Function at 0x1400afa03
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x358
mov ebx, edx
mov rsi, rcx
mov word [rsp + 0x28], bx
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x2a], al
mov r15d, 0x80000
mov ecx, 0x80000
xor edx, edx
call fcn.14002dfdd
lea r12, [rsp + 0x48]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
lea r13, [rsp + 0xb0]
lea rdi, [0x1401398c0]
lea r14, [0x140139280]
lea rbp, [0x1401387f0]
and dword [rsp + 0xb0], 0
mov rcx, r12
mov rdx, r15
call fcn.14002a6c5
mov rdx, qword [rsp + 0x48]
mov ecx, 5
mov r8d, r15d
mov r9, r13
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400afac4
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x1400afab6
add eax, 0x2800
jb 0x1400afd38
mov r15d, eax
jmp 0x1400afa6c
test r15, r15
js 0x1400afd49
add r15, r15
jmp 0x1400afa6c
test eax, eax
jne 0x1400afcff
mov qword [rsp + 0x58], r15
mov ecx, 0x1f4
xor edx, edx
call fcn.1400a7ab7
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
and qword [rdi + 0x10], 0
xor eax, eax
xor r14d, r14d
mov r15, qword [rsp + 0x48]
add r15, r14
cmp rax, rdx
jne 0x1400afb0d
mov rcx, rdi
call fcn.1400a8404
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + rax*8], r15
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov ecx, dword [r15]
test rcx, rcx
je 0x1400afb3b
add r14, rcx
jo 0x1400afd1e
mov rdx, qword [rsp + 0x38]
jmp 0x1400afaf3
lea rdi, [rsi + 0x40]
mov qword [rsp + 0x60], rdi
test bl, bl
je 0x1400afb5f
lea rcx, [rsi + 0x110]
xor edx, edx
call fcn.1400aca4a
mov rax, qword [rsi + 0x190]
jmp 0x1400afb61
xor eax, eax
mov qword [rsp + 0x68], rax
call fcn.140094e10
shl rdx, 0x20
mov ecx, eax
or rcx, rdx
movabs r8, 0x19db1ded53e7fff
mov rax, rcx
sub rax, r8
mov edx, 1
sub rdx, rax
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovle rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovle rax, r9
lea rcx, [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x60]
mov qword [rdx + 0x18], rax
lea rax, [rsp + 0x28]
mov qword [rdx + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rcx
lea rcx, [rsp + 0x90]
call fcn.1400a85de
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
imul rbp, qword [rsp + 0xa0], 0x150
lea rcx, [rdx + rbp]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rcx
lea r14, [rsp + 0x208]
lea r15, [rsp + 0xb0]
test rbp, rbp
je 0x1400afced
lea rsi, [rdx + 0x150]
mov qword [rsp + 0x80], rsi
mov rbx, qword [rdx]
cmp rbx, 2
je 0x1400afced
lea r12, [rdx + 0xc8]
mov r13, qword [rdx + 0xc0]
add rdx, 8
mov r8d, 0xb8
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
lea rcx, [rsp + 0x178]
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x170], r13
mov rcx, r14
mov rdx, rdi
mov r8, r13
mov r9, r15
call fcn.1400aa548
cmp dword [rsp + 0x208], 2
je 0x1400afcde
mov rcx, r14
call fcn.1400a666c
add rbp, 0xfffffffffffffeb0
mov rdx, rsi
jmp 0x1400afc4f
lea rcx, [rsp + 0x70]
call fcn.1400a9d5f
mov rcx, rdi
call fcn.1400aa727
lea rcx, [rsp + 0x48]
call fcn.14002e741
nop
add rsp, 0x358
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x1401387f0]
lea r8, [0x140139890]
mov edx, 0x1c
call fcn.14000e3b0
jmp 0x1400afd59
mov edx, 0x1c
mov r14, rbp
lea rdi, [0x1401398a8]
jmp 0x1400afd4e
mov edx, 0x21
mov rcx, r14
mov r8, rdi
call fcn.14000e3b0
ud2