Function at 0x14000d470
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x368
test rdx, rdx
je 0x14000d4ba
mov rdi, r8
test r8, r8
je 0x14000d6e4
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r9
lea rax, [0x140050dd8]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], rdx
mov r15, rdx
jmp 0x14000d4e3
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], rdx
lea rax, [0x140050da8]
mov qword [rsp + 0x70], rax
mov r15d, 8
xor edi, edi
movzx eax, byte [0x140064141]
mov r14d, 0x80000
mov ecx, 0x80000
mov edx, 1
call fcn.140009c00
test rax, rax
je 0x14000daaf
mov r12, rax
mov qword [rsp + 0x40], 0x80000
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0
xor edx, edx
lea rbp, [rsp + 0x20]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea rsi, [rsp + 0xb0]
mov ebx, 0x80000
jmp 0x14000d54a
mov r14, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov dword [rsp + 0x20], 0
sub r14, rdx
cmp rbx, r14
ja 0x14000d5bf
mov ecx, 5
mov rdx, r12
mov r8d, ebx
mov r9, rbp
call r13
test eax, eax
jns 0x14000d5d3
or eax, 0x10000000
mov ecx, eax
call fcn.1400123e0
cmp edx, 0xd0000004
jne 0x14000d6ab
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0xd0000004
mov ecx, dword [rsp + 0x20]
mov rdx, rbx
add rdx, rbx
lea ebx, [rcx + 0x2800]
test ecx, ecx
cmove rbx, rdx
test rax, rax
je 0x14000d540
mov rcx, rsi
call fcn.140012410
jmp 0x14000d540
lea rcx, [rsp + 0x40]
mov r8, rbx
call fcn.1400474d0
mov r12, qword [rsp + 0x48]
jmp 0x14000d55a
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x90], 0
movzx eax, byte [0x140064141]
mov ecx, 0xfa0
mov edx, 8
call fcn.140009c00
test rax, rax
je 0x14000dabe
mov qword [rsp + 0x58], 0x1f4
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rax + 0x28]
xor r13d, r13d
lea rsi, [rsp + 0x58]
jmp 0x14000d64d
lea rax, [r12 + r13]
mov rcx, qword [rsp + 0x60]
mov qword [rcx + rbp*8], rax
inc rbp
mov qword [rsp + 0x68], rbp
add r13, r14
test r14d, r14d
je 0x14000d67d
mov r14d, dword [r12 + r13]
mov rdx, qword [r12 + r13 + 0x50]
mov ecx, 1
mov r8, r15
mov r9, rdi
call rbx
test al, al
je 0x14000d645
mov rbp, qword [rsp + 0x68]
cmp rbp, qword [rsp + 0x58]
jne 0x14000d630
mov rcx, rsi
call fcn.14000c3e0
jmp 0x14000d630
mov rbx, qword [rsp + 0x78]
lea rdi, [rbx + 0x40]
mov qword [rsp + 0x98], rdi
mov rsi, qword [rsp + 0x80]
cmp byte [rsi], 0
je 0x14000d6eb
mov rcx, rbx
xor edx, edx
call fcn.14000ac30
mov rax, qword [rbx + 0x10]
jmp 0x14000d6ed
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], edx
test rax, rax
je 0x14000d6cc
lea rcx, [rsp + 0xb0]
call fcn.140012410
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000d6e4
mov r8d, 1
mov rcx, r12
call fcn.140009c10
xor eax, eax
jmp 0x14000da9b
xor eax, eax
mov qword [rsp + 0xa0], rax
call fcn.140028260
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], edx
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x20]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140028290
cmp qword [rsp + 0xb0], 0
je 0x14000d72f
xor eax, eax
jmp 0x14000d737
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0xb0], xmm0
lea rax, [rsp + 0x90]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rsi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 8
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0xb0]
call fcn.14000dd40
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
imul r8, rcx, 0x158
add r8, rdx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r8
test rcx, rcx
je 0x14000da56
lea rbx, [rsp + 0x218]
lea r14, [rsp + 0x1a8]
lea r15, [rsp + 0xb0]
lea r12, [rsp + 0x210]
movabs rsi, 0x8000000000000000
jmp 0x14000d840
mov rdx, qword [rsp + 0x28]
cmp rdx, qword [rsp + 0x38]
je 0x14000da56
lea rax, [rdx + 0x158]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx]
cmp rax, 2
je 0x14000da56
add rdx, 8
mov qword [rsp + 0x210], rax
mov r8d, 0x150
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rsp + 0x2f0]
mov rcx, r15
mov rdx, rdi
mov r9, r12
call fcn.140010cd0
cmp dword [rsp + 0xb0], 2
je 0x14000d830
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x14000d8b3
mov rcx, qword [rsp + 0xc8]
mov r8d, 1
call fcn.140009c10
mov r13, qword [rsp + 0xf0]
test r13, r13
je 0x14000d900
mov rbp, qword [rsp + 0xe8]
add rbp, 8
jmp 0x14000d8d9
add rbp, 0x20
dec r13
je 0x14000d900
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14000d8d0
mov rcx, qword [rbp]
mov r8d, 1
call fcn.140009c10
jmp 0x14000d8d0
mov rdx, qword [rsp + 0xe0]
test rdx, rdx
je 0x14000d924
mov rcx, qword [rsp + 0xe8]
shl rdx, 5
mov r8d, 8
call fcn.140009c10
mov rdx, qword [rsp + 0x110]
cmp rdx, rsi
je 0x14000d949
test rdx, rdx
je 0x14000d949
mov rcx, qword [rsp + 0x118]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [rsp + 0x130]
cmp rdx, rsi
je 0x14000d96e
test rdx, rdx
je 0x14000d96e
mov rcx, qword [rsp + 0x138]
mov r8d, 1
call fcn.140009c10
mov r13, qword [rsp + 0x108]
test r13, r13
je 0x14000d9c0
mov rbp, qword [rsp + 0x100]
add rbp, 8
jmp 0x14000d999
add rbp, 0x20
dec r13
je 0x14000d9c0
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14000d990
mov rcx, qword [rbp]
mov r8d, 1
call fcn.140009c10
jmp 0x14000d990
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
je 0x14000d9e4
mov rcx, qword [rsp + 0x100]
shl rdx, 5
mov r8d, 8
call fcn.140009c10
mov rdx, qword [rsp + 0x148]
cmp rdx, rsi
je 0x14000da09
test rdx, rdx
je 0x14000da09
mov rcx, qword [rsp + 0x150]
mov r8d, 1
call fcn.140009c10
mov rdx, qword [rsp + 0x168]
cmp rdx, rsi
je 0x14000da2e
test rdx, rdx
je 0x14000da2e
mov rcx, qword [rsp + 0x170]
mov r8d, 1
call fcn.140009c10
mov rax, qword [rsp + 0x1a8]
test rax, rax
je 0x14000d830
lock dec qword [rax]
jne 0x14000d830
mov rcx, r14
call fcn.14000b960
jmp 0x14000d830
lea rcx, [rsp + 0x20]
call fcn.14000ba90
cmp qword [rsp + 0x88], 0
jne 0x14000da73
mov rcx, rdi
call fcn.140010e90
mov rax, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x14000da9b
mov rcx, qword [rsp + 0x48]
mov r8d, 1
mov rsi, rax
call fcn.140009c10
mov rax, rsi
add rsp, 0x368
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov edx, 0x80000
call fcn.14004be60
mov ecx, 8
mov edx, 0xfa0
call fcn.14004be60
int3