Function at 0x1400b5f29
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
mov ebp, edx
mov rdi, rcx
mov word [rsp + 0x40], bp
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x42], al
call fcn.1400aca30
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x1400b5f85
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
jmp 0x1400b5f87
xor eax, eax
mov qword [rsp + 0xd8], rax
mov r15d, 0x80000
lea r14, [rsp + 0x44]
mov rsi, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, r15
xor edx, edx
call fcn.1400572ff
mov rbx, rax
mov r12, rdx
and dword [rsp + 0x44], 0
mov ecx, 5
mov rdx, rax
mov r8d, r15d
mov r9, r14
call rsi
cmp eax, 0xc0000004
jne 0x1400b5fef
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x1400b5fdf
add eax, 0x2800
mov r15, rax
jmp 0x1400b5fe2
add r15, r15
mov rcx, rbx
mov rdx, r12
call fcn.1400c2022
jmp 0x1400b5fa1
mov ecx, 8
mov edx, 0xfa0
call fcn.140056125
test rax, rax
je 0x1400b65d1
lea r14, [rsp + 0x68]
mov qword [r14], rax
mov qword [r14 + 8], 0x1f4
and qword [r14 + 0x10], 0
xor edx, edx
xor esi, esi
lea r15, [rbx + rsi]
cmp rdx, qword [rsp + 0x70]
jne 0x1400b603d
mov rcx, r14
call fcn.140051e03
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov qword [rax + rdx*8], r15
mov rdx, qword [rsp + 0x78]
inc rdx
mov qword [rsp + 0x78], rdx
mov ecx, dword [r15]
add rsi, rcx
test rcx, rcx
jne 0x1400b6020
lea rsi, [rdi + 0x40]
mov qword [rsp + 0xe0], rsi
test bpl, bpl
mov qword [rsp + 0xc0], r12
je 0x1400b6089
lea rcx, [rdi + 0x110]
xor edx, edx
call fcn.1400b6790
mov rax, qword [rdi + 0x190]
jmp 0x1400b608b
xor eax, eax
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0xe8]
mov qword [rcx], rax
mov r13, qword [rsp + 0x78]
mov qword [rsp + 0x100], r13
movdqu xmm0, xmmword [rsp + 0x68]
movdqa xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x50], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x118], rcx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x120], rax
mov r12, qword [rsp + 0xf8]
cmp r12, r13
jb 0x1400b65e2
lea rsi, [rsp + 0x108]
mov rbp, qword [rsi - 0x18]
mov rcx, r13
call fcn.1400b4981
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], 1
lea r15, [rsp + 0x248]
mov rcx, r15
mov rdx, r13
xor r8d, r8d
mov r9, rax
call fcn.1400b06c8
test r12, r12
je 0x1400b616e
shl r12, 3
mov edx, 8
mov rcx, rbp
mov r8, r12
call fcn.14000a512
mov rax, qword [rsp + 0x258]
xor edx, edx
sub rax, 1
jb 0x1400b6190
mov r15, qword [r15]
test r15, r15
je 0x1400b6190
add rdx, qword [r15 + 0x10]
add r15, 0x18
jmp 0x1400b6178
lea rcx, [rsp + 0x50]
call fcn.1400b4c29
mov rax, qword [rsp + 0x258]
lea r15, [rsp + 0x2d0]
mov qword [r15 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x248]
movdqa xmmword [r15], xmm0
lea rsi, [rsp + 0xf8]
lea r12, [rsp + 0xf0]
mov rcx, r15
call fcn.1400b3fdf
test rax, rax
je 0x1400b6263
mov r13, qword [rax]
movdqu xmm0, xmmword [rax + 8]
movdqa xmmword [rsp + 0x80], xmm0
mov rcx, rax
call fcn.140005ed0
test r13, r13
je 0x1400b6263
mov qword [rsp + 0xf0], r13
movdqa xmm0, xmmword [rsp + 0x80]
movdqu xmmword [rsi], xmm0
mov rbp, qword [rsp + 0x100]
lea rcx, [rsp + 0x50]
mov rdx, rbp
call fcn.1400b4c29
mov r14, qword [rsp + 0x60]
imul rcx, r14, 0x150
add rcx, qword [rsp + 0x50]
imul r8, rbp, 0x150
mov rdx, r13
call fcn.1400ffbc0
add r14, rbp
mov qword [rsp + 0x60], r14
and qword [rsp + 0x100], 0
mov rcx, r12
call fcn.1400b04d2
jmp 0x1400b61cc
mov qword [rsp + 0xa0], rbx
lea rcx, [rsp + 0x2d0]
call fcn.1400b1f30
mov r12, qword [rsp + 0x50]
imul rcx, qword [rsp + 0x60], 0x150
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xb0], rax
lea rax, [r12 + rcx]
mov qword [rsp + 0xa8], rax
lea rax, [rdi + 0x60]
mov qword [rsp + 0x98], rax
lea rbp, [rsp + 0x248]
lea rbx, [rsp + 0xf0]
mov qword [rsp + 0xb8], r12
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0xc8], rdi
test rcx, rcx
je 0x1400b64e8
mov r14, qword [r12]
cmp r14, 2
je 0x1400b64e1
mov qword [rsp + 0xd0], rcx
lea r13, [r12 + 0xc8]
mov r15, qword [r12 + 0xc0]
lea rdx, [r12 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x2d0]
call fcn.1400ffbc0
mov r8d, 0x88
mov rcx, rbp
mov rdx, r13
call fcn.1400ffbc0
mov qword [rsp + 0x80], r15
mov rcx, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov r8, r15
call fcn.1400b339d
mov r13, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x50], rax
cmp qword [rdi + 0x50], 0
je 0x1400b64cc
lea rax, [rsp + 0x50]
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rsi
mov rcx, qword [rdi + 0x40]
mov rdx, qword [rdi + 0x48]
lea rax, [0x1400b5572]
mov qword [rsp + 0x20], rax
mov r8, r13
mov r9, rbx
call fcn.1400b540d
mov rbp, rdx
test rax, rax
je 0x1400b641b
mov rdi, qword [rsp + 0x80]
mov rax, qword [rsi]
mov r8b, byte [rax + rbp]
mov rcx, rsi
mov rdx, rbp
mov r9, r13
call fcn.1400b5549
mov rsi, qword [rsi]
neg rbp
imul rbp, rbp, 0x158
lea r13, [rsi + rbp]
add r13, 0xfffffffffffffeb8
mov qword [r13 - 0x10], rdi
mov qword [r13 - 8], r14
mov r8d, 0xb8
mov rcx, r13
lea rdx, [rsp + 0x2d0]
call fcn.1400ffbc0
mov qword [r13 + 0xb8], r15
lea rcx, [rsi + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
lea rbp, [rsp + 0x248]
mov rdx, rbp
call fcn.1400ffbc0
jmp 0x1400b64a4
mov rsi, qword [rsi]
neg rbp
imul rdi, rbp, 0x158
lea r13, [rsi + rdi]
add r13, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, rbx
mov rdx, r13
call fcn.1400ffbc0
mov qword [r13], r14
lea r13, [rsi + rdi]
add r13, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r13
lea rdx, [rsp + 0x2d0]
call fcn.1400ffbc0
mov qword [r13 + 0xb8], r15
lea rcx, [rsi + rdi]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
lea rbp, [rsp + 0x248]
mov rdx, rbp
call fcn.1400ffbc0
cmp qword [rsp + 0xf0], 2
je 0x1400b64a4
mov rcx, rbx
call fcn.1400b053d
add r12, 0x150
mov rcx, qword [rsp + 0xd0]
add rcx, 0xfffffffffffffeb0
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0x48]
jmp 0x1400b62d0
mov rcx, rsi
mov rdx, qword [rsp + 0x98]
call fcn.140112c55
jmp 0x1400b635b
add r12, 0x150
mov rax, qword [rsp + 0xa8]
sub rax, r12
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r12
mov rdx, rax
call fcn.1400b0513
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
call fcn.1400b04fc
mov rax, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x48]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rdi + 0x58]
lea rsi, [rsp + 0xf0]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov r14d, 0x158
mov rdi, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xa0]
mov rcx, rsi
call fcn.1400b51ff
test rax, rax
je 0x1400b65b1
mov r15, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x1400b656e
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
sub rax, r15
cqo
idiv r14
mov rdx, rax
call fcn.1400b561d
add r15, 0xfffffffffffffeb0
mov rcx, r15
call fcn.1400b053d
jmp 0x1400b656e
mov rcx, rbx
mov rdx, rdi
call fcn.1400c2022
nop
add rsp, 0x388
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0xfa0
call fcn.14010e7f0
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:UsersAdministrator.WIN7_2021OVWRCZ.cargo_registry_src_rsproxy.cn_0dccff568467c15b_rayon_1.9.0_src_vec.rs
lea r8, [0x14013e130]
mov edx, 0x2f
call fcn.14010ebd0
ud2