Function at 0x140096bdf
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x3a8
movaps xmmword [rsp + 0x390], xmm6
mov r12, rdx
mov rbx, rcx
mov al, byte [rdx + 9]
cmp al, 2
je 0x140096d0b
mov sil, byte [r12 + 0xa]
test al, al
je 0x140096c71
xorps xmm0, xmm0
lea rcx, [rsp + 0x170]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140096c42
xor ecx, ecx
jmp 0x140096c4c
call fcn.1400acb3c
mov ecx, 1
mov rax, qword [rsp + 0x178]
mov qword [rbx + 0xc0], rax
mov rax, qword [rsp + 0x180]
mov qword [rbx + 0xc8], rax
xor edx, edx
call fcn.140094833
test sil, 1
je 0x140096d0b
xorps xmm0, xmm0
lea rcx, [rsp + 0x170]
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
and qword [rcx + 0x60], 0
mov edx, 0x68
call qword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x140096d0b
mov r8, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x180]
xor r9d, r9d
sub rdx, r8
cmovb rdx, r9
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
mul rdx
mov r10, 0xffffffffffffffff
cmovo rax, r10
mov rdx, qword [rsp + 0x178]
sub rdx, r8
cmovb rdx, r9
mov qword [rbx + 0xd0], rax
mov rax, rcx
mul rdx
cmovo rax, r10
mov qword [rbx + 0xd8], rax
cmp byte [r12 + 0xb], 2
movabs rbp, 0x8000000000000000
je 0x140097079
mov r13b, byte [r12 + 0xc]
lea rdi, [rbx + 0xe0]
cmp qword [rbx + 0xe0], 0
jne 0x140096f6a
lea r8, [rsp + 0x2c0]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call qword [sym.imp.pdh.dll_PdhOpenQueryA]
mov ebp, eax
test ebp, ebp
jne 0x140096d80
mov r15, qword [rsp + 0x2c0]
lea r14, [rsp + 0x170]
mov rcx, r14
call fcn.140096b37
mov rcx, r14
call fcn.140096b9e
lea rsi, [0x140104610]
and qword [rbx + 0xf8], 0
and qword [rbx + 0x118], 0
mov qword [rbx + 0xe0], rsi
xorps xmm0, xmm0
movups xmmword [rbx + 0xe8], xmm0
mov qword [rbx + 0x100], rax
mov qword [rbx + 0x108], rdx
mov qword [rbx + 0x110], r15
test ebp, ebp
jne 0x140096f57
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x70], r13b
mov ebp, r13d
and bpl, 1
lea rdx, str.Processor__Total___Idle_Timetot_0Processor____Idle_Time
lea rsi, [rsp + 0x2c0]
mov r8d, 0x1e
mov rcx, rsi
call fcn.14000d281
lea r12, [rbx + 0x48]
lea rdx, [0x14010440e]
lea r14, [rsp + 0x170]
mov r8d, 5
mov rcx, r14
call fcn.140092269
mov rcx, rsi
mov qword [rsp + 0x58], rdi
mov rdx, rdi
mov r8, r12
mov r9, r14
call fcn.14009817c
mov rcx, rbx
mov edx, ebp
call fcn.1400984fc
mov r12, rax
mov qword [rsp + 0x60], rdx
xor eax, eax
mov qword [rsp + 0x68], rax
mov ebp, 2
mov esi, 1
cmp r12, qword [rsp + 0x60]
je 0x140096f45
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
inc rax
mov qword [rsp + 0x68], rax
lea rax, [0x140104430]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rbp
and qword [rsp + 0x190], 0
lea r14, [rsp + 0x40]
mov qword [rsp + 0x80], r14
lea r15, [fcn.14000e250]
mov qword [rsp + 0x88], r15
lea rdi, [rsp + 0x80]
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rsi
lea rcx, [rsp + 0xf0]
lea r13, [rsp + 0x170]
mov rdx, r13
call fcn.140092222
lea rax, str._rustc_2f090c30ddd6b3bbe5c81c087579a5166e7c7278librarycore_srccharmethods.rs
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rbp
and qword [rsp + 0x190], 0
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rsi
lea r14, [rsp + 0x2c0]
mov rcx, r14
mov rdx, r13
call fcn.140092222
lea r8, [r12 + 0x48]
lea rcx, [rsp + 0xf0]
mov rdx, qword [rsp + 0x58]
mov r9, r14
call fcn.14009817c
add r12, 0x70
jmp 0x140096e46
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rdi]
mov r12, qword [rsp + 0x78]
mov r13b, byte [rsp + 0x70]
test rsi, rsi
movabs rbp, 0x8000000000000000
je 0x140097079
mov rcx, qword [rbx + 0x110]
call qword [sym.imp.pdh.dll_PdhCollectQueryData]
cmp qword [rbx + 0x48], rbp
je 0x140096fa2
lea rdx, [rbx + 0x48]
mov rcx, rdi
call fcn.14009851e
test eax, eax
je 0x1400978e5
movss xmm1, dword [0x1400b3938]
subss xmm1, xmm0
movss dword [rbx + 0x68], xmm1
mov edx, r13d
and dl, 1
mov rcx, rbx
call fcn.1400984fc
mov r14, rax
mov r15, rdx
add r14, 0x48
movss xmm6, dword [0x1400b3938]
lea rax, [r14 - 0x48]
cmp rax, r15
je 0x140096ff6
cmp qword [r14], rbp
je 0x140096ff0
mov rcx, rdi
mov rdx, r14
call fcn.14009851e
test eax, eax
je 0x1400978a6
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [r14 + 0x20], xmm1
add r14, 0x70
jmp 0x140096fc2
test r13b, 1
je 0x140097079
cmp byte [rbx + 0x88], 0
jne 0x140097079
mov rdi, qword [rbx + 0x80]
lea r14, [rsp + 0x170]
mov rcx, r14
mov rdx, rdi
call fcn.140097fb7
mov rsi, qword [rbx + 0x78]
mov rcx, qword [r14]
mov rdx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
shl rax, 3
imul r8, rdi, 0x70
xor r9d, r9d
mov r10, rsi
test r8, r8
je 0x14009705c
cmp rax, r9
je 0x14009705c
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x14009703c
call fcn.1400735ca
test rdi, rdi
je 0x14009706c
mov rax, qword [rsi + 0x60]
jmp 0x14009706e
xor eax, eax
mov qword [rbx + 0x60], rax
mov byte [rbx + 0x88], 1
mov al, byte [r12]
cmp al, 2
je 0x14009788a
mov rcx, qword [r12 + 1]
mov byte [rsp + 0x9f], al
mov qword [rsp + 0xa0], rcx
lea rdi, [rsp + 0xd0]
mov r14d, 0x80000
mov edx, 0x80000
mov rcx, rdi
call fcn.1400978fe
lea r15, [rsp + 0x2c0]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea r12, [rsp + 0x170]
and dword [rsp + 0x2c0], 0
mov rcx, rdi
mov rdx, r14
call fcn.14003a1c3
mov rsi, qword [rsp + 0xd8]
mov ecx, 5
mov rdx, rsi
mov r8d, r14d
mov r9, r15
call r13
mov rcx, r12
mov edx, eax
call fcn.140094657
cmp qword [rsp + 0x170], 0
je 0x14009714f
cmp dword [rsp + 0x180], 0xd0000004
mov rcx, qword [rsp + 0x178]
jne 0x140097206
mov eax, dword [rsp + 0x2c0]
mov rdx, r14
add rdx, r14
lea r14d, [rax + 0x2800]
test eax, eax
cmove r14, rdx
test rcx, rcx
je 0x1400970cb
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400970cb
mov qword [rsp + 0xe0], r14
mov ecx, 8
mov edx, 0xfa0
call fcn.14000d2db
test rax, rax
je 0x1400978be
lea rdi, [rsp + 0xa8]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
xor edx, edx
xor r14d, r14d
mov r15d, dword [rsi + r14]
cmp rdx, qword [rsp + 0xa8]
jne 0x1400971b2
mov rcx, rdi
call fcn.14009b549
mov rax, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsi + r14]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0xb8]
inc rdx
mov qword [rsp + 0xb8], rdx
add r14, r15
test r15d, r15d
jne 0x14009718c
lea rax, [rbx + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xe8], rax
cmp byte [rsp + 0x9f], 0
je 0x140097221
mov rcx, rbx
xor edx, edx
call fcn.140097932
mov rax, qword [rbx + 0x80]
jmp 0x140097223
test rcx, rcx
je 0x140097211
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0xd0]
mov rdx, rsi
jmp 0x140097885
xor eax, eax
lea r14, [rsp + 0x160]
mov qword [r14], rax
lea rsi, [rsp + 0x170]
and qword [rsi], 0
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetSystemTimePreciseAsFileTime]
mov rcx, qword [rsi]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovl rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovl rax, r9
lea rcx, [rsp + 0x168]
mov qword [rcx], rax
mov rdi, qword [rsp + 0xb8]
mov qword [rsi + 0x10], rdi
movups xmm0, xmmword [rsp + 0xa8]
movaps xmmword [rsi], xmm0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 8
and qword [rsp + 0x50], 0
lea rax, [rsp + 0xe8]
mov qword [rsi + 0x18], rax
lea rax, [rsp + 0x9f]
mov qword [rsi + 0x20], rax
movups xmm0, xmmword [rsp + 0xa8]
movaps xmmword [rsp + 0xf0], xmm0
and qword [rsp + 0x100], 0
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], rcx
cmp qword [rsp + 0xf0], rdi
jb 0x1400978cd
lea rsi, [rsp + 0x188]
mov r14, qword [rsp + 0xf8]
call fcn.14003d031
xor r9d, r9d
cmp rdi, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
call fcn.140094f2a
cmp qword [rsp + 0x100], rdi
jne 0x140097396
lea rax, [rsp + 0xf0]
and qword [rax + 0x10], 0
lea rcx, [rsp + 0x2c0]
mov qword [rcx + 0x18], rdi
and qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rax
lea rax, str._rustc_2f090c30ddd6b3bbe5c81c087579a5166e7c7278librarycore_srccharmethods.rs
mov qword [rcx], rax
mov qword [rcx + 8], rax
call fcn.140096050
jmp 0x1400973a4
test rdi, rdi
jne 0x1400973a4
and qword [rsp + 0x100], 0
mov r8, qword [rsp + 0xf0]
test r8, r8
je 0x1400973c7
shl r8, 3
mov rcx, qword [rsp + 0xf8]
mov edx, 8
call fcn.1400027ba
mov rax, qword [rsp + 0x90]
xor edx, edx
sub rax, 1
jb 0x1400973e9
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400973e9
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x1400973d1
lea rcx, [rsp + 0x40]
call fcn.14009620d
mov rax, qword [rsp + 0x90]
lea rsi, [rsp + 0x2c0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsi], xmm0
lea r12, [rsp + 0x178]
lea rdi, [rsp + 0x170]
mov rcx, rsi
call fcn.140094efc
test rax, rax
je 0x1400974cf
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x170], xmm0
mov rcx, rax
call fcn.14003aab4
movaps xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0xf0], xmm0
cmp r14, rbp
je 0x1400974cf
mov qword [rsp + 0x170], r14
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [r12], xmm0
mov r14, qword [rsp + 0x178]
mov r15, qword [rsp + 0x180]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.14009620d
mov r13, qword [rsp + 0x50]
imul rcx, r13, 0x150
add rcx, qword [rsp + 0x48]
imul r8, r15, 0x150
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
add r13, r15
mov qword [rsp + 0x50], r13
and qword [rsp + 0x180], 0
mov rcx, rdi
call fcn.1400923f3
jmp 0x140097422
lea rcx, [rsp + 0x2c0]
call fcn.140094eca
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x78], rax
imul rcx, qword [rsp + 0x50], 0x150
mov r13, qword [rsp + 0x48]
lea rax, [rcx + r13]
mov qword [rsp + 0xc8], rax
lea rax, [rbx + 0xb0]
mov qword [rsp + 0xc0], rax
lea rbp, [rsp + 0xf0]
lea r14, [rsp + 0x170]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x58], rbx
lea rcx, str.key_used_disappeared
lea r8, [0x140104520]
mov edx, 0x14