Function at 0x14011d9a0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x368
mov qword [rsp + 0x88], r9
mov r14, r8
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x80], rcx
movzx eax, byte [0x140230ff1]
mov r15d, 0x80000
mov ecx, 0x80000
mov edx, 1
call fcn.140001410
test rax, rax
je 0x14011de8e
mov rsi, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x80000
mov qword [rsp + 0x58], 0
lea r12, [rsp + 0xc8]
xor edx, edx
lea rbp, [rsp + 0x60]
mov rbx, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea r13, [rsp + 0x210]
mov edi, 0x80000
jmp 0x14011da3a
mov r15, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x60], 0
sub r15, rdx
cmp r15, rdi
jb 0x14011daea
mov ecx, 5
mov rdx, rsi
mov r8d, edi
mov r9, rbp
call rbx
test eax, eax
jns 0x14011db01
or eax, 0x10000000
mov ecx, eax
call fcn.140127650
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0xd0], edx
mov qword [rsp + 0xc0], 1
mov rcx, r12
call fcn.140127640
cmp eax, 0xd0000004
jne 0x14011dc0c
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x210], rax
mov dword [rsp + 0x218], ecx
mov ecx, dword [rsp + 0x60]
mov rdx, rdi
add rdx, rdi
lea edi, [rcx + 0x2800]
test ecx, ecx
cmove rdi, rdx
test rax, rax
je 0x14011da30
mov rcx, r13
call fcn.140127940
jmp 0x14011da30
lea rcx, [rsp + 0x48]
mov r8, rdi
call fcn.14015e460
mov rsi, qword [rsp + 0x48]
jmp 0x14011da4e
mov rbx, qword [rsp + 0x28]
test rbx, rbx
lea r12, str.Processor__Total___Idle_TimeProcessor____Idle_Time
cmovne r12, rbx
cmove r14, rbx
mov qword [rsp + 0x58], rdi
movzx eax, byte [0x140230ff1]
mov ecx, 0xfa0
mov edx, 8
call fcn.140001410
test rax, rax
je 0x14011de9f
test rbx, rbx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x1f4
lea rax, [fcn.1400aa4c0]
lea rbx, [0x14011cef0]
cmove rbx, rax
mov qword [rsp + 0x40], 0
xor r13d, r13d
lea rdi, str.Processor__Total___Idle_TimeProcessor____Idle_Time
lea r15, [rsp + 0x30]
jmp 0x14011db99
mov rax, qword [rsp + 0x30]
mov qword [rax + rdx*8], rbp
inc qword [rsp + 0x40]
mov eax, dword [rbp]
add r13, rax
test rax, rax
je 0x14011dbcc
lea rbp, [rsi + r13]
mov rdx, qword [rsi + r13 + 0x50]
mov rcx, rdi
mov r8, r12
mov r9, r14
call rbx
test al, al
je 0x14011db8e
mov rdx, qword [rsp + 0x40]
cmp rdx, qword [rsp + 0x38]
jne 0x14011db80
mov rcx, r15
call fcn.14005ae50
mov rdx, qword [rsp + 0x40]
jmp 0x14011db80
mov rbx, qword [rsp + 0x80]
lea rax, [rbx + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x90], rax
mov rdi, qword [rsp + 0x88]
cmp byte [rdi], 0
je 0x14011dc45
lea rcx, [rbx + 0x90]
xor edx, edx
xor r8d, r8d
call fcn.140119540
mov rax, qword [rbx + 0x110]
jmp 0x14011dc47
mov rax, qword [rsp + 0xc8]
mov ecx, dword [rsp + 0xd0]
mov qword [rsp + 0x210], rax
mov dword [rsp + 0x218], ecx
test rax, rax
je 0x14011de61
lea rcx, [rsp + 0x210]
call fcn.140127940
jmp 0x14011de61
xor eax, eax
mov qword [rsp + 0x98], rax
call fcn.140135e90
mov dword [rsp + 0x210], eax
mov dword [rsp + 0x214], edx
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x210]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140135ec0
cmp qword [rsp + 0xc0], 0
je 0x14011dc92
xor eax, eax
jmp 0x14011dc9a
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov r9, qword [rsp + 0x40]
mov qword [rsp + 0xd0], r9
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0xc0], xmm0
lea r8, [rsp + 0xd8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rdi
lea rax, [rsp + 0x98]
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xf0], rax
movaps xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], r9
lea rdi, [rsp + 0x60]
lea rdx, [rsp + 0x210]
mov rcx, rdi
call fcn.140121d20
lea rcx, [rsp + 0xa8]
mov rdx, rdi
call fcn.140121b50
mov rbp, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
imul rdi, rcx, 0x150
add rdi, rbp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
test rcx, rcx
je 0x14011de4d
add rbp, 0x150
lea r15, [rsp + 0x210]
lea r12, [rsp + 0xc0]
jmp 0x14011ddb7
add rbp, 0x150
add r14, 0x150
cmp r14, rdi
je 0x14011de45
mov rbx, qword [rbp - 0x150]
cmp rbx, 2
je 0x14011de48
lea r14, [rbp - 0x150]
mov r13, qword [r14 + 0xc0]
lea rdx, [r14 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0xc8]
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [r14 + 0xc8]
mov r8d, 0x88
lea rcx, [rsp + 0x188]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x180], r13
mov rcx, r15
mov rdx, qword [rsp + 0x28]
mov r8, r13
mov r9, r12
call fcn.1401213c0
cmp dword [rsp + 0x210], 2
je 0x14011dda0
mov rcx, r15
call fcn.14011cf20
jmp 0x14011dda0
mov rbp, rdi
mov qword [rsp + 0x70], rbp
lea rcx, [rsp + 0x60]
call fcn.1401207f0
mov rcx, qword [rsp + 0x28]
call fcn.140121590
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14011de79
mov r8d, 1
mov rcx, rsi
call fcn.140001420
nop
add rsp, 0x368
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
mov edx, 0x80000
call fcn.1401688d0
ud2
mov ecx, 8
mov edx, 0xfa0
call fcn.1401688d0
ud2