Function at 0x1400589c0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x8e0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x858], 0xfffffffffffffffe
mov qword [rbp + 0x18], rcx
mov ax, dx
mov word [rbp + 0x24], ax
shr edx, 0x10
mov al, dl
mov byte [rbp + 0x26], al
mov ax, word [rbp + 0x24]
mov word [rbp + 0x21], ax
mov al, byte [rbp + 0x26]
mov byte [rbp + 0x23], al
mov qword [rbp + 0x828], rcx
mov byte [rbp + 0x827], 0
mov byte [rbp + 0x826], 0
mov qword [rbp + 0x28], 0x80000
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.14006c110
mov dword [rbp + 0x4c], 0
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.14009f8c0
jmp 0x140058a3c
lea rcx, [rbp + 0x30]
call fcn.14006c3d0
mov qword [rbp + 0x10], rax
jmp 0x140058a4b
mov rdx, qword [rbp + 0x10]
mov r8d, dword [rbp + 0x28]
mov rax, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ecx, 5
lea r9, [rbp + 0x4c]
call rax
mov dword [rbp + 0xc], eax
jmp 0x140058a6a
mov eax, dword [rbp + 0xc]
mov dword [rbp + 0x834], eax
cmp eax, 0
je 0x140058a84
mov eax, dword [rbp + 0xc]
cmp eax, 0xc0000004
je 0x140058a9e
jmp 0x140058a93
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x30]
call fcn.14006df50
jmp 0x140058b11
lea rcx, [rbp + 0x30]
call fcn.1400a2cb0
jmp 0x140058aa6
cmp dword [rbp + 0x4c], 0
je 0x140058aaf
jmp 0x140058ac6
add rsp, 0x8e0
pop rbp
ret
mov rax, qword [rbp + 0x28]
mov ecx, 2
mul rcx
mov qword [rbp], rax
seto al
jo 0x140058ae5
jmp 0x140058ad8
mov eax, dword [rbp + 0x4c]
add eax, 0x2800
mov dword [rbp - 4], eax
setb al
jb 0x140058b03
jmp 0x140058af5
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
jmp 0x140058a26
lea rcx, [0x140128df0]
call fcn.1400eb7a0
jmp 0x140058af3
ud2
mov eax, dword [rbp - 4]
mov eax, eax
mov qword [rbp + 0x28], rax
jmp 0x140058a26
lea rcx, [0x140128e08]
call fcn.1400eb720
jmp 0x140058af3
lea rcx, [rbp + 0x50]
mov edx, 0x1f4
call fcn.14006c090
jmp 0x140058b21
mov byte [rbp + 0x827], 1
mov qword [rbp + 0x68], 0
lea rcx, [rbp + 0x30]
call fcn.14006dce0
mov qword [rbp - 0x10], rax
jmp 0x140058b3f
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x840], rdx
mov qword [rbp + 0x848], rax
add rdx, rax
mov qword [rbp - 0x18], rdx
mov qword [rbp + 0x838], rdx
lea rcx, [rbp + 0x50]
call fcn.14006d840
jmp 0x140058b6e
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x70]
call fcn.1400806b0
jmp 0x140058b7d
cmp dword [rbp + 0x70], 0
jne 0x140058ba9
mov rax, qword [rbp + 0x18]
add rax, 0xd8
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x1c0], rax
lea rcx, [rbp + 0x21]
call fcn.140054ad0
mov byte [rbp - 0x19], al
jmp 0x140058bc2
mov eax, dword [rbp + 0x70]
add rax, qword [rbp + 0x68]
mov qword [rbp - 0x28], rax
seto al
jo 0x140058e05
jmp 0x140058df8
mov al, byte [rbp - 0x19]
test al, 1
jne 0x140058bd8
jmp 0x140058bcb
mov qword [rbp + 0x1c8], 0
jmp 0x140058be7
mov rcx, qword [rbp + 0x18]
call fcn.140084490
mov qword [rbp - 0x30], rax
jmp 0x140058bf2
call fcn.140087590
mov qword [rbp - 0x38], rax
jmp 0x140058bff
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x1c8], rax
jmp 0x140058be7
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x1d0], rax
mov byte [rbp + 0x827], 0
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x250], rax
movups xmm0, xmmword [rbp + 0x50]
movaps xmmword [rbp + 0x240], xmm0
lea rcx, [rbp + 0x228]
lea rdx, [rbp + 0x240]
call fcn.140054110
jmp 0x140058c3c
lea rax, [rbp + 0x1c0]
mov qword [rbp + 0x260], rax
lea rax, [rbp + 0x21]
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0x1c8]
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x278], rax
lea rcx, [rbp + 0x1f0]
lea rdx, [rbp + 0x228]
lea r8, [rbp + 0x260]
call fcn.140072610
jmp 0x140058c8d
lea rcx, [rbp + 0x1d8]
lea rdx, [rbp + 0x1f0]
call fcn.14008c030
jmp 0x140058ca2
lea rcx, [rbp + 0x2a0]
lea rdx, [rbp + 0x1d8]
call fcn.14006f640
jmp 0x140058cb7
lea rcx, [rbp + 0x280]
lea rdx, [rbp + 0x2a0]
call fcn.1400772f0
jmp 0x140058ccc
mov rax, qword [rbp + 0x280]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x298]
mov qword [rbp + 0x2d8], rax
lea rcx, [rbp + 0x2e0]
lea rdx, [rbp + 0x2c0]
call fcn.140076000
jmp 0x140058d19
cmp qword [rbp + 0x2e0], 2
sete al
test al, 1
jne 0x140058d2a
jmp 0x140058d38
lea rcx, [rbp + 0x2c0]
call fcn.140062f90
jmp 0x140058d79
mov byte [rbp + 0x826], 1
lea rcx, [rbp + 0x430]
mov qword [rbp - 0x50], rcx
lea rdx, [rbp + 0x2e0]
mov r8d, 0x150
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp - 0x50]
mov rax, qword [rbp + 0x18]
add rax, 0xd8
mov qword [rbp - 0x48], rax
call fcn.14005c440
mov qword [rbp - 0x40], rax
jmp 0x140058da0
mov rcx, qword [rbp + 0x18]
add rcx, 0xd8
call fcn.14005a040
jmp 0x140058d8b
mov byte [rbp + 0x827], 0
lea rcx, [rbp + 0x30]
call fcn.1400a2cb0
jmp 0x140058aa6
mov byte [rbp + 0x826], 0
lea rcx, [rbp + 0x6d0]
mov qword [rbp - 0x58], rcx
lea rdx, [rbp + 0x430]
mov r8d, 0x150
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
mov r9, qword [rbp - 0x58]
lea rcx, [rbp + 0x580]
call fcn.14005a010
jmp 0x140058dde
lea rcx, [rbp + 0x580]
call fcn.140062b10
jmp 0x140058dec
mov byte [rbp + 0x826], 0
jmp 0x140058d04
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x68], rax
jmp 0x140058b30
lea rcx, [0x140128e20]
call fcn.1400eb720
jmp 0x140058af3