebx, dword [ebp - 0x6d8]
nop dword [eax]
mov esi, dword [eax + 0x188]
lea ecx, [ebp - 0x6d9]
push ecx
push eax
mov dword [ebp - 0x770], eax
lea eax, [ebp - 0x790]
push eax
push edi
mov dword [ebp - 0x78c], 0xffffffff
call fcn.004a7650
add esp, 0x10
movzx ebx, bl
test al, al
mov eax, 1
cmovne ebx, eax
cmp byte [ebp - 0x6d9], 0
je 0x4ac81a
inc dword [ebp - 0x6fc]
mov eax, esi
test esi, esi
jne 0x4ac7d0
mov dword [ebp - 0x6d8], ebx
xor ebx, ebx
mov eax, dword [ebp - 0x6e8]
test eax, eax
je 0x4acc89
mov edi, dword [0x550f44]
mov dword [ebp - 0x6f4], edi
test edi, edi
je 0x4ac861
cmp dword [edi + 0x24], eax
je 0x4ac85d
mov edi, dword [edi + 0x5c0]
mov dword [ebp - 0x6f4], edi
test edi, edi
jne 0x4ac846
jmp 0x4ac861
lock inc dword [edi + 0x20]
cmp eax, 8
je 0x4ac86f
cmp eax, 4
jne 0x4acc83
push 0x3e8
mov dword [ebp - 0x6e0], 0x3e8
call fcn.004c8c9a
add esp, 4
mov dword [ebp - 0x708], eax
mov esi, eax
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x6e0]
push esi
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
je 0x4ac8e8
push esi
call fcn.004c8c7f
mov eax, dword [ebp - 0x6e0]
add eax, 0x3e8
push eax
mov dword [ebp - 0x6e0], eax
call fcn.004c8c9a
add esp, 8
mov esi, eax
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x6e0]
push esi
push 0xb
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jne 0x4ac8a7
mov dword [ebp - 0x708], esi
xor ecx, ecx
mov dword [ebp - 0x6e4], ecx
cmp dword [esi], ecx
jbe 0x4acc74
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ebx, [esi + 0x10]
mov dword [ebp - 0x734], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov dword [ebp - 0x73c], eax
mov eax, dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov dword [ebp - 0x714], eax
mov eax, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x718], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x71c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 0x720], eax
nop dword [eax]
mov eax, dword [0x550f4c]
test eax, eax
je 0x4ac976
mov edx, dword [ebx - 4]
nop dword [eax]
cmp dword [eax + 0xd0], edx
jne 0x4ac966
mov ecx, dword [eax + 0xe0]
cmp ecx, dword [ebx]
je 0x4acb68
mov eax, dword [eax + 0x188]
test eax, eax
jne 0x4ac950
mov ecx, dword [ebp - 0x6e4]
mov eax, dword [ebx - 4]
cmp eax, dword [0x555f58]
jbe 0x4acc5f
push 0x190
lea eax, [ebp - 0x6d0]
push 0
push eax
call fcn.004c52c0
add esp, 0xc
call fcn.0042dbe0
test eax, eax
je 0x4acdf5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x710]
mov dword [ebp - 0x710], eax
lea eax, [ebx + 0x10]
push eax
call fcn.0048dae0
mov esi, dword [ebp - 0x710]
push esi
call fcn.0047a490
mov dword [ebp - 0x61c], eax
add esp, 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4ac9f4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx - 4]
mov dword [ebp - 0x600], eax
mov eax, dword [ebx]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebx - 4]
mov dword [ebp - 0x5f8], eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x624]
push eax
push 0x41
lea eax, [ebp - 0x6a8]
push eax
push dword [ebp - 0x61c]
call fcn.0047a5d0
push 0x4fbd20
lea eax, [ebp - 0x5dc]
push 0x41
push eax
call fcn.004c905a
add esp, 0x20
xorps xmm0, xmm0
movlpd qword [ebp - 0x5e8], xmm0
push 0
push 0
push 3
push 0
push 3
push SysReAllocStringLen
push dword [ebp - 0x61c]
call dword [ebp - 0x734]
mov esi, eax
cmp esi, 0xffffffff
je 0x4acb3a
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x754]
push eax
push esi
call dword [ebp - 0x73c]
push esi
call dword [ebp - 0x70c]
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x730]
push eax
call dword [ebp - 0x714]
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x744]
push eax
call dword [ebp - 0x718]
push 0x40
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 1
push 0x400
call dword [ebp - 0x71c]
push 0x40
lea eax, [ebp - 0x84]
push eax
push 0
lea eax, [ebp - 0x314]
push eax
push 2
push 0x400
call dword [ebp - 0x720]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x5dc]
push 0x4fc644
push eax
call fcn.0048d590
add esp, 0x10
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x6c0], 0
cmp dword [0x538de0], eax
jne 0x4acbc3
mov dword [ebp - 0x6c4], 2
jmp 0x4acbd4
mov ecx, dword [ebp - 0x704]
inc ecx
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x700], ecx
xor cl, cl
cmp byte [eax + 0x14], cl
je 0x4acba2
mov ecx, dword [eax + 0x18]
cmp ecx, dword [0x5510ec]
jge 0x4acb9c
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 2
jmp 0x4acc59
mov cl, 1
mov byte [eax + 0x14], 0
test cl, cl
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x6e4]
je 0x4acc5f
mov byte [ebp - 0x6d8], 1
jmp 0x4acc5f
mov byte [ebp - 0x6bc], 0
mov dword [ebp - 0x6c4], 0
lea eax, [ebp - 0x5f2]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 0x61c]
call fcn.00481950
add esp, 0x10
test al, al
je 0x4acc02
or dword [ebp - 0x5fc], 4
test edi, edi
je 0x4acc20
push dword [ebp - 0x61c]
push dword [edi + 0xfc]
call fcn.00454d90
add esp, 8
mov dword [ebp - 0x614], eax
sub esp, 0x190
lea esi, [ebp - 0x6d0]
mov edi, esp
mov ecx, 0x64
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x6f0]
call fcn.0046b950
mov edi, dword [ebp - 0x6f4]
add esp, 0x194
mov esi, dword [ebp - 0x708]
mov byte [ebp - 0x6d8], 1
mov ecx, dword [ebp - 0x6e4]
inc ecx
add ebx, 0x11c
mov dword [ebp - 0x6e4], ecx
cmp ecx, dword [esi]
jb 0x4ac940
push esi
call fcn.004c8c7f
mov eax, dword [ebp - 0x6e8]
add esp, 4
mov ebx, dword [ebp - 0x6f4]
mov esi, dword [ebp - 0x6ec]
lea ecx, [ebp - 0x700]
mov edi, dword [ebp - 0x6f0]
push ecx
push 0
push esi
push eax
push ebx
push 0
push edi
call fcn.004a1e50
add esp, 0x1c
test al, al
jne 0x4accc6
cmp byte [ebp - 0x6d8], al
jne 0x4accc6
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp - 0x700], eax
je 0x4acccd
mov byte [ebp - 0x6d8], 1
cmp word [ebp - 0x304], 1
mov eax, dword [ebp - 0x6e8]
mov dword [0x538de0], eax
je 0x4accfd
mov ecx, dword [0x550f38]
lea eax, [ebp - 0x304]
push 0
push eax
mov eax, dword [0x570310]
dec eax
push eax
call fcn.00477e80
cmp byte [ebp - 0x6d8], 0
jne 0x4acd1c
cmp byte [ebp - 0x6d1], 1
jne 0x4acd1c
push 0
push 1
push 0xb
push edi
call dword [ebp - 0x724]
test esi, esi
je 0x4acd29
push esi
call fcn.004c8c7f
add esp, 4
test ebx, ebx
je 0x4acd34
mov ecx, ebx
call fcn.00467a00
mov al, byte [ebp - 0x6d8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x228
lea eax, [ebp - 0x53c]
push 0
push eax
call fcn.004c52c0
mov eax, dword [0x53a840]
add esp, 0xc
cmp eax, 0xffffffff
je 0x4acd72
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [0x53a840], eax
cmp eax, 0xffffffff
je 0x4acde2
lea ecx, [ebp - 0x540]
mov dword [ebp - 0x540], 0x22c
push ecx
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4acde2
cmp byte [esi], 1
je 0x4acde2
lea eax, [ebp - 0x728]
push eax
lea eax, [ebp - 0x51c]
push eax
push 0
push dword [ebp - 0x538]
push 0
push esi
push dword [ebp - 0x6f0]
call fcn.004a1e50
add esp, 0x1c
lea eax, [ebp - 0x540]
push eax
push dword [0x53a840]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4acda0
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c3287
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0042d2e0
int3