Function at 0x14013afd0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x358
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2d0], 0xfffffffffffffffe
mov r14, rcx
mov byte [rbp + 0x2c8], dl
mov byte [rbp + 0x2c9], r8b
call fcn.140161ef0
mov dword [rbp - 0x58], eax
mov dword [rbp - 0x54], edx
lea rcx, [rbp + 0xe0]
lea rdx, [rbp - 0x58]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140161f20
cmp qword [rbp + 0xe0], 0
je 0x14013b03b
xor eax, eax
jmp 0x14013b042
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x250], rax
mov edi, 0x80000
lea rsi, [rbp + 0x2b4]
mov rbx, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jmp 0x14013b079
mov edi, 0
test rdx, rdx
je 0x14013b079
lea rdi, [rdx + rdx]
mov r8d, 1
call fcn.14000e8c0
mov eax, 1
test rdi, rdi
je 0x14013b09f
js 0x14013b4af
mov edx, 1
mov rcx, rdi
call fcn.14000e8b0
test rax, rax
je 0x14013b4b6
mov dword [rbp + 0x2b4], 0
mov ecx, 5
mov qword [rbp + 0x2b8], rax
mov rdx, rax
mov qword [rbp + 0x290], rdi
mov r8d, edi
mov r9, rsi
call rbx
cmp eax, 0xc0000004
jne 0x14013b0fe
mov edi, dword [rbp + 0x2b4]
test edi, edi
mov rdx, qword [rbp + 0x290]
mov rcx, qword [rbp + 0x2b8]
je 0x14013b060
add edi, 0x2800
test rdx, rdx
jne 0x14013b06e
jmp 0x14013b079
mov ecx, 0xfa0
mov edx, 8
call fcn.14000e8b0
test rax, rax
mov rdi, qword [rbp + 0x2b8]
je 0x14013b4c5
mov qword [rbp + 0x298], 0x1f4
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], 0
xor edx, edx
lea rsi, [rbp + 0x298]
xor ebx, ebx
jmp 0x14013b17a
lea rax, [rdi + rbx]
mov rcx, qword [rbp + 0x2a0]
mov qword [rcx + rdx*8], rax
mov rdx, qword [rbp + 0x2a8]
inc rdx
mov qword [rbp + 0x2a8], rdx
mov eax, dword [rax]
add rbx, rax
test rax, rax
je 0x14013b1a2
cmp rdx, qword [rbp + 0x298]
jne 0x14013b150
mov byte [rbp + 0x2cf], 1
mov rcx, rsi
call fcn.140069530
mov rdx, qword [rbp + 0x2a8]
mov rdi, qword [rbp + 0x2b8]
jmp 0x14013b150
lea r13, [r14 + 0x40]
mov qword [rbp + 0x248], r13
cmp byte [rbp + 0x2c8], 0
je 0x14013b1d2
lea rcx, [r14 + 0xc8]
mov byte [rbp + 0x2cf], 1
call fcn.1401376e0
mov rax, qword [r14 + 0x148]
jmp 0x14013b1d4
xor eax, eax
mov qword [rbp + 0x240], rax
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x278], 8
mov qword [rbp + 0x280], 0
lea rax, [rbp + 0x248]
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x2c8]
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x240]
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x250]
mov qword [rbp + 0xf8], rax
movups xmm0, xmmword [rbp + 0x298]
movups xmmword [rbp + 0x100], xmm0
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x270]
lea rdx, [rbp + 0xe0]
call fcn.1401439b0
mov rcx, qword [rbp + 0x270]
mov rbx, qword [rbp + 0x278]
mov rax, qword [rbp + 0x280]
imul r14, rax, 0x138
lea rdx, [rbx + r14]
mov qword [rbp + 0x260], rcx
mov qword [rbp + 0x220], rcx
mov qword [rbp + 0x228], rbx
mov qword [rbp + 0x2c0], rdx
mov qword [rbp + 0x230], rdx
mov qword [rbp + 0x238], rbx
mov qword [rbp + 0x288], rbx
test rax, rax
je 0x14013b3d1
mov rax, qword [rbp + 0x288]
add rax, 0x138
lea r15, [rbp - 0x58]
lea r12, [rbp + 0xe0]
jmp 0x14013b2f4
lea rax, [rbx + 0x138]
add r14, 0xfffffffffffffec8
je 0x14013b3d1
mov rbx, rax
mov qword [rbp + 0x228], rax
mov rax, qword [rax - 0xb8]
cmp rax, 2
je 0x14013b3d1
lea rcx, [rbx - 0x138]
lea rdx, [rbx - 0xa0]
mov rdi, qword [rbx - 0xb0]
mov rsi, qword [rbx - 0xa8]
movups xmm0, xmmword [rcx + 0x70]
movaps xmmword [rbp + 0x150], xmm0
movups xmm0, xmmword [rcx + 0x60]
movaps xmmword [rbp + 0x140], xmm0
movups xmm0, xmmword [rcx + 0x50]
movaps xmmword [rbp + 0x130], xmm0
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rbp + 0x120], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rbp + 0x110], xmm3
movaps xmmword [rbp + 0x100], xmm2
movaps xmmword [rbp + 0xf0], xmm1
movaps xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], rdi
mov qword [rbp + 0x170], rsi
mov r8d, 0xa0
lea rcx, [rbp + 0x178]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
mov rdx, r13
mov r8, rsi
mov r9, r12
call fcn.14013f5f0
cmp dword [rbp + 0x28], 2
je 0x14013b2e0
mov rcx, r15
call fcn.140139840
jmp 0x14013b2e0
mov rax, qword [rbp + 0x2c0]
sub rax, rbx
mov qword [rbp + 0x2c0], rax
shr rax, 3
movabs rcx, 0xd20d20d20d20d21
mul rcx
shr rdx, 1
imul rax, rdx, 0x138
add rax, rbx
mov qword [rbp + 0x268], rax
nop word [rax + rax]
mov rax, qword [rbp + 0x2c0]
test rax, rax
je 0x14013b444
lea rsi, [rbx + 0x138]
add rax, 0xfffffffffffffec8
mov qword [rbp + 0x2c0], rax
mov rcx, rbx
mov qword [rbp + 0x258], rsi
call fcn.14013ce70
mov rbx, rsi
jmp 0x14013b410
mov rax, qword [rbp + 0x260]
test rax, rax
je 0x14013b469
imul rdx, rax, 0x138
mov r8d, 8
mov rcx, qword [rbp + 0x288]
call fcn.14000e8c0
mov byte [rbp + 0x2cf], 0
mov rcx, r13
call fcn.14013fb10
mov rdx, qword [rbp + 0x290]
test rdx, rdx
je 0x14013b49a
mov r8, rdx
not r8
shr r8, 0x3f
mov rcx, qword [rbp + 0x2b8]
call fcn.14000e8c0
nop
add rsp, 0x358
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140173890
ud2
mov edx, 1
mov rcx, rdi
call fcn.14018fcb0
ud2
mov ecx, 0xfa0
mov edx, 8
call fcn.14018fcb0
ud2