Function at 0x14005db5e
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
movaps xmmword [rsp + 0x390], xmm6
mov r12, rdx
mov rbx, rcx
mov al, byte [rdx + 9]
cmp al, 2
je 0x14005dc88
mov sil, byte [r12 + 0xa]
test al, al
je 0x14005dbef
xorps xmm0, xmm0
lea rcx, [rsp + 0x100]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call sub.kernel32.dll_GlobalMemoryStatusEx
test eax, eax
je 0x14005dbc0
xor ecx, ecx
jmp 0x14005dbca
call fcn.140061677
mov ecx, 1
mov rax, qword [rsp + 0x108]
mov qword [rbx + 0xc0], rax
mov rax, qword [rsp + 0x110]
mov qword [rbx + 0xc8], rax
xor edx, edx
call fcn.14005c6e9
test sil, 1
je 0x14005dc88
xorps xmm0, xmm0
lea rcx, [rsp + 0x100]
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.kernel32.dll_K32GetPerformanceInfo
test eax, eax
je 0x14005dc88
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x110]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x150]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x108]
sub rdx, r8
cmovb rdx, r9
mov qword [rbx + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rbx + 0xd8], rax
cmp byte [r12 + 0xb], 2
movabs rbp, 0x8000000000000000
je 0x14005e015
mov r13b, byte [r12 + 0xc]
lea rdi, [rbx + 0xe0]
cmp qword [rbx + 0xe0], 0
jne 0x14005df07
lea r8, [rsp + 0x2c0]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov ebp, eax
test ebp, ebp
jne 0x14005dcfc
mov r15, qword [rsp + 0x2c0]
lea r14, [rsp + 0x100]
mov rcx, r14
call fcn.14005dae3
mov rcx, r14
call fcn.14005db1d
lea rsi, [0x140258fd0]
and qword [rbx + 0xf8], 0
and qword [rbx + 0x118], 0
mov qword [rbx + 0xe0], rsi
xorps xmm0, xmm0
movups xmmword [rbx + 0xe8], xmm0
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], rdx
mov qword [rbx + 0x110], r15
test ebp, ebp
jne 0x14005def4
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x70], r13b
mov ebp, r13d
and bpl, 1
mov ecx, 0x1e
call fcn.14001c557
movups xmm0, xmmword [str.Processor__Total___Idle_Timetot_0Processor____Idle_Time]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x140259826]
movups xmmword [rdx + 0xe], xmm0
lea rsi, [rsp + 0x2c0]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x1e
lea r12, [rbx + 0x48]
mov ecx, 5
call fcn.14001c557
mov dword [rdx], 0x5f746f74
mov byte [rdx + 4], 0x30
lea r9, [rsp + 0x100]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
mov rcx, rsi
mov qword [rsp + 0x60], rdi
mov rdx, rdi
mov r8, r12
call fcn.14005f0f6
mov rcx, rbx
mov edx, ebp
call fcn.14005f45a
mov r12, rax
mov qword [rsp + 0x80], rdx
xor eax, eax
mov qword [rsp + 0x68], rax
mov ebp, 2
mov esi, 1
cmp r12, qword [rsp + 0x80]
je 0x14005dee2
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
inc rax
mov qword [rsp + 0x68], rax
lea rax, [0x140259858]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
and qword [rsp + 0x120], 0
lea r14, [rsp + 0x98]
mov qword [rsp + 0x48], r14
lea r15, [fcn.14000d910]
mov qword [rsp + 0x50], r15
lea rdi, [rsp + 0x48]
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rsi
lea rcx, [rsp + 0x250]
lea r13, [rsp + 0x100]
mov rdx, r13
call fcn.140058c9a
lea rax, [0x140259880]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rbp
and qword [rsp + 0x120], 0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rsi
lea r14, [rsp + 0x2c0]
mov rcx, r14
mov rdx, r13
call fcn.140058c9a
lea r8, [r12 + 0x48]
lea rcx, [rsp + 0x250]
mov rdx, qword [rsp + 0x60]
mov r9, r14
call fcn.14005f0f6
add r12, 0x70
jmp 0x14005dde9
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rdi]
mov r12, qword [rsp + 0x78]
mov r13b, byte [rsp + 0x70]
test rsi, rsi
movabs rbp, 0x8000000000000000
je 0x14005e015
mov rcx, qword [rbx + 0x110]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rbx + 0x48], rbp
je 0x14005df3e
lea rdx, [rbx + 0x48]
mov rcx, rdi
call fcn.14005f47c
test eax, eax
je 0x14005e810
movss xmm1, dword [0x14006d6c0]
subss xmm1, xmm0
movss dword [rbx + 0x68], xmm1
mov edx, r13d
and dl, 1
mov rcx, rbx
call fcn.14005f45a
mov r14, rax
mov r15, rdx
add r14, 0x48
movss xmm6, dword [0x14006d6c0]
lea rax, [r14 - 0x48]
cmp rax, r15
je 0x14005df92
cmp qword [r14], rbp
je 0x14005df8c
mov rcx, rdi
mov rdx, r14
call fcn.14005f47c
test eax, eax
je 0x14005e7d1
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [r14 + 0x20], xmm1
add r14, 0x70
jmp 0x14005df5e
test r13b, 1
je 0x14005e015
cmp byte [rbx + 0x88], 0
jne 0x14005e015
mov rdi, qword [rbx + 0x80]
lea r14, [rsp + 0x100]
mov rcx, r14
mov rdx, rdi
call fcn.14005ef58
mov rsi, qword [rbx + 0x78]
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
shl rax, 3
imul r8, rdi, 0x70
xor r9d, r9d
mov r10, rsi
test r8, r8
je 0x14005dff8
cmp rax, r9
je 0x14005dff8
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x14005dfd8
call fcn.14005c9a0
test rdi, rdi
je 0x14005e008
mov rax, qword [rsi + 0x60]
jmp 0x14005e00a
xor eax, eax
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x88], 1
mov al, byte [r12]
cmp al, 2
je 0x14005e7b5
mov rcx, qword [r12 + 1]
mov byte [rsp + 0x8f], al
mov qword [rsp + 0x90], rcx
mov edi, 0x80000
mov ecx, 0x80000
call fcn.14001c557
lea r14, [rsp + 0xd0]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
lea r15, [rsp + 0x2c0]
lea r12, [rsp + 0x100]
and dword [rsp + 0x2c0], 0
mov rcx, r14
mov rdx, rdi
call fcn.14001a499
mov rsi, qword [rsp + 0xd8]
mov ecx, 5
mov rdx, rsi
mov r8d, edi
mov r9, r15
call sub.ntdll.dll_NtQuerySystemInformation
mov rcx, r12
mov edx, eax
call fcn.14005c4ce
cmp qword [rsp + 0x100], 0
je 0x14005e0ed
cmp dword [rsp + 0x110], 0xd0000004
mov rcx, qword [rsp + 0x108]
jne 0x14005e1a7
mov eax, dword [rsp + 0x2c0]
mov rdx, rdi
add rdx, rdi
lea edi, [rax + 0x2800]
test eax, eax
cmove rdi, rdx
test rcx, rcx
je 0x14005e068
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14005e068
mov qword [rsp + 0xe0], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.140058e5e
test rax, rax
je 0x14005e7e9
lea rdi, [rsp + 0x98]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
xor edx, edx
xor r14d, r14d
mov r15d, dword [rsi + r14]
cmp rdx, qword [rsp + 0x98]
jne 0x14005e150
mov rcx, rdi
call fcn.14005cdb3
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsi + r14]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0xa8]
inc rdx
mov qword [rsp + 0xa8], rdx
add r14, r15
test r15, r15
jne 0x14005e12a
lea rax, [rbx + 0x90]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xe8], rax
cmp byte [rsp + 0x8f], 0
je 0x14005e1c2
mov rcx, rbx
xor edx, edx
call fcn.14005e829
mov rax, qword [rbx + 0x80]
jmp 0x14005e1c4
test rcx, rcx
je 0x14005e1b2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rdx, rsi
jmp 0x14005e7b0
xor eax, eax
lea rdi, [rsp + 0xf0]
mov qword [rdi], rax
lea rsi, [rsp + 0x100]
and qword [rsi], 0
mov rax, qword [0x14006a0e0]
mov rcx, rsi
call rax
mov rcx, qword [rsi]
movabs r8, 0x19db1ded53e7fff
mov rax, rcx
sub rax, r8
mov edx, 1
sub rdx, rax
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovle rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovle rax, r9
lea rcx, [rsp + 0xf8]
mov qword [rcx], rax
mov r14, qword [rsp + 0xa8]
mov qword [rsi + 0x10], r14
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsi], xmm0
and qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 8
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xe8]
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x8f]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rdi
mov qword [rsi + 0x30], rcx
mov rdi, qword [rsi]
cmp rdi, r14
jb 0x14005e7f8
lea rsi, [rsp + 0x118]
mov r15, qword [rsi - 0x10]
call fcn.14001da51
xor r9d, r9d
cmp r14, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x250]
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.1400596c8
test rdi, rdi
je 0x14005e2f8
shl rdi, 3
mov edx, 8
mov rcx, r15
mov r8, rdi
call fcn.140003b49
mov rax, qword [rsp + 0x260]
xor edx, edx
sub rax, 1
jb 0x14005e31a
mov rsi, qword [rsi]
test rsi, rsi
je 0x14005e31a
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14005e302
lea rcx, [rsp + 0x48]
call fcn.14005cc23
mov rax, qword [rsp + 0x260]
lea rsi, [rsp + 0x2c0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x250]
movaps xmmword [rsi], xmm0
lea r12, [rsp + 0x108]
lea rdi, [rsp + 0x100]
mov rcx, rsi
call fcn.140059690
test rax, rax
je 0x14005e3f0
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0xb0], xmm0
mov rcx, rax
call fcn.1400596be
cmp r14, rbp
je 0x14005e3f0
mov qword [rsp + 0x100], r14
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [r12], xmm0
mov r14, qword [rsp + 0x108]
mov r15, qword [rsp + 0x110]
lea rcx, [rsp + 0x48]
mov rdx, r15
call fcn.14005cc23
mov r13, qword [rsp + 0x58]
imul rcx, r13, 0x150
add rcx, qword [rsp + 0x50]
imul r8, r15, 0x150
mov rdx, r14
call sub.msvcrt.dll_memcpy
add r13, r15
mov qword [rsp + 0x58], r13
and qword [rsp + 0x110], 0
mov rcx, rdi
call fcn.140058e9f
jmp 0x14005e353
lea rcx, [rsp + 0x2c0]
call fcn.14005965e
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x78], rax
imul rcx, qword [rsp + 0x58], 0x150
mov r13, qword [rsp + 0x50]
lea rax, [rcx + r13]
mov qword [rsp + 0xc8], rax
lea rax, [rbx + 0xb0]
mov qword [rsp + 0xc0], rax
lea rbp, [rsp + 0x250]
lea r14, [rsp + 0x100]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x60], rbx
test rcx, rcx
je 0x14005e66c
mov r12, qword [r13]
cmp r12, 2
je 0x14005e665
mov qword [rsp + 0x68], rcx
lea rsi, [r13 + 0xe0]
mov r15, qword [r13 + 0xd8]
lea rdx, [r13 + 8]
mov r8d, 0xd0
lea rcx, [rsp + 0x2c0]
call sub.msvcrt.dll_memcpy
mov ecx, 0xe
mov rdi, rbp
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0xb0], r15
mov rcx, qword [rbx + 0xb0]
mov rdx, qword [rbx + 0xb8]
mov r8, r15
call fcn.14005c7d6
mov rsi, rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x48], rax
cmp qword [rbx + 0xa0], 0
mov rdi, qword [rsp + 0x80]
je 0x14005e650
lea rax, [rsp + 0x48]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rdi
mov rcx, qword [rbx + 0x90]
mov rdx, qword [rbx + 0x98]
lea rax, [0x14005d72a]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov r9, r14
call fcn.14005d222
test rax, rax
je 0x14005e5b2
mov rdi, qword [rbx + 0x90]
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0xb0]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [rbx + 0x98]
mov byte [rdi + rdx], sil
mov byte [rcx + rdi + 0x10], sil
inc qword [rbx + 0xa8]
neg rdx
imul rbp, rdx, 0x158
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], r12
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x2c0]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r15
add rdi, rbp
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rbp, [rsp + 0x250]
mov rsi, rbp
rep movsq qword [rdi], qword [rsi]
jmp 0x14005e633
mov rdi, qword [rdi]
neg rdx
imul rbp, rdx, 0x158
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r14
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov qword [rsi], r12
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x2c0]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r15
add rdi, rbp
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rbp, [rsp + 0x250]
mov rsi, rbp
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x100], 2
je 0x14005e633
mov rcx, r14
call fcn.140058f10
add r13, 0x150
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffeb0
mov rbx, qword [rsp + 0x60]
jmp 0x14005e44a
mov rcx, rdi
mov rdx, qword [rsp + 0xc0]
call fcn.14005d750
jmp 0x14005e4da
add r13, 0x150
mov rax, qword [rsp + 0xc8]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
mov rdx, rax
call fcn.140058ee6
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
call fcn.140058ec9
mov rdi, qword [rbx + 0x90]
mov r14, qword [rbx + 0x98]
lea rax, [r14 + rdi]
inc rax
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rdi + 0x10]
mov r15, qword [rbx + 0xa8]
lea rsi, [rsp + 0x100]
mov qword [rsi], rdi
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], r15
mov r12, qword [rbx + 0xa0]
mov r13d, 0x158
pcmpeqd xmm6, xmm6
mov rcx, rsi
call fcn.14005cf5a
test rax, rax
je 0x14005e7a0
mov rcx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x14005e6f1
mov rax, rdi
sub rax, rcx
cqo
idiv r13
lea rdx, [rax - 0x10]
and rdx, r14
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x14005e744
bsr r8w, r8w
xor r8d, 0xf
jmp 0x14005e749
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
ja 0x14005e77c
inc r12
mov qword [rbx + 0xa0], r12
mov r9b, 0xff
mov byte [rdi + rax], r9b
mov byte [rdx + rdi + 0x10], r9b
dec r15
mov qword [rbx + 0xa8], r15
add rcx, 0xfffffffffffffeb0
call fcn.140058f10
jmp 0x14005e6f1
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
call fcn.1400603fd
movaps xmm6, xmmword [rsp + 0x390]
add rsp, 0x3a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.key_used_disappeared
lea r8, [0x140259958]
mov edx, 0x14
call fcn.14000f850
mov ecx, 8
mov edx, 0xfa0
call fcn.14000bfa0
lea rcx, str.assertion_failed:_vec.capacity_____start___len_home_floppa_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x1402592f0]
mov edx, 0x2f
call fcn.14000e620
lea rcx, str.global_key_idle_disappeared_home_floppa_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.30.8_src_windows_system.rs
lea r8, [0x140259928]
mov edx, 0x1b
call fcn.14000f850
int3