Function at 0x421850
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x42187b
mov ecx, dword [ebp + 0x10]
mov edx, 0x5385a4
test ecx, ecx
mov dword [esp + 0x10], ecx
jne 0x42188d
jmp 0x421a61
mov edx, 0x53858c
mov eax, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x55bd94]
mov dword [esp + 4], edx
movzx eax, byte [eax]
push 1
push 0x80000
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x421db4
mov dword [esp + 0x20], 0x80000
mov dword [esp + 0x24], eax
mov edi, eax
xor eax, eax
mov ecx, 0x80000
lea esi, [esp + 0x14]
mov ebx, 0x80000
mov dword [esp + 0x28], 0
jmp 0x4218e8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
sub ecx, eax
mov dword [esp + 0x14], 0
cmp ebx, ecx
ja 0x42194f
push esi
push ebx
push edi
push 5
call sub.ntdll.dll_NtQuerySystemInformation
test eax, eax
jns 0x421964
or eax, 0x10000000
push eax
call fcn.004480f0
add esp, 4
cmp eax, 0xd0000004
jne 0x421a34
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov dword [esp + 0x50], 0xd0000004
mov dword [esp + 0x54], edx
add ecx, ebx
lea ebx, [eax + 0x2800]
test eax, eax
cmove ebx, ecx
test edx, edx
je 0x4218e0
lea eax, [esp + 0x54]
push eax
call fcn.00447ed0
add esp, 4
jmp 0x4218e0
push ebx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00423e90
add esp, 0xc
mov edi, dword [esp + 0x24]
jmp 0x4218f6
mov eax, dword [0x55bd94]
mov dword [esp + 8], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], 0
movzx eax, byte [eax]
push 4
push 0x7d0
call fcn.0040d1d0
add esp, 8
test eax, eax
je 0x421dc0
mov dword [esp + 0x2c], 0x1f4
mov dword [esp + 0x30], eax
mov eax, dword [esp + 4]
mov esi, dword [esp + 0xc]
xor edi, edi
mov dword [esp + 0x34], 0
mov eax, dword [eax + 0x14]
mov dword [esp + 4], eax
jmp 0x4219dc
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x30]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0xc]
add edi, ebx
test ebx, ebx
je 0x421a12
mov eax, dword [esp + 8]
mov ebx, dword [eax + edi]
push dword [esp + 0x10]
push esi
push dword [eax + edi + 0x44]
push 1
call dword [esp + 0x14]
add esp, 0x10
test al, al
je 0x4219d6
mov esi, dword [esp + 0x34]
cmp esi, dword [esp + 0x2c]
jne 0x4219c0
lea eax, [esp + 0x2c]
push eax
call fcn.00424370
add esp, 4
jmp 0x4219c0
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
cmp byte [eax], 0
lea edi, [ebx + 0x20]
mov dword [esp + 0x3c], edi
je 0x421a68
mov ecx, ebx
xor edx, edx
xor esi, esi
call fcn.00416f70
mov eax, dword [ebx + 8]
jmp 0x421a6c
test edx, edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], edx
je 0x421a4d
lea eax, [esp + 0x54]
push eax
call fcn.00447ed0
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x421a61
push 1
push eax
push edi
call fcn.0040d1e0
add esp, 0xc
xor eax, eax
jmp 0x421dac
xor eax, eax
xor esi, esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
call fcn.004976e0
lea ebx, [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
push 0x19db1de
push 0xd53e8000
lea eax, [esp + 0x1c]
push eax
push ebx
call fcn.00497710
add esp, 0x10
mov eax, dword [esp + 0x50]
or eax, dword [esp + 0x54]
je 0x421aad
xor eax, eax
xor ecx, ecx
jmp 0x421ab5
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x34]
movsd xmm0, qword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 8
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x58], eax
lea eax, [esp + 0x38]
movsd qword [esp + 0x50], xmm0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x6c], eax
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.00418310
add esp, 8
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
imul ecx, edx, 0xe8
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
add ecx, esi
test edx, edx
mov dword [esp + 8], ecx
je 0x421d3d
mov esi, dword [esp + 4]
mov dword [esp + 0x10], edi
jmp 0x421b5a
cmp esi, dword [esp + 8]
je 0x421d70
mov eax, esi
add esi, 0xe8
mov ecx, dword [eax]
cmp ecx, 2
je 0x421d3d
add eax, 4
mov dword [esp + 0x138], ecx
push 0xe4
push eax
lea eax, [esp + 0x144]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x138]
push eax
push dword [esp + 0x210]
push edi
push ebx
call fcn.00425df0
add esp, 0x10
cmp dword [esp + 0x50], 2
je 0x421b50
mov eax, dword [esp + 0x60]
test eax, eax
je 0x421bc4
push 1
push eax
push dword [esp + 0x6c]
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0x108]
test edi, edi
je 0x421c00
mov ebx, dword [esp + 0x104]
add ebx, 4
jmp 0x421be6
add ebx, 0x10
dec edi
je 0x421c00
mov eax, dword [ebx - 4]
test eax, eax
je 0x421be0
push 1
push eax
push dword [ebx]
call fcn.0040d1e0
add esp, 0xc
jmp 0x421be0
mov eax, dword [esp + 0x100]
test eax, eax
je 0x421c20
shl eax, 4
push 4
push eax
push dword [esp + 0x10c]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x421c3e
test eax, eax
je 0x421c3e
push 1
push eax
push dword [esp + 0x7c]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x118]
cmp eax, 0x80000000
je 0x421c62
test eax, eax
je 0x421c62
push 1
push eax
push dword [esp + 0x124]
call fcn.0040d1e0
add esp, 0xc
mov edi, dword [esp + 0x114]
test edi, edi
je 0x421ca0
mov ebx, dword [esp + 0x110]
add ebx, 4
jmp 0x421c86
add ebx, 0x10
dec edi
je 0x421ca0
mov eax, dword [ebx - 4]
test eax, eax
je 0x421c80
push 1
push eax
push dword [ebx]
call fcn.0040d1e0
add esp, 0xc
jmp 0x421c80
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x421cc0
shl eax, 4
push 4
push eax
push dword [esp + 0x118]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x10]
lea ebx, [esp + 0x50]
cmp eax, 0x80000000
je 0x421cec
test eax, eax
je 0x421cec
push 1
push eax
push dword [esp + 0x8c]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x90]
cmp eax, 0x80000000
je 0x421d10
test eax, eax
je 0x421d10
push 1
push eax
push dword [esp + 0x9c]
call fcn.0040d1e0
add esp, 0xc
mov eax, dword [esp + 0x128]
test eax, eax
je 0x421b50
lock dec dword [eax]
jne 0x421b50
lea eax, [esp + 0x128]
push eax
call fcn.00427b00
add esp, 4
jmp 0x421b50
mov ebx, dword [esp + 8]
mov ecx, 0x8d3dcb09
mov eax, ebx
sub eax, esi
mul ecx
cmp ebx, esi
je 0x421d70
mov edi, edx
shr edi, 7
nop word cs:[eax + eax]
nop
mov ecx, esi
call fcn.00410d50
add esi, 0xe8
dec edi
jne 0x421d60
mov eax, dword [esp + 0xc]
test eax, eax
je 0x421d8d
imul eax, eax, 0xe8
push 8
push eax
push dword [esp + 0xc]
call fcn.0040d1e0
add esp, 0xc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
test ecx, ecx
je 0x421dac
push 1
push ecx
push dword [esp + 0x2c]
mov esi, eax
call fcn.0040d1e0
mov eax, esi
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x80000
push 1
call fcn.004d09f0
push 0x7d0
push 4
call fcn.004d09f0
nop dword [eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 8]
cmp dword [edi + 0x2c], 0
je 0x421e8e
mov esi, dword [ebp + 0xc]
lea eax, [edi + 0x30]
lea ecx, [ebp + 0xc]
push ecx
push eax
call fcn.004251d0
add esp, 8
mov edx, dword [edi + 0x24]
mov ecx, dword [edi + 0x20]
xor ebx, ebx
pcmpeqd xmm1, xmm1
mov edi, edx
mov dword [ebp - 0x10], ecx
and edi, eax
shr eax, 0x19
movd xmm0, eax
lea eax, [ecx - 0xf0]
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
movdqu xmm2, xmmword [ecx + edi]
mov dword [ebp - 0x14], ebx
movdqa xmm3, xmm2
pcmpeqb xmm3, xmm0
pmovmskb ebx, xmm3
test ebx, ebx
je 0x421e5f
nop
tzcnt ecx, ebx
add ecx, edi
and ecx, edx
neg ecx
imul ecx, ecx, 0xf0
cmp dword [eax + ecx], esi
je 0x421e7c
lea ecx, [ebx - 1]
and cx, bx
mov ebx, ecx
jne 0x421e40
mov ebx, dword [ebp - 0x14]
pcmpeqb xmm2, xmm1
pmovmskb ecx, xmm2
test ecx, ecx
jne 0x421ea0
mov ecx, dword [ebp - 0x10]
lea edi, [edi + ebx + 0x10]
add ebx, 0x10
and edi, edx
jmp 0x421e27
mov eax, dword [ebp - 0x10]
add eax, ecx
lea edx, [eax - 0xf0]
test eax, eax
cmove edx, eax
jmp 0x421e90
xor edx, edx
lea eax, [edx + 8]
test edx, edx
cmove eax, edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x421e81