Function at 0x140014ce0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x328
movdqa xmmword [rsp + 0x310], xmm6
mov ebp, edx
mov rbx, rcx
mov word [rsp + 0x28], bp
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x2a], al
call fcn.140077ad0
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], edx
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x30]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140077b00
test byte [rsp + 0x80], 1
je 0x140014d48
xor eax, eax
jmp 0x140014d50
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x68], rax
mov esi, 0x80000
lea r14, [rsp + 0x2c]
mov r12, qword [0x140105118]
jmp 0x140014d9a
test rsi, rsi
je 0x140014e0a
lea r15, [rsi + rsi]
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.14000b1f0
mov rsi, r15
test r15, r15
js 0x14001517e
mov edi, 1
test rsi, rsi
je 0x140014dc8
movzx eax, byte [r12]
mov r15d, 1
mov edx, 1
mov rcx, rsi
call fcn.14000b1e0
test rax, rax
je 0x14001518c
mov rdi, rax
mov dword [rsp + 0x2c], 0
mov ecx, 5
mov rdx, rdi
mov r8d, esi
mov r9, r14
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140014e12
mov r15d, dword [rsp + 0x2c]
test r15d, r15d
je 0x140014d70
add r15d, 0x2800
test rsi, rsi
jne 0x140014d7d
jmp 0x140014d8e
xor r15d, r15d
jmp 0x140014d8e
movzx eax, byte [r12]
mov ecx, 0xfa0
mov edx, 8
call fcn.14000b1e0
test rax, rax
je 0x14001519a
mov qword [rsp + 0x50], 0x1f4
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
xor r15d, r15d
lea r14, [rsp + 0x50]
xor r12d, r12d
jmp 0x140014e7f
lea rax, [rdi + r12]
mov rcx, qword [rsp + 0x58]
mov qword [rcx + r15*8], rax
inc r15
mov qword [rsp + 0x60], r15
mov eax, dword [rax]
add r12, rax
test rax, rax
je 0x140014e90
cmp r15, qword [rsp + 0x50]
jne 0x140014e60
mov rcx, r14
call fcn.140020940
jmp 0x140014e60
lea r14, [rbx + 0xd8]
mov qword [rsp + 0x70], r14
test bpl, 1
je 0x140014eb8
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.140019960
mov rax, qword [rbx + 0x80]
jmp 0x140014eba
xor eax, eax
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
movdqu xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 8
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x80]
call fcn.140017670
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
imul r15, rcx, 0x148
add r15, rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r15
test rcx, rcx
je 0x14001500d
add rbp, 0x148
lea r12, [rsp + 0x80]
jmp 0x140014fa3
add rbp, 0x148
add r13, 0x148
cmp r13, r15
je 0x140015005
mov rax, qword [rbp - 0x148]
cmp rax, 2
je 0x140015008
lea r13, [rbp - 0x148]
mov qword [rsp + 0x1c8], rax
lea rdx, [r13 + 8]
mov r8d, 0x140
lea rcx, [rsp + 0x1d0]
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x288]
mov rcx, r12
mov rdx, r14
lea r9, [rsp + 0x1c8]
call fcn.140026e20
cmp dword [rsp + 0x80], 2
je 0x140014f90
mov rcx, r12
call fcn.140013060
jmp 0x140014f90
mov rbp, r15
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x30]
call fcn.14001fa40
mov r14, qword [rbx + 0xf0]
test r14, r14
je 0x14001514c
mov r15, qword [rbx + 0xd8]
lea r12, [r15 + 0x10]
movdqa xmm0, xmmword [r15]
pmovmskb ebp, xmm0
not ebp
movabs r13, 0xcf3cf3cf3cf3cf3d
pcmpeqd xmm6, xmm6
jmp 0x14001507c
mov byte [rax + rdx], r10b
mov byte [rax + r8 + 0x10], r10b
dec qword [rbx + 0xf0]
add rcx, 0xfffffffffffffeb0
call fcn.140029ef0
lea eax, [rbp - 1]
and eax, ebp
mov ebp, eax
dec r14
je 0x14001514c
test bp, bp
jne 0x1400150af
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb ebp, xmm0
add r15, 0xffffffffffffeb00
add r12, 0x10
cmp ebp, 0xffff
je 0x140015090
not ebp
tzcnt eax, ebp
neg rax
imul rcx, rax, 0x150
cmp byte [r15 + rcx - 4], 0
mov byte [r15 + rcx - 4], 0
jne 0x14001506c
add rcx, r15
mov rax, qword [rbx + 0xd8]
mov rdx, rax
sub rdx, rcx
sar rdx, 4
imul rdx, r13
lea r8, [rdx - 0x10]
and r8, qword [rbx + 0xe0]
movdqu xmm0, xmmword [rax + r8]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
test r9d, r9d
je 0x14001510d
bsr r9w, r9w
xor r9d, 0xf
jmp 0x140015112
mov r9w, 0x10
movdqu xmm0, xmmword [rax + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
tzcnt r10d, r10d
add r9d, r10d
mov r10b, pe_nt_image_headers64
cmp r9w, 0xf
ja 0x140015050
inc qword [rbx + 0xe8]
mov r10b, 0xff
jmp 0x140015050
test rsi, rsi
je 0x140015162
mov r8d, 1
mov rcx, rdi
mov rdx, rsi
call fcn.14000b1f0
movaps xmm6, xmmword [rsp + 0x310]
add rsp, 0x328
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.1400b3800
mov rdi, rsi
mov rcx, r15
mov rdx, rdi
call fcn.1400b3800
mov ecx, 8
mov edx, 0xfa0
call fcn.1400b3800
ud2