Function at 0x14000c3f0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Read file via mapping

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
xor esi, esi
mov eax, 0x410
cmp dword [0x140079f08], 6
mov r12d, 0x1010
cmovb r12d, eax
cmp qword [0x140079b18], rsi
jne 0x14000cad7
mov rcx, qword [0x140079b30]
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov dword [rbp + 0x6f], 0xc0000225
test rcx, rcx
je 0x14000c47a
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], esi
lea r13d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x14000c554
lea rdx, str.lsass.exe
mov r13d, 1
lea rcx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov ebx, 0x1000
nop word [rax + rax]
mov edx, ebx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x14000ca36
lea r9, [rbp + 0x67]
mov r8d, ebx
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, eax
test eax, eax
jns 0x14000c4de
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
add ebx, ebx
cmp r14d, 0xc0000004
je 0x14000c4a0
test r14d, r14d
js 0x14000ca36
mov rbx, rdi
nop word [rax + rax]
lea rcx, [rbx + 0x38]
movzx r8d, r13b
lea rdx, [rbp - 9]
call qword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
movzx r15d, al
test al, al
jne 0x14000c52a
mov eax, dword [rbx]
test eax, eax
je 0x14000c525
add rbx, rax
jmp 0x14000c500
mov ebx, dword [rbp + 0x67]
jmp 0x14000c52d
mov ebx, dword [rbx + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14d, r14d
cmovs r15d, esi
test r15d, r15d
je 0x14000ca36
mov r8d, ebx
xor edx, edx
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000ca36
mov edx, 0x10
mov r14d, esi
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x140079b18], rax
test rax, rax
je 0x14000ca2d
mov dword [rax], r13d
mov edx, r13d
test r13d, r13d
je 0x14000c5d1
sub edx, 1
je 0x14000c5a9
sub edx, 1
je 0x14000c615
sub edx, 1
je 0x14000c5a9
cmp edx, 3
jne 0x14000c6ee
mov edx, 8
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, rax
mov rax, qword [0x140079b18]
mov qword [rax + 8], rcx
test rcx, rcx
je 0x14000c6ee
mov qword [rcx], rdi
mov eax, dword [0x140079f08]
mov dword [0x140079b20], eax
mov eax, dword [0x14007a088]
mov dword [0x140079b24], eax
mov eax, dword [0x140079f0c]
mov dword [0x140079b28], eax
cmp dword [0x140079b20], 6
jae 0x14000c7d4
mov rcx, qword [0x140061d30]
lea rax, [0x140061d30]
jmp 0x14000c7e2
mov edx, 8
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov rax, qword [0x140079b18]
mov qword [rax + 8], rbx
test rbx, rbx
je 0x14000c6ee
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbx], rax
test rax, rax
je 0x14000c6e9
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x20], esi
mov rcx, rdi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov rax, qword [rbx]
mov qword [rax], rcx
mov rax, qword [rbx]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000c6c9
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rax
mov rax, qword [rbx]
mov qword [rax + 8], rcx
test rcx, rcx
je 0x14000c6c9
mov rax, qword [rbx]
mov rcx, qword [rax + 8]
cmp dword [rcx], 0x504d444d
jne 0x14000c6c9
mov eax, 0xa793
cmp word [rcx + 4], ax
jne 0x14000c6c9
mov r14d, 1
jmp 0x14000c6e9
mov rbx, qword [rbx]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000c6db
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000c6e9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
jne 0x14000c704
mov rcx, qword [0x140079b18]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14d, r14d
je 0x14000ca2d
cmp r13d, 2
jne 0x14000c5d1
mov r11, qword [0x140079b18]
mov rax, qword [r11 + 8]
mov rcx, qword [rax]
mov eax, esi
mov r10, qword [rcx + 8]
mov r9d, dword [r10 + 0xc]
mov edx, dword [r10 + 8]
add r9, r10
test edx, edx
je 0x14000c743
mov rcx, r9
cmp dword [rcx], 7
je 0x14000c77b
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x14000c734
mov ebx, 1
mov rax, qword [r11 + 8]
mov rcx, qword [rax]
mov eax, esi
mov r9, qword [rcx + 8]
mov r8d, dword [r9 + 0xc]
mov edx, dword [r9 + 8]
add r8, r9
test edx, edx
je 0x14000c7c7
mov rcx, r8
cmp dword [rcx], 0x1337
je 0x14000c7af
inc eax
add rcx, 0xc
cmp eax, edx
jb 0x14000c767
jmp 0x14000c7c7
lea rcx, [rax + rax*2]
mov edx, dword [r9 + rcx*4 + 8]
add rdx, r10
je 0x14000c743
mov eax, dword [rdx + 8]
mov ebx, esi
mov dword [0x140079b20], eax
mov eax, dword [rdx + 0xc]
mov dword [0x140079b24], eax
mov eax, dword [rdx + 0x10]
mov dword [0x140079b28], eax
cmp word [rdx], 9
setne bl
jmp 0x14000c748
lea rcx, [rax + rax*2]
mov edx, dword [r8 + rcx*4 + 4]
mov ecx, dword [r8 + rcx*4 + 8]
add rcx, r9
je 0x14000c7c7
call fcn.14001f910
test ebx, ebx
jne 0x14000ca2d
jmp 0x14000c5f5
mov rcx, qword [0x140061d58]
lea rax, [0x140061d58]
mov qword [0x140079b10], rax
call rcx
test eax, eax
js 0x14000ca2d
mov ecx, dword [0x140079b28]
mov eax, esi
cmp ecx, 0x1f40
setae al
cmp dword [0x140079b20], 6
mov dword [0x140079f90], eax
jae 0x14000c822
cmp dword [0x140079b24], 2
mov dword [0x14007a050], esi
jae 0x14000c82c
mov dword [0x14007a050], 1
cmp ecx, 0x47bb
lea rdx, [0x14000caf0]
mov rcx, qword [0x140079b18]
mov eax, esi
setae al
xor r8d, r8d
mov dword [0x14007a110], eax
call fcn.140008830
test eax, eax
js 0x14000ca2d
cmp dword [0x140078820], esi
je 0x14000ca2d
mov rax, qword [0x140079b18]
lea rcx, [0x140079b48]
movaps xmm2, xmmword [0x140078810]
lea r14, [0x140079b58]
movaps xmm1, xmmword [0x140078800]
mov rbx, rsi
mov edx, dword [0x140079b28]
mov r8, rsi
movsd xmm0, qword [0x140078820]
cmp edx, 0xece
mov qword [rbp - 0x11], rcx
movd ecx, xmm2
cmovb r14, rsi
mov qword [rbp - 1], rax
mov qword [rbp + 0xf], rax
lea rax, [0x140077c90]
mov qword [rbp + 0x17], rcx
movups xmmword [0x140079ee0], xmm1
mov qword [rbp - 9], rsi
movups xmmword [0x140079ef0], xmm2
mov qword [rbp - 0x19], rsi
movsd qword [0x140079f00], xmm0
movq qword [rbp + 7], xmm1
mov qword [rbp + 0x1f], rsi
nop word [rax + rax]
cmp dword [rax - 0x50], edx
ja 0x14000c94c
lea rbx, [rax - 0x50]
cmp dword [rax], edx
ja 0x14000c94c
mov rbx, rax
cmp dword [rax + 0x50], edx
ja 0x14000c94c
lea rbx, [rax + 0x50]
cmp dword [rax + 0xa0], edx
ja 0x14000c94c
lea rbx, [rax + 0xa0]
cmp dword [rax + 0xf0], edx
ja 0x14000c94c
lea rbx, [rax + 0xf0]
cmp dword [rax + 0x140], edx
ja 0x14000c94c
lea rbx, [rax + 0x140]
add r8, 0x1e0
add rax, 0x1e0
cmp r8, 0x3c0
jb 0x14000c8f0
test rbx, rbx
je 0x14000ca04
mov rax, qword [rbx + 0x10]
lea r8, [rbp + 7]
mov edx, dword [rbx + 8]
lea rcx, [rbp - 0x19]
mov qword [rbp - 0x19], rax
call fcn.140014270
test eax, eax
je 0x14000ca04
movsxd rax, dword [rbx + 0x28]
lea rdx, [rbp - 9]
add rax, qword [rbp + 0x1f]
lea rcx, [rbp - 0x19]
mov qword [rbp - 9], rax
mov r8d, 4
lea rax, [rbp + 0x67]
mov qword [rbp - 0x19], rax
call fcn.140013e60
mov dword [0x140078824], eax
mov edx, eax
test eax, eax
je 0x14000c9bb
movsxd rcx, dword [rbp + 0x67]
add rcx, 4
add rcx, qword [rbp - 9]
mov qword [0x140079b60], rcx
test r14, r14
je 0x14000ca0a
movsxd rax, dword [rbx + 0x2c]
lea rdx, [rbp - 9]
add rax, qword [rbp + 0x1f]
lea rcx, [rbp - 0x19]
mov qword [rbp - 9], rax
mov r8d, 4
lea rax, [rbp + 0x67]
mov qword [rbp - 0x19], rax
call fcn.140013e60
mov dword [0x140078824], eax
mov edx, eax
test eax, eax
je 0x14000ca0a
movsxd rcx, dword [rbp + 0x67]
add rcx, 4
add rcx, qword [rbp - 9]
mov qword [r14], rcx
jmp 0x14000ca0a
mov edx, dword [0x140078824]
test edx, edx
je 0x14000ca2d
mov rax, qword [0x140079b10]
lea rdx, [0x140078800]
lea rcx, [0x140079b18]
call qword [rax + 0x10]
mov dword [rbp + 0x6f], eax
test eax, eax
jns 0x14000caa3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [0x140079b18]
test rbx, rbx
je 0x14000ca99
mov ecx, dword [rbx]
sub ecx, 1
je 0x14000ca83
sub ecx, 1
je 0x14000ca5a
sub ecx, 1
je 0x14000ca83
cmp ecx, 3
jne 0x14000ca8d
jmp 0x14000ca83
mov rax, qword [rbx + 8]
test rax, rax
je 0x14000ca8d
mov rdi, qword [rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14000ca75
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000ca83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, rax
mov eax, dword [rbp + 0x6f]
mov qword [0x140079b18], rsi
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xd0]
mov r15, qword [rsp + 0x80]
add rsp, 0xa0
pop r12
pop rsi
pop rbp
ret
mov eax, esi
add rsp, 0xa0
pop r12
pop rsi
pop rbp
ret