Function at 0x14003add0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3b8
movaps xmmword [rsp + 0x3a0], xmm6
mov r12, rdx
mov rbx, rcx
mov al, byte [rdx + 9]
cmp al, 2
je 0x14003aef6
mov sil, byte [r12 + 0xa]
test al, al
je 0x14003ae5c
xorps xmm0, xmm0
lea rcx, [rsp + 0x100]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x14003ae33
xor ecx, ecx
jmp 0x14003ae3d
call fcn.1400448f8
mov ecx, 1
mov rax, qword [rsp + 0x108]
mov qword [rbx + 0x70], rax
mov rax, qword [rsp + 0x110]
mov qword [rbx + 0x78], rax
xor edx, edx
call fcn.1400364e4
test sil, 1
je 0x14003aef6
xorps xmm0, xmm0
lea rcx, [rsp + 0x100]
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
and qword [rcx + 0x60], 0
mov edx, 0x68
call qword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x14003aef6
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x110]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x150]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x108]
sub rdx, r8
cmovb rdx, r9
mov qword [rbx + 0x80], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rbx + 0x88], rax
cmp byte [r12 + 0xb], 2
movabs r13, 0x8000000000000000
je 0x14003b257
mov sil, byte [r12 + 0xc]
lea rdi, [rbx + 0x90]
cmp qword [rbx + 0x90], 0
jne 0x14003b166
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x58], r12
lea r8, [rsp + 0x100]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.pdh.dll_PdhOpenQueryA]
mov ebp, eax
test eax, eax
jne 0x14003af68
mov r12, qword [rsp + 0x100]
call fcn.14001429c
mov r15, rax
mov r14, rdx
lea rsi, [0x1400543f0]
cmp qword [rdi], 0
je 0x14003af7e
mov rcx, rdi
call fcn.14003c29a
mov rcx, rdi
call fcn.14003a133
and qword [rbx + 0xa8], 0
and qword [rbx + 0xc8], 0
mov qword [rbx + 0x90], rsi
xorps xmm0, xmm0
movups xmmword [rbx + 0x98], xmm0
mov qword [rbx + 0xb0], r15
mov qword [rbx + 0xb8], r14
mov qword [rbx + 0xc0], r12
test ebp, ebp
jne 0x14003b153
mov bpl, byte [rsp + 0x50]
and bpl, 1
lea rdx, str.Processor__Total___Idle_Timetot_0Processor____Idle_Time
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x258]
mov r8d, 0x1e
mov rcx, rbx
call fcn.140033791
mov rax, qword [rsp + 0x48]
lea r12, [rax + 0x18]
lea rdx, [0x140053e96]
lea rsi, [rsp + 0x100]
mov r8d, 5
mov rcx, rsi
call fcn.140033791
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rdi
mov rdx, rdi
mov r8, r12
mov r9, rsi
call fcn.14003c359
mov rcx, rbx
mov edx, ebp
call fcn.14003c69e
mov r12, rax
mov qword [rsp + 0x60], rdx
xor esi, esi
mov r14d, 2
mov edi, 1
cmp r12, qword [rsp + 0x60]
je 0x14003b141
mov qword [rsp + 0x98], rsi
inc rsi
lea rax, [0x140053eb8]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], r14
and qword [rsp + 0x120], 0
lea r15, [rsp + 0x98]
mov qword [rsp + 0x258], r15
lea rbp, [fcn.14000b800]
mov qword [rsp + 0x260], rbp
lea rbx, [rsp + 0x258]
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], rdi
lea rcx, [rsp + 0x330]
lea r13, [rsp + 0x100]
mov rdx, r13
call fcn.1400376fa
lea rax, [0x140053ee0]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], r14
and qword [rsp + 0x120], 0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], rbp
lea rax, [rsp + 0x78]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rdi
mov rcx, rbx
mov rdx, r13
call fcn.1400376fa
lea r8, [r12 + 0x48]
lea rcx, [rsp + 0x330]
mov rdx, qword [rsp + 0x40]
mov r9, rbx
mov rbx, qword [rsp + 0x48]
call fcn.14003c359
add r12, 0x70
jmp 0x14003b047
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rdi]
movabs r13, 0x8000000000000000
test rsi, rsi
mov r12, qword [rsp + 0x58]
mov sil, byte [rsp + 0x50]
je 0x14003b257
mov rcx, qword [rbx + 0xc0]
call qword [sym.imp.pdh.dll_PdhCollectQueryData]
cmp qword [rbx + 0x18], r13
je 0x14003b19e
lea rdx, [rbx + 0x18]
mov rcx, rdi
call fcn.14003c6bd
test eax, eax
je 0x14003ba18
movss xmm1, dword [0x140049760]
subss xmm1, xmm0
movss dword [rbx + 0x30], xmm1
mov edx, esi
and dl, 1
mov rcx, rbx
call fcn.14003c69e
mov r14, rax
mov r15, rdx
add r14, 0x48
movss xmm6, dword [0x140049760]
lea rax, [r14 - 0x48]
cmp rax, r15
je 0x14003b1f1
cmp qword [r14], r13
je 0x14003b1eb
mov rcx, rdi
mov rdx, r14
call fcn.14003c6bd
test eax, eax
je 0x14003b9d9
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [r14 + 0x18], xmm1
add r14, 0x70
jmp 0x14003b1bd
test sil, 1
je 0x14003b257
cmp byte [rbx + 0x38], 0
jne 0x14003b257
mov rdi, qword [rbx + 0x10]
lea r14, [rsp + 0x100]
mov rcx, r14
mov rdx, rdi
call fcn.14003c0d5
mov rax, qword [rbx + 8]
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
shl r8, 3
imul r9, rdi, 0x70
xor r10d, r10d
test r9, r9
je 0x14003b24e
cmp r8, r10
je 0x14003b24e
mov r11, qword [rdx + r10]
mov qword [rax + 0x68], r11
add rax, 0x70
add r10, 8
add r9, 0xffffffffffffff90
jmp 0x14003b22e
call fcn.1400399fc
mov byte [rbx + 0x38], 1
mov al, byte [r12]
cmp al, 2
jne 0x14003b27b
movaps xmm6, xmmword [rsp + 0x3a0]
add rsp, 0x3b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [r12 + 1]
mov byte [rsp + 0x6f], al
mov qword [rsp + 0x70], rcx
lea rdi, [rsp + 0x98]
mov r14d, 0x80000
mov edx, 0x80000
mov rcx, rdi
call fcn.14003ba31
lea r15, [rsp + 0x258]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea r12, [rsp + 0x100]
and dword [rsp + 0x258], 0
mov rcx, rdi
mov rdx, r14
call fcn.140039e2a
mov rsi, qword [rsp + 0xa0]
mov ecx, 5
mov rdx, rsi
mov r8d, r14d
mov r9, r15
call r13
mov rcx, r12
mov edx, eax
call fcn.1400393f1
cmp qword [rsp + 0x100], 0
je 0x14003b33f
cmp dword [rsp + 0x110], 0xd0000004
mov rcx, qword [rsp + 0x108]
jne 0x14003b3e1
mov eax, dword [rsp + 0x258]
mov rdx, r14
add rdx, r14
lea r14d, [rax + 0x2800]
test eax, eax
cmove r14, rdx
test rcx, rcx
je 0x14003b2bb
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14003b2bb
mov qword [rsp + 0xa8], r14
and qword [rsp + 0xc0], 0
mov ecx, 8
mov edx, 0xfa0
call fcn.140033b49
test rax, rax
je 0x14003b9f1
lea rdi, [rsp + 0x78]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
xor r14d, r14d
xor r15d, r15d
mov r12d, dword [rsi + r15]
cmp r14, qword [rsp + 0x78]
jne 0x14003b39e
mov rcx, rdi
call fcn.140041bef
mov rax, qword [rsp + 0x80]
lea rcx, [rsi + r15]
mov qword [rax + r14*8], rcx
inc r14
mov qword [rsp + 0x88], r14
add r15, r12
test r12d, r12d
jne 0x14003b383
lea rax, [rbx + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xc8], rax
cmp byte [rsp + 0x6f], 0
je 0x14003b3fc
mov rcx, rbx
xor edx, edx
call fcn.14003ba74
mov rax, qword [rbx + 0x10]
jmp 0x14003b3fe
test rcx, rcx
je 0x14003b3ec
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x98]
mov rdx, rsi
jmp 0x14003b93e
xor eax, eax
lea rdi, [rsp + 0xf0]
mov qword [rdi], rax
lea rsi, [rsp + 0x100]
and qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetSystemTimePreciseAsFileTime]
mov rcx, qword [rsi]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovl rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovl rax, r9
lea rcx, [rsp + 0xf8]
mov qword [rcx], rax
mov r15, qword [rsp + 0x88]
mov qword [rsi + 0x10], r15
and qword [rsp + 0x258], 0
mov qword [rsp + 0x260], 8
and qword [rsp + 0x268], 0
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rsi], xmm0
lea rax, [rsp + 0xc0]
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0xc8]
mov qword [rsi + 0x20], rax
lea rax, [rsp + 0x6f]
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], rdi
mov qword [rsi + 0x38], rcx
mov rdi, qword [rsi]
cmp rdi, r15
jb 0x14003ba00
lea rsi, [rsp + 0x118]
mov r14, qword [rsi - 0x10]
mov rcx, r15
call fcn.140035944
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xd8]
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
mov r9, rax
call fcn.140036999
test r15, r15
jne 0x14003b546
xor ecx, ecx
xor edx, edx
xor r8d, r8d
call fcn.140019c0a
test rdx, rdx
je 0x14003b546
mov r8, rdx
cmp rdx, rax
je 0x14003b546
lea rdx, [r14 + r8*8]
shl r8, 3
lea rcx, [r14 + rax*8]
neg r8
call sub.VCRUNTIME140.dll_memmove
test rdi, rdi
je 0x14003b55f
shl rdi, 3
mov edx, 8
mov rcx, r14
mov r8, rdi
call fcn.140001bf8
mov rax, qword [rsp + 0xe8]
xor r8d, r8d
sub rax, 1
jb 0x14003b582
mov rsi, qword [rsi]
test rsi, rsi
je 0x14003b582
add r8, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14003b56a
test r8, r8
jne 0x14003b9c5
lea rsi, [rsp + 0xe0]
mov rcx, qword [rsi - 8]
mov r13, qword [rsi + 8]
lea rdi, [rsp + 0x100]
test rcx, rcx
je 0x14003b690
mov rbp, qword [rcx + 0x18]
lea rax, [rbp + 0x20]
test rbp, rbp
cmove rax, rsi
and qword [rax], 0
mov r14, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x330], xmm0
mov edx, 8
call fcn.14000aea0
movabs rax, 0x8000000000000000
cmp r14, rax
je 0x14003b694
mov qword [rsp + 0x100], r14
movaps xmm0, xmmword [rsp + 0x330]
lea rax, [rsp + 0x108]
movups xmmword [rax], xmm0
mov r15, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
mov rax, qword [rsp + 0x258]
mov r12, qword [rsp + 0x268]
sub rax, r12
cmp rax, r14
jb 0x14003b673
imul rcx, r12, 0x158
add rcx, qword [rsp + 0x260]
imul r8, r14, 0x158
mov rdx, r15
call fcn.1400455e0
add r12, r14
mov qword [rsp + 0x268], r12
and qword [rsp + 0x110], 0
mov rcx, rdi
call fcn.140033938
dec r13
mov rcx, rbp
jmp 0x14003b5a3
lea rcx, [rsp + 0x258]
mov rdx, r12
mov r8, r14
call fcn.14004791e
mov r12, qword [rsp + 0x268]
jmp 0x14003b62e
xor ebp, ebp
jmp 0x14003b697
dec r13
lea rcx, [rsp + 0xd8]
mov qword [rcx], rbp
mov qword [rcx + 0x10], r13
call fcn.140036918
lea rcx, [rsp + 0x258]
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov rbp, qword [rcx + 8]
imul rcx, qword [rcx + 0x10], 0x158
lea rax, [rcx + rbp]
mov qword [rsp + 0xb8], rax
lea rax, [rbx + 0x60]
mov qword [rsp + 0xb0], rax
lea r15, [rsp + 0x330]
lea r13, [rsp + 0x100]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x48], rbx
test rcx, rcx
je 0x14003b8ff
mov r12, qword [rbp]
cmp r12, 2
je 0x14003b8f8
mov qword [rsp + 0x60], rcx
lea rsi, [rbp + 0xe8]
mov r14, qword [rbp + 0xe0]
lea rdx, [rbp + 8]
mov r8d, 0xd8
lea rcx, [rsp + 0x258]
call fcn.1400455e0
mov ecx, 0xe
mov rdi, r15
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x90], r14
mov rcx, qword [rbx + 0x60]
mov rdx, qword [rbx + 0x68]
mov r8, r14
call fcn.14003948c
mov rsi, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0xd0], rax
cmp qword [rbx + 0x50], 0
je 0x14003b8e1
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x108], rax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x48]
lea rax, [0x14003a94c]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov r9, r13
call fcn.14003a7bc
mov rdi, qword [rbx + 0x40]
test rax, rax
je 0x14003b846
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x90]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [rbx + 0x48]
mov byte [rdi + rdx], sil
mov byte [rdi + rcx + 0x10], sil
inc qword [rbx + 0x58]
neg rdx
imul r15, rdx, 0x160
lea rsi, [rdi + r15]
add rsi, 0xfffffffffffffeb0
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], r12
mov r8d, 0xd8
mov rcx, rsi
lea rdx, [rsp + 0x258]
call fcn.1400455e0
mov qword [rsi + 0xd8], r14
add rdi, r15
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea r15, [rsp + 0x330]
mov rsi, r15
rep movsq qword [rdi], qword [rsi]
jmp 0x14003b8c4
neg rdx
imul r15, rdx, 0x160
lea rsi, [rdi + r15]
add rsi, 0xfffffffffffffea8
mov r8d, 0x158
mov rcx, r13
mov rdx, rsi
call fcn.1400455e0
mov qword [rsi], r12
lea rsi, [rdi + r15]
add rsi, 0xfffffffffffffeb0
mov r8d, 0xd8
mov rcx, rsi
lea rdx, [rsp + 0x258]
call fcn.1400455e0
mov qword [rsi + 0xd8], r14
add rdi, r15
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea r15, [rsp + 0x330]
mov rsi, r15
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x100], 2
je 0x14003b8c4
mov rcx, r13
call fcn.1400339a9
add rbp, 0x158
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffea8
mov rbx, qword [rsp + 0x48]
jmp 0x14003b6f9
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0xb0]
call fcn.140047ef3
jmp 0x14003b77b
add rbp, 0x158
mov rax, qword [rsp + 0xb8]
sub rax, rbp
mov ecx, 0x158
xor edx, edx
div rcx
mov rcx, rbp
mov rdx, rax
call fcn.14003397f
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
call fcn.140033962
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
call case.0x14002dd08.180
mov rax, qword [rbx + 0x40]
mov rcx, qword [rbx + 0x48]
lea rdx, [rax + rcx]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
mov rcx, qword [rbx + 0x58]
lea rsi, [rsp + 0x100]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rdx
mov word [rsi + 0x18], r8w
mov qword [rsi + 0x20], rcx
test rcx, rcx
je 0x14003b25f
mov rcx, rsi
call fcn.14003a33d
mov rcx, qword [rsp + 0x120]
dec rcx
mov qword [rsp + 0x120], rcx
test rax, rax
je 0x14003b25f
mov rdx, rax
add rdx, 0xfffffffffffffea8
je 0x14003b25f
mov byte [rax - 4], 0
jmp 0x14003b982
lea rcx, [rsp + 0x258]
xor edx, edx
call fcn.14004791e
jmp 0x14003b58b
lea rcx, str.key_used_disappeared
lea r8, [0x140053fb8]
mov edx, 0x14
call fcn.140045d70
mov ecx, 8
mov edx, 0xfa0
call fcn.140045700
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x1400539d0]
mov edx, 0x2f
call fcn.140045970
lea rcx, str.global_key_idle_disappearedC:Usersuser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.32.0_srcwindows_system.rs
lea r8, [0x140053f88]
mov edx, 0x1b
call fcn.140045d70
int3