Function at 0x1400096c0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x388
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x300], 0xfffffffffffffffe
mov ebx, edx
mov rdi, rcx
mov word [rbp + 0x2f8], bx
mov eax, edx
shr eax, 0x10
mov byte [rbp + 0x2fa], al
call fcn.140019e70
mov dword [rbp - 0x60], eax
mov dword [rbp - 0x5c], edx
lea rcx, [rbp + 0xf0]
lea rdx, [rbp - 0x60]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140019ea0
cmp qword [rbp + 0xf0], 0
je 0x140009732
xor eax, eax
jmp 0x140009739
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x290], rax
mov r15d, 0x80000
lea rsi, [rbp + 0x2ec]
mov r14, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jmp 0x14000977a
mov r15d, 0
test rdx, rdx
je 0x14000977a
lea r15, [rdx + rdx]
mov r8d, 1
call fcn.140003730
mov eax, 1
test r15, r15
je 0x1400097a0
js 0x140009bb5
mov edx, 1
mov rcx, r15
call fcn.140003720
test rax, rax
je 0x140009ba6
mov dword [rbp + 0x2ec], 0
mov ecx, 5
mov qword [rbp + 0x2f0], rax
mov rdx, rax
mov qword [rbp + 0x2c0], r15
mov r8d, r15d
mov r9, rsi
call r14
cmp eax, 0xc0000004
jne 0x140009803
mov r15d, dword [rbp + 0x2ec]
test r15d, r15d
mov rdx, qword [rbp + 0x2c0]
mov rcx, qword [rbp + 0x2f0]
je 0x140009760
add r15d, 0x2800
test rdx, rdx
jne 0x14000976f
jmp 0x14000977a
mov ecx, 0xfa0
mov edx, 8
call fcn.140003720
test rax, rax
mov r8, qword [rbp + 0x2f0]
je 0x140009bbc
mov qword [rbp + 0x2d0], 0x1f4
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2e0], 0
xor edx, edx
lea rsi, [rbp + 0x2d0]
xor r14d, r14d
jmp 0x14000987a
lea rax, [r8 + r14]
mov rcx, qword [rbp + 0x2d8]
mov qword [rcx + rdx*8], rax
mov rdx, qword [rbp + 0x2e0]
inc rdx
mov qword [rbp + 0x2e0], rdx
mov eax, dword [rax]
add r14, rax
test rax, rax
je 0x1400098a2
cmp rdx, qword [rbp + 0x2d0]
jne 0x140009850
mov byte [rbp + 0x2ff], 1
mov rcx, rsi
call fcn.14000d3f0
mov rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
jmp 0x140009850
lea rax, [rdi + 0x40]
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x288], rax
test bl, bl
je 0x1400098e0
lea rcx, [rdi + 0xa0]
mov byte [rbp + 0x2ff], 1
xor edx, edx
xor r8d, r8d
call fcn.140006840
mov rax, qword [rdi + 0x120]
mov rdx, qword [rbp + 0x2e0]
jmp 0x1400098e2
xor eax, eax
mov qword [rbp + 0x280], rax
mov rax, qword [rbp + 0x2d0]
mov rcx, qword [rbp + 0x2d8]
lea rdx, [rcx + rdx*8]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rcx
mov qword [rbp + 0x100], rdx
mov qword [rbp + 0x108], rcx
lea rax, [rbp + 0x288]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x2f8]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x280]
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x290]
mov qword [rbp + 0x128], rax
mov byte [rbp + 0x2ff], 0
lea rcx, [rbp + 0x248]
lea rdx, [rbp + 0xf0]
call fcn.1400100d0
mov rdx, qword [rbp + 0x248]
mov rcx, qword [rbp + 0x250]
mov rax, qword [rbp + 0x258]
imul rdi, rax, 0x150
lea rbx, [rcx + rdi]
mov qword [rbp + 0x298], rdx
mov qword [rbp + 0x260], rdx
mov qword [rbp + 0x268], rcx
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x278], rcx
mov qword [rbp + 0x2b8], rcx
mov r8, rcx
test rax, rax
je 0x140009adf
mov rax, qword [rbp + 0x2b8]
add rax, 0x150
lea r15, [rbp - 0x60]
jmp 0x1400099f7
mov r8, rsi
lea rax, [rsi + 0x150]
add rdi, 0xfffffffffffffeb0
je 0x140009adf
mov r8, rax
mov qword [rbp + 0x268], rax
mov r14, qword [rax - 0xd0]
cmp r14, 2
je 0x140009adf
lea rax, [r8 - 0x150]
lea rdx, [r8 - 0xb8]
mov r12, qword [r8 - 0xc8]
mov rsi, r8
mov r13, qword [r8 - 0xc0]
movups xmm0, xmmword [rax + 0x70]
movaps xmmword [rbp + 0x160], xmm0
movups xmm0, xmmword [rax + 0x60]
movaps xmmword [rbp + 0x150], xmm0
movups xmm0, xmmword [rax + 0x50]
movaps xmmword [rbp + 0x140], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x120], xmm3
movaps xmmword [rbp + 0x110], xmm2
movaps xmmword [rbp + 0x100], xmm1
movaps xmmword [rbp + 0xf0], xmm0
mov r8d, 0xb8
lea rcx, [rbp + 0x188]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], r13
mov rcx, r15
mov rdx, qword [rbp + 0x2b0]
mov r8, r13
lea r9, [rbp + 0xf0]
call fcn.14000f0e0
cmp dword [rbp + 0x20], 2
je 0x1400099e0
mov rcx, r15
call fcn.140007ee0
jmp 0x1400099e0
sub rbx, r8
shr rbx, 4
movabs rcx, 0xc30c30c30c30c31
mov rax, rbx
mul rcx
mov qword [rbp + 0x2a8], rdx
xor eax, eax
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2a0], r8
mov rcx, r8
mov rax, qword [rbp + 0x2c8]
cmp qword [rbp + 0x2a8], rax
je 0x140009b3b
inc rax
mov qword [rbp + 0x2c8], rax
lea rdi, [rcx + 0x150]
call fcn.140007ee0
mov rcx, rdi
jmp 0x140009b10
mov rax, qword [rbp + 0x298]
test rax, rax
je 0x140009b60
imul rdx, rax, 0x150
mov r8d, 8
mov rcx, qword [rbp + 0x2b8]
call fcn.140003730
mov byte [rbp + 0x2ff], 0
mov rcx, qword [rbp + 0x2b0]
call fcn.14000f4f0
mov rdx, qword [rbp + 0x2c0]
test rdx, rdx
je 0x140009b91
mov r8d, 1
mov rcx, qword [rbp + 0x2f0]
call fcn.140003730
nop
add rsp, 0x388
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edx, 1
mov rcx, r15
call fcn.140031ba0
ud2
call fcn.140028340
ud2
mov ecx, 0xfa0
mov edx, 8
call fcn.140031ba0
ud2