Function at 0x14001e9d0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x398
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x310], 0xfffffffffffffffe
mov ebx, edx
mov rdi, rcx
mov word [rbp + 0x30c], bx
mov eax, edx
shr eax, 0x10
mov byte [rbp + 0x30e], al
call fcn.1401b8440
mov dword [rbp + 0x2a0], eax
mov dword [rbp + 0x2a4], edx
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x2a0]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.1401b8470
cmp qword [rbp + 0xf0], 0
je 0x14001ea4b
xor eax, eax
jmp 0x14001ea52
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x270], rax
mov r14d, 0x80000
lea rsi, [rbp + 0x2fc]
mov r15, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jmp 0x14001eaa4
mov r12, qword [rbp + 0x300]
mov rdx, r12
mov r14d, 0
mov rax, qword [rbp + 0x2e8]
test rax, rax
je 0x14001eaa4
lea r14, [rax + rax]
mov r8d, 1
mov rcx, r12
mov rdx, rax
call fcn.14001b9d0
mov rdx, r12
mov r12, r14
mov eax, 1
test r14, r14
je 0x14001eada
js 0x14001ee82
movzx eax, byte [0x1402f0f41]
mov r14d, 1
mov edx, 1
mov rcx, r12
call fcn.14001b9c0
test rax, rax
je 0x14001ee8d
mov dword [rbp + 0x2fc], 0
mov ecx, 5
mov qword [rbp + 0x300], rax
mov rdx, rax
mov qword [rbp + 0x2e8], r12
mov r8d, r12d
mov r9, rsi
call r15
cmp eax, 0xc0000004
jne 0x14001eb40
mov r14d, dword [rbp + 0x2fc]
test r14d, r14d
je 0x14001ea70
add r14d, 0x2800
mov r12, qword [rbp + 0x300]
mov rdx, r12
mov rax, qword [rbp + 0x2e8]
test rax, rax
jne 0x14001ea90
jmp 0x14001eaa4
movzx eax, byte [0x1402f0f41]
mov ecx, 0xfa0
mov edx, 8
call fcn.14001b9c0
test rax, rax
je 0x14001ee98
mov qword [rbp + 0x2c0], 0x1f4
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2d0], 0
xor r14d, r14d
lea rsi, [rbp + 0x2c0]
xor r15d, r15d
jmp 0x14001ebb9
mov rax, qword [rbp + 0x300]
add rax, r15
mov rcx, qword [rbp + 0x2c8]
mov qword [rcx + r14*8], rax
inc r14
mov qword [rbp + 0x2d0], r14
mov eax, dword [rax]
add r15, rax
test rax, rax
je 0x14001ebd3
cmp r14, qword [rbp + 0x2c0]
jne 0x14001eb90
mov byte [rbp + 0x30f], 1
mov rcx, rsi
call fcn.14002ade0
jmp 0x14001eb90
lea rsi, [rdi + 0xd8]
mov qword [rbp + 0x268], rsi
test bl, bl
je 0x14001ec02
mov byte [rbp + 0x30f], 1
mov rcx, rdi
xor edx, edx
xor r8d, r8d
call fcn.14001bf60
mov rax, qword [rdi + 0x80]
jmp 0x14001ec04
xor eax, eax
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x280], 8
mov qword [rbp + 0x288], 0
mov r9, qword [rbp + 0x2d0]
mov qword [rbp + 0x100], r9
movups xmm0, xmmword [rbp + 0x2c0]
movaps xmmword [rbp + 0xf0], xmm0
lea r8, [rbp + 0x108]
lea rax, [rbp + 0x268]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x30c]
mov qword [rbp + 0x110], rax
lea rax, [rbp + 0x260]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x270]
mov qword [rbp + 0x120], rax
movaps xmmword [rbp + 0x2a0], xmm0
mov qword [rbp + 0x2b0], r9
lea rcx, [rbp + 0x248]
lea rdx, [rbp + 0x2a0]
call fcn.14002cee0
lea rcx, [rbp + 0x278]
lea rdx, [rbp + 0x248]
call fcn.1400268a0
mov rcx, qword [rbp + 0x278]
mov r13, qword [rbp + 0x280]
mov rax, qword [rbp + 0x288]
imul rdi, rax, 0x150
add rdi, r13
mov qword [rbp + 0x2a0], r13
mov qword [rbp + 0x2a8], r13
mov qword [rbp + 0x2e0], rcx
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], rdi
mov r8, r13
test rax, rax
je 0x14001edab
lea rbx, [rbp - 0x58]
lea r8, [r13 + 0x150]
lea r14, [rbp + 0xf0]
lea r15, [rbp - 0x60]
jmp 0x14001ed4a
mov r8, qword [rbp + 0x2f0]
add r8, 0x150
add r12, 0x150
cmp r12, rdi
je 0x14001eda1
mov rax, qword [r8 - 0x150]
cmp rax, 2
je 0x14001eda4
mov qword [rbp + 0x2f0], r8
lea r12, [r8 - 0x150]
mov qword [rbp - 0x60], rax
lea rdx, [r12 + 8]
mov r8d, 0x148
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rbp + 0x78]
mov rcx, r14
mov rdx, rsi
mov r9, r15
call fcn.140028fc0
cmp dword [rbp + 0xf0], 2
je 0x14001ed30
mov rcx, r14
call fcn.14001d150
jmp 0x14001ed30
mov r8, rdi
mov qword [rbp + 0x2a8], r8
mov qword [rbp + 0x298], r13
sub rdi, r8
shr rdi, 4
movabs rcx, 0xc30c30c30c30c31
mov rax, rdi
mul rcx
mov qword [rbp + 0x290], rdx
xor eax, eax
mov qword [rbp + 0x2d8], rax
mov qword [rbp + 0x2f0], r8
mov rcx, r8
nop word cs:[rax + rax]
mov rax, qword [rbp + 0x2d8]
cmp qword [rbp + 0x290], rax
je 0x14001ee1b
inc rax
mov qword [rbp + 0x2d8], rax
lea rdi, [rcx + 0x150]
call fcn.14001d150
mov rcx, rdi
jmp 0x14001edf0
mov rax, qword [rbp + 0x2e0]
test rax, rax
je 0x14001ee40
imul rdx, rax, 0x150
mov r8d, 8
mov rcx, qword [rbp + 0x298]
call fcn.14001b9d0
mov byte [rbp + 0x30f], 0
mov rcx, rsi
call fcn.140029200
mov rdx, qword [rbp + 0x2e8]
test rdx, rdx
je 0x14001ee6d
mov r8d, 1
mov rcx, qword [rbp + 0x300]
call fcn.14001b9d0
nop
add rsp, 0x398
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor r14d, r14d
mov rcx, r14
call fcn.1401eddb0
mov rdx, r12
mov rcx, r14
call fcn.1401eddb0
mov ecx, 8
mov edx, 0xfa0
call fcn.1401eddb0
ud2