Function at 0x140135f00
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x790
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x708], 0xfffffffffffffffe
mov qword [rbp + 0x18], rcx
mov ax, dx
mov word [rbp + 0x24], ax
shr edx, 0x10
mov al, dl
mov byte [rbp + 0x26], al
mov ax, word [rbp + 0x24]
mov word [rbp + 0x21], ax
mov al, byte [rbp + 0x26]
mov byte [rbp + 0x23], al
mov qword [rbp + 0x6d0], rcx
mov byte [rbp + 0x6cf], 0
mov byte [rbp + 0x6ce], 0
mov qword [rbp + 0x28], 0x80000
call fcn.14016b3d0
mov qword [rbp + 0x30], rax
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x10], rcx
call fcn.140141320
mov rcx, qword [rbp + 0x10]
mov dword [rbp + 0x54], 0
mov rdx, qword [rbp + 0x28]
call fcn.1401437f0
jmp 0x140135f89
lea rcx, [rbp + 0x38]
call fcn.140141780
mov qword [rbp + 8], rax
jmp 0x140135f98
mov rdx, qword [rbp + 8]
mov rax, qword [rbp + 0x28]
mov r8d, eax
mov ecx, 5
lea r9, [rbp + 0x54]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov dword [rbp + 0x6dc], eax
cmp eax, 0xc0000004
jne 0x140135fc7
cmp dword [rbp + 0x54], 0
je 0x140135fd7
jmp 0x140135fee
lea rcx, [rbp + 0x58]
mov edx, 0x1f4
call fcn.1401413d0
jmp 0x14013604b
mov rax, qword [rbp + 0x28]
mov ecx, 2
mul rcx
mov qword [rbp], rax
seto al
jo 0x140136016
jmp 0x140136000
mov eax, dword [rbp + 0x54]
add eax, 0x2800
mov dword [rbp - 4], eax
setb al
jb 0x14013603d
jmp 0x140136026
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x38]
call fcn.140176190
jmp 0x140135f62
lea rcx, [0x1401e4060]
call fcn.1401bdce0
jmp 0x140136024
ud2
mov eax, dword [rbp - 4]
mov eax, eax
mov qword [rbp + 0x28], rax
lea rcx, [rbp + 0x38]
call fcn.140176190
jmp 0x140135f62
lea rcx, [0x1401e4078]
call fcn.1401bdc60
jmp 0x140136024
mov byte [rbp + 0x6cf], 1
mov qword [rbp + 0x70], 0
lea rcx, [rbp + 0x38]
call fcn.1401432e0
mov qword [rbp - 0x10], rax
jmp 0x140136069
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x70]
mov qword [rbp - 0x20], rdx
mov qword [rbp + 0x6f0], rcx
mov qword [rbp + 0x6f8], rdx
mov r8d, 1
call fcn.140138210
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x20]
add rdx, rax
mov qword [rbp - 0x18], rdx
mov qword [rbp + 0x6e0], rdx
mov qword [rbp + 0x6e8], rdx
lea rcx, [rbp + 0x58]
call fcn.140142f10
jmp 0x1401360b6
mov rax, qword [rbp - 0x18]
cmp dword [rax], 0
jne 0x1401360e2
mov rax, qword [rbp + 0x18]
add rax, 0xd8
mov qword [rbp + 0x700], rax
mov qword [rbp + 0x78], rax
lea rcx, [rbp + 0x21]
call fcn.140139c90
mov byte [rbp - 0x21], al
jmp 0x1401360fe
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
add rax, qword [rbp + 0x70]
mov qword [rbp - 0x30], rax
seto al
jo 0x14013632a
jmp 0x14013631d
mov al, byte [rbp - 0x21]
test al, 1
jne 0x140136114
jmp 0x140136107
mov qword [rbp + 0x80], 0
jmp 0x140136123
mov rcx, qword [rbp + 0x18]
call fcn.1401693e0
mov qword [rbp - 0x38], rax
jmp 0x140136155
mov byte [rbp + 0x6cf], 0
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x100], rax
movups xmm0, xmmword [rbp + 0x58]
movaps xmmword [rbp + 0xf0], xmm0
lea rcx, [rbp + 0xd8]
lea rdx, [rbp + 0xf0]
call fcn.140165ca0
jmp 0x140136162
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x80], rax
jmp 0x140136123
lea rax, [rbp + 0x78]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x21]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x80]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x120], rax
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xd8]
lea r8, [rbp + 0x108]
call fcn.14016c960
jmp 0x1401361ad
lea rcx, [rbp + 0x88]
lea rdx, [rbp + 0xa0]
call fcn.1401639b0
jmp 0x1401361c2
lea rcx, [rbp + 0x148]
lea rdx, [rbp + 0x88]
call fcn.1401451d0
jmp 0x1401361d7
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0x148]
call fcn.14016cb60
jmp 0x1401361ec
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0x178], rax
mov rax, qword [rbp + 0x140]
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x188]
lea rdx, [rbp + 0x168]
call fcn.14016ba00
jmp 0x140136239
cmp qword [rbp + 0x188], 2
sete al
test al, 1
jne 0x14013624a
jmp 0x140136258
lea rcx, [rbp + 0x168]
call fcn.14013db00
jmp 0x140136299
mov byte [rbp + 0x6ce], 1
lea rcx, [rbp + 0x2d8]
mov qword [rbp - 0x50], rcx
lea rdx, [rbp + 0x188]
mov r8d, 0x150
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp + 0x18]
add rax, 0xd8
mov qword [rbp - 0x48], rax
call fcn.140151070
mov qword [rbp - 0x40], rax
jmp 0x1401362c5
mov rcx, qword [rbp + 0x18]
add rcx, 0xd8
call fcn.14015d010
jmp 0x1401362ab
mov byte [rbp + 0x6cf], 0
lea rcx, [rbp + 0x38]
call fcn.140176190
nop
add rsp, 0x790
pop rbp
ret
mov byte [rbp + 0x6ce], 0
lea rcx, [rbp + 0x578]
mov qword [rbp - 0x58], rcx
lea rdx, [rbp + 0x2d8]
mov r8d, 0x150
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x58]
lea rcx, [rbp + 0x428]
call fcn.14015cfe0
jmp 0x140136303
lea rcx, [rbp + 0x428]
call fcn.14013d680
jmp 0x140136311
mov byte [rbp + 0x6ce], 0
jmp 0x140136224
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x70], rax
jmp 0x14013605a
lea rcx, [0x1401e4090]
call fcn.1401bdc60
jmp 0x140136024