Function at 0x7fff25db9fd0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x7fff25fcfe70]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov r15, rcx
cmp edx, 0x68
jb 0x7fff25dfbea2
xor r9d, r9d
lea rdx, [rsp + 0x60]
xor ecx, ecx
lea ebx, [r9 + 0x40]
mov r8d, ebx
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbea9
xor r9d, r9d
lea r8d, [rbx - 8]
lea rdx, [rsp + 0x28]
lea ecx, [rbx + 0x76]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbea9
xor r9d, r9d
lea rdx, [rbp - 0x20]
mov r8d, 0x158
lea ecx, [rbx - 0x3e]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbea9
xor r9d, r9d
lea rdx, [rbp - 0x60]
mov r8d, ebx
lea ecx, [rbx - 0x2b]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
test eax, eax
js 0x7fff25dfbea9
mov r14d, 0x1000
mov ebx, r14d
mov edx, r14d
xor ecx, ecx
call sym.KERNELBASE.dll_LocalAlloc
mov rdi, rax
test rax, rax
je 0x7fff25dfbeb9
lea r9, [rsp + 0x20]
mov r8d, ebx
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov esi, eax
mov rcx, rdi
test eax, eax
jns 0x7fff25dba103
call sym.KERNELBASE.dll_LocalFree
cmp esi, 0xc0000004
jne 0x7fff25dfbeb5
cmp dword [rsp + 0x20], ebx
jbe 0x7fff25dfbead
mov ebx, dword [rsp + 0x20]
mov edx, ebx
jmp 0x7fff25dba0a8
mov edx, dword [rsp + 0x20]
xor ebx, ebx
xor esi, esi
mov r8d, 0x100
xor r14d, r14d
jmp 0x7fff25dba133
add esi, dword [rcx + 4]
inc ebx
add r14d, dword [rcx + 0x60]
cmp dword [rcx], 0
je 0x7fff25dba138
cmp dword [rcx], edx
ja 0x7fff25dba138
sub edx, dword [rcx]
mov dword [rsp + 0x20], edx
mov eax, dword [rcx]
add rcx, rax
cmp edx, r8d
ja 0x7fff25dba116
mov rcx, rdi
call sym.KERNELBASE.dll_LocalFree
mov r10d, dword [rsp + 0x68]
xor edx, edx
mov rax, qword [rsp + 0x40]
div r10
mov r9d, dword [rbp + 0x54]
xor edx, edx
mov r8d, dword [rbp + 0x50]
mov qword [r15 + 8], rax
mov rax, qword [rsp + 0x50]
div r10
mov rcx, qword [rbp - 0x38]
xor edx, edx
mov qword [r15 + 0x10], rax
mov rax, qword [rsp + 0x58]
div r10
xor edx, edx
mov dword [r15], 0x68
mov qword [r15 + 0x18], rax
mov rax, qword [rsp + 0x28]
div r10
xor edx, edx
mov qword [r15 + 0x30], rcx
mov qword [r15 + 0x20], rax
mov rax, qword [rsp + 0x30]
div r10
lea edx, [r9 + r8]
mov qword [r15 + 0x40], r8
mov qword [r15 + 0x28], rax
mov eax, 1
mov qword [r15 + 0x38], rdx
mov qword [r15 + 0x48], r9
mov qword [r15 + 0x50], r10
mov dword [r15 + 0x58], r14d
mov dword [r15 + 0x5c], ebx
mov dword [r15 + 0x60], esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.7fff25dce640
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 0xc0000004
jmp 0x7fff25dfbebe
mov ecx, eax
jmp 0x7fff25dfbebe
add ebx, r14d
jmp 0x7fff25dba0ff
mov ecx, esi
jmp 0x7fff25dfbebe
mov ecx, 0xc000009a
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x7fff25dba1c7