Function at 0x1800ddf70
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x498
movaps xmmword [rsp + 0x480], xmm7
movaps xmmword [rsp + 0x470], xmm6
mov rsi, rcx
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xa0], 0
jne 0x1800ddfb8
call fcn.1800531e0
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm6, xmmword [rax + 0xa8]
inc qword [rax + 0xa8]
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800de006
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800ded94
mov rcx, rax
mov qword [0x180168b78], rax
mov r8d, 0x56410
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800ded94
mov rdi, rax
add rdi, 0x56000
mov r8d, 0x410
mov rcx, rdi
mov dl, 0xff
call fcn.1800f6c80
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800de063
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800deda0
mov rcx, rax
mov qword [0x180168b78], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800deda0
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
xorps xmm7, xmm7
movups xmmword [rsp + 0x170], xmm7
movups xmmword [rsp + 0x188], xmm7
mov qword [rsp + 0x198], 0
movups xmmword [rsp + 0x1c8], xmm7
mov byte [rsp + 0x1d8], 0
movups xmmword [rsp + 0x130], xmm7
movups xmmword [rsp + 0x140], xmm7
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 0x3ff
mov qword [rsp + 0x110], 0x380
mov qword [rsp + 0x118], 0
movdqu xmmword [rsp + 0x120], xmm6
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], 9
mov qword [rsp + 0x160], 9
mov qword [rsp + 0x168], 1
mov qword [rsp + 0x180], 1
mov qword [rsp + 0x1b0], 0
mov dword [rsp + 0x1b8], 0
mov qword [rsp + 0x1c0], 8
movaps xmmword [rsp + 0x1e0], xmm7
movaps xmmword [rsp + 0x210], xmm7
movaps xmmword [rsp + 0x200], xmm7
movaps xmmword [rsp + 0x1f0], xmm7
mov dword [rsp + 0x1e0], 0x40
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.kernel32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x1800de1a8
call sub.kernel32.dll_GetLastError
movdqu xmm0, xmmword [rsp + 0x1e8]
movdqu xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x230], xmm7
movaps xmmword [rsp + 0x220], xmm7
movaps xmmword [rsp + 0x210], xmm7
movaps xmmword [rsp + 0x200], xmm7
movaps xmmword [rsp + 0x1f0], xmm7
movaps xmmword [rsp + 0x1e0], xmm7
mov qword [rsp + 0x240], 0
lea rcx, [rsp + 0x1e0]
mov edx, 0x68
call qword [sym.imp.kernel32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x1800de269
mov r8, qword [rsp + 0x200]
mov r9, qword [rsp + 0x1f0]
xor r10d, r10d
sub r9, r8
cmovb r9, r10
mov rcx, qword [rsp + 0x230]
mov rax, rcx
mul r9
mov r9, 0xffffffffffffffff
cmovo rax, r9
mov r11, qword [rsp + 0x1e8]
sub r11, r8
cmovb r11, r10
mov qword [rsp + 0x140], rax
mov rax, rcx
mul r11
cmovo rax, r9
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0xc0]
mov dl, 1
call fcn.1800d7d50
mov byte [rsp + 0x60], 1
movabs rax, 0x202020202020101
mov qword [rsp + 0x61], rax
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800de2b8
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800dedb1
mov rcx, rax
mov qword [0x180168b78], rax
mov ebp, 0x80000
mov r8d, 0x80000
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800dedb1
mov rbx, rax
mov qword [rsp + 0x90], rsi
lea rsi, [rsp + 0x100]
lea rdi, [rsp + 0x150]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 0x80000
mov qword [rsp + 0x58], 0
xor edx, edx
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x1e0]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r12d, 0x80000
jmp 0x1800de33a
mov rbp, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x1e0], 0
sub rbp, rdx
cmp rbp, r12
jb 0x1800de3a4
mov ecx, 5
mov rdx, rbx
mov r8d, r12d
mov r9, r15
call r13
test eax, eax
jns 0x1800de3b6
or eax, 0x10000000
mov ecx, eax
call fcn.1800f5360
cmp edx, 0xd0000004
jne 0x1800de490
mov ecx, dword [rsp + 0x1e0]
mov rdx, r12
add rdx, r12
lea r12d, [rcx + 0x2800]
test ecx, ecx
cmove r12, rdx
test rax, rax
je 0x1800de330
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
jmp 0x1800de330
mov rcx, r14
mov r8, r12
call fcn.180105950
mov rbx, qword [rsp + 0x48]
jmp 0x1800de34d
mov qword [rsp + 0x58], r12
movzx eax, byte [0x180168bb8]
mov rcx, qword [0x180168b78]
test rcx, rcx
jne 0x1800de3e7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1800dedc2
mov rcx, rax
mov qword [0x180168b78], rax
mov r8d, 0xfa0
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1800dedc2
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0x1f4
mov qword [rsp + 0x80], 0
xor edx, edx
lea r14, [rsp + 0x70]
xor r15d, r15d
jmp 0x1800de447
mov qword [rax + rdx*8], r13
inc rdx
mov qword [rsp + 0x80], rdx
add r15, r12
test r12, r12
je 0x1800de46d
lea r13, [rbx + r15]
mov r12d, dword [rbx + r15]
cmp rdx, qword [rsp + 0x78]
jne 0x1800de430
mov rcx, r14
call fcn.1800e2250
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
jmp 0x1800de430
mov qword [rsp + 0xa8], rsi
cmp byte [rsp + 0x60], 0
je 0x1800de4c9
mov rcx, rdi
xor edx, edx
call fcn.1800d8200
mov rax, qword [rsp + 0x1d0]
jmp 0x1800de4cb
test rax, rax
je 0x1800de49e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
cmp qword [rsp + 0x50], 0
mov rsi, qword [rsp + 0x90]
je 0x1800ded3d
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800ded3d
xor eax, eax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x1e0], 0
mov rax, qword [0x180168030]
lea rcx, [rsp + 0x1e0]
call rax
mov rax, qword [rsp + 0x1e0]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x1800de527
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
jmp 0x1800de529
xor edx, edx
mov qword [rsp + 0xb8], rdx
mov rdi, qword [rsp + 0x80]
mov qword [rsp + 0x1f0], rdi
movdqu xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x330], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x338], xmm0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x200], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x210], rax
mov rsi, qword [rsp + 0x1e8]
cmp rsi, rdi
jb 0x1800dedd3
lea r14, [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1e0]
mov eax, dword [0x180168bbc]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x48]
test rax, rax
je 0x1800de5ee
add rax, 0x110
jmp 0x1800de5f3
call fcn.18004e450
mov rax, qword [rax]
mov r9, qword [rax + 0x210]
xor eax, eax
cmp rdi, 0xffffffffffffffff
sete al
cmp rax, r9
cmova r9, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x3b8]
mov rdx, rdi
xor r8d, r8d
call fcn.1800d8cf0
test rsi, rsi
je 0x1800de64f
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsp + 0x3b8]
mov rax, qword [rsp + 0x3c8]
test rax, rax
je 0x1800de68b
xor r8d, r8d
mov rcx, rbx
nop word [rax + rax]
test rcx, rcx
je 0x1800de682
add r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
dec rax
jne 0x1800de670
test r8, r8
jne 0x1800ded77
test rbx, rbx
je 0x1800de769
mov rsi, qword [sym.imp.kernel32.dll_HeapFree]
lea r14, [rsp + 0x330]
jmp 0x1800de6bc
mov rbx, rdi
test rdi, rdi
je 0x1800de769
mov rdi, qword [rbx + 0x18]
test rdi, rdi
je 0x1800de6cd
mov qword [rdi + 0x20], 0
mov r15, qword [rbx]
mov r13, qword [rbx + 8]
mov r12, qword [rbx + 0x10]
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rbx
call rsi
test r15, r15
je 0x1800de760
mov rax, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x340]
sub rax, rbx
cmp rax, r12
jb 0x1800de748
imul rcx, rbx, 0x150
add rcx, qword [rsp + 0x330]
imul r8, r12, 0x150
mov rdx, r15
call fcn.1800f64f0
add rbx, r12
mov qword [rsp + 0x340], rbx
test r13, r13
je 0x1800de6b0
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, r15
call rsi
jmp 0x1800de6b0
mov rcx, r14
mov rdx, rbx
mov r8, r12
call fcn.18010a830
mov rbx, qword [rsp + 0x340]
jmp 0x1800de703
test rdi, rdi
jne 0x1800de7ea
mov r14, qword [rsp + 0x330]
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x340]
imul rcx, rax, 0x150
add rcx, r14
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x88], r14
test rax, rax
je 0x1800deb63
lea r15, [rsp + 0x3b8]
lea r12, [rsp + 0x330]
pcmpeqd xmm6, xmm6
mov r14, qword [rsp + 0x88]
jmp 0x1800de8de
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rdi
call rsi
mov rdi, r15
test r15, r15
je 0x1800de769
mov r15, qword [rdi + 0x18]
test r15, r15
je 0x1800de7fb
mov qword [r15 + 0x20], 0
mov rbx, qword [rdi]
mov r12, qword [rdi + 0x10]
test r12, r12
je 0x1800de824
mov r14, rbx
nop word [rax + rax]
mov rcx, r14
call fcn.1800d9aa0
add r14, 0x150
dec r12
jne 0x1800de810
cmp qword [rdi + 8], 0
je 0x1800de7d0
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, rbx
call rsi
jmp 0x1800de7d0
movzx edx, sil
sub qword [rsp + 0x110], rdx
lea rdx, [rcx - 0x10]
and rdx, rax
mov byte [rbp + rcx], dil
mov byte [rdx + rbp + 0x10], dil
inc qword [rsp + 0x118]
mov rdi, qword [rsp + 0x100]
neg rcx
imul r15, rcx, 0x158
mov qword [rdi + r15 - 0x158], r13
mov qword [rdi + r15 - 0x150], rbx
lea rcx, [rdi + r15]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
lea rbx, [rsp + 0x3b8]
mov rdx, rbx
call fcn.1800f64f0
mov qword [rdi + r15 - 0x90], r13
lea rcx, [rdi + r15]
add rcx, 0xffffffffffffff78
mov r15, rbx
mov r8d, 0x88
mov rdx, r12
call fcn.1800f64f0
nop word [rax + rax]
cmp r14, qword [rsp + 0x98]
je 0x1800deba4
mov rdx, r14
add r14, 0x150
mov rbx, qword [rdx]
cmp rbx, 2
je 0x1800deb63
lea rdi, [rdx + 0xc8]
mov r13, qword [rdx + 0xc0]
add rdx, 8
mov r8d, 0xb8
mov rcx, r15
call fcn.1800f64f0
mov r8d, 0x88
mov rsi, r12
mov rcx, r12
mov rdx, rdi
call fcn.1800f64f0
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
mov r8, r13
call fcn.1800d9c50
mov r15, rax
mov rbp, qword [rsp + 0x100]
mov rax, qword [rsp + 0x108]
mov rdi, r15
shr rdi, 0x39
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rbp - 0x158]
xor edx, edx
mov r8, r15
and r8, rax
movdqu xmm1, xmmword [rbp + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
test r9w, r9w
je 0x1800de9c0
lea r10d, [r9 - 1]
and r10d, r9d
tzcnt r9d, r9d
add r9, r8
and r9, rax
neg r9
imul r12, r9, 0x158
mov r9d, r10d
cmp qword [rcx + r12], r13
jne 0x1800de990
jmp 0x1800de9e0
pcmpeqb xmm1, xmm6
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x1800dea6c
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x1800de979
lea rdx, [r12 + rbp]
add rdx, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x1e0]
call fcn.1800f64f0
mov qword [rbp + r12 - 0x150], rbx
lea rcx, [r12 + rbp]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
lea r15, [rsp + 0x3b8]
mov rdx, r15
call fcn.1800f64f0
mov qword [rbp + r12 - 0x90], r13
lea rcx, [r12 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov r12, rsi
mov rdx, rsi
call fcn.1800f64f0
cmp qword [rsp + 0x1e0], 2
je 0x1800de8d0
lea rcx, [rsp + 0x1e0]
call fcn.1800d9aa0
jmp 0x1800de8d0
mov rdx, rax
and rdx, r15
movdqu xmm0, xmmword [rbp + rdx]
pmovmskb ecx, xmm0
test ecx, ecx
je 0x1800dea85
mov r12, rsi
jmp 0x1800deaa8
mov r8d, 0x10
mov r12, rsi
nop
add rdx, r8
and rdx, rax
movdqu xmm0, xmmword [rbp + rdx]
pmovmskb ecx, xmm0
add r8, 0x10
test ecx, ecx
je 0x1800dea90
tzcnt ecx, ecx
add rcx, rdx
and rcx, rax
movzx esi, byte [rbp + rcx]
test sil, sil
js 0x1800deace
movdqa xmm0, xmmword [rbp]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx esi, byte [rbp + rcx]
and sil, 1
je 0x1800de83b
cmp qword [rsp + 0x110], 0
jne 0x1800de83b
lea rcx, [rsp + 0x100]
lea rdx, [rsp + 0x120]
call fcn.18010a900
mov rbp, qword [rsp + 0x100]
mov rax, qword [rsp + 0x108]
and r15, rax
movdqu xmm0, xmmword [rbp + r15]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x1800deb3c
mov edx, 0x10
add r15, rdx
and r15, rax
movdqu xmm0, xmmword [rbp + r15]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x1800deb23
tzcnt ecx, ecx
add rcx, r15
and rcx, rax
cmp byte [rbp + rcx], 0
js 0x1800de83b
movdqa xmm0, xmmword [rbp]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
jmp 0x1800de83b
mov r8, qword [rsp + 0x98]
mov rax, r8
sub rax, r14
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp r8, r14
je 0x1800deba4
mov rdi, rdx
nop word [rax + rax]
mov rcx, r14
call fcn.1800d9aa0
add r14, 0x150
dec rdi
jne 0x1800deb90
cmp qword [rsp + 0xa0], 0
je 0x1800debc6
mov rcx, qword [0x180168b78]
xor edx, edx
mov r8, qword [rsp + 0x88]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x118]
test rsi, rsi
je 0x1800ded19
mov rdi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x108]
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, qword [rsp + 0x110]
pcmpeqd xmm6, xmm6
mov r13, rsi
mov rbp, rdi
jmp 0x1800dec40
lea rcx, [rax + rbp]
add rcx, 0xfffffffffffffeb0
mov byte [rdi + rdx], r9b
mov byte [r8 + rdi + 0x10], r9b
dec rsi
mov qword [rsp + 0x118], rsi
call fcn.1800d9aa0
mov eax, r12d
test r13, r13
je 0x1800ded19
test ax, ax
je 0x1800dec50
lea r12d, [rax - 1]
and r12d, eax
jmp 0x1800dec79
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbp, 0xffffffffffffea80
add r14, 0x10
cmp ax, 0xffff
je 0x1800dec50
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov r12d, eax
and r12d, ecx
tzcnt eax, eax
neg rax
imul rax, rax, 0x158
dec r13
cmp byte [rbp + rax - 4], 0
mov byte [rbp + rax - 4], 0
jne 0x1800dec34
mov rdx, rdi
sub rdx, rbp
sub rdx, rax
sar rdx, 3
movabs rcx, 0x82fa0be82fa0be83
imul rdx, rcx
lea r8, [rdx - 0x10]
and r8, rbx
movdqu xmm0, xmmword [rdi + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb ecx, xmm0
test ecx, ecx
je 0x1800decd8
bsr cx, cx
xor ecx, 0xf
jmp 0x1800decdc
mov cx, 0x10
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add ecx, r9d
mov r9b, 0x80
cmp cx, 0xf
ja 0x1800dec10
inc r15
mov qword [rsp + 0x110], r15
mov r9b, 0xff
jmp 0x1800dec10
cmp qword [rsp + 0x50], 0
je 0x1800ded35
mov r8, qword [rsp + 0x48]
mov rcx, qword [0x180168b78]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x90]
lea rdx, [rsp + 0xc0]
mov r8d, 0x120
mov rcx, rsi
call fcn.1800f64f0
movaps xmm6, xmmword [rsp + 0x470]
movaps xmm7, xmmword [rsp + 0x480]
add rsp, 0x498
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x330]
xor edx, edx
call fcn.18010a830
test rbx, rbx
jne 0x1800de694
jmp 0x1800de769
mov ecx, 0x56410
call fcn.18002d190
ud2
mov ecx, 1
mov edx, 9
call fcn.180103b10
ud2
mov ecx, 1
mov edx, 0x80000
call fcn.180103b10
ud2
mov ecx, 8
mov edx, 0xfa0
call fcn.180103b10
ud2
ud2