Function at 0x1400284b0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov r15, rcx
mov ebx, 0x40000
mov ecx, 1
mov edx, ebx
mov r8d, 0x54585342
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
je 0x140028550
xor r9d, r9d
mov r8d, ebx
mov rdx, r14
lea ecx, [r9 + 5]
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov r12d, eax
test eax, eax
jns 0x14002854b
mov edx, 0x54585342
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r12d, 0xc0000004
jne 0x140028715
add ebx, 0x40000
mov ecx, 1
mov edx, ebx
mov r8d, 0x54585342
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
test rax, rax
jne 0x1400284e3
mov eax, 0xc000009a
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
test r14, r14
jne 0x140028562
mov eax, 0xc000009a
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
mov qword [rsp + 0x70], rbp
xor ebp, ebp
mov qword [rsp + 0x78], rsi
mov rsi, r14
test r15, r15
jne 0x1400286e8
mov ebx, ebp
cmp dword [rsi + 4], ebp
jbe 0x1400286ee
mov ecx, 0x28
call fcn.140002a20
mov r8, rax
test rax, rax
je 0x1400287ac
mov rcx, qword [rdi]
lea rdx, [rax + 8]
mov qword [rax], rcx
test rdx, rdx
je 0x1400285b0
mov rcx, qword [rdi]
mov qword [rdx], rcx
lea rcx, [rax + 0x10]
test rcx, rcx
je 0x1400285bf
mov rax, qword [rdi]
mov qword [rcx], rax
lea r11, [r8 + 0x20]
mov word [r8 + 0x18], bp
test r11, r11
je 0x1400285e1
mov eax, ebx
lea rax, [rax + rax*4]
add rax, rax
mov rax, qword [rsi + rax*8 + 0x130]
mov qword [r11], rax
mov r10, qword [rdi]
mov dl, 1
mov r9, r10
mov rax, qword [r10 + 8]
cmp byte [rax + 0x19], bpl
jne 0x14002861d
mov rcx, qword [r11]
nop word [rax + rax]
cmp rcx, qword [rax + 0x20]
mov r9, rax
setb dl
test dl, dl
je 0x140028613
mov rax, qword [rax]
jmp 0x140028617
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], bpl
je 0x140028600
mov rax, r9
test dl, dl
je 0x1400286aa
cmp r9, qword [r10]
jne 0x14002864f
mov qword [rsp + 0x28], r8
lea rdx, [rsp + 0x80]
mov r8b, 1
mov qword [rsp + 0x20], r11
mov rcx, rdi
call fcn.14000ca10
jmp 0x1400286db
cmp byte [r9 + 0x19], bpl
je 0x14002865b
mov rax, qword [r9 + 0x10]
jmp 0x1400286aa
mov rcx, qword [r9]
cmp byte [rcx + 0x19], bpl
jne 0x140028680
mov rax, rcx
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], bpl
jne 0x1400286aa
mov rax, rcx
mov rcx, qword [rcx + 0x10]
cmp byte [rcx + 0x19], bpl
je 0x140028671
jmp 0x1400286aa
mov rcx, qword [r9 + 8]
cmp byte [rcx + 0x19], bpl
jne 0x1400286a2
nop word [rax + rax]
cmp rax, qword [rcx]
jne 0x1400286a2
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], bpl
je 0x140028690
cmp byte [rax + 0x19], bpl
cmove rax, rcx
mov rcx, qword [r11]
cmp qword [rax + 0x20], rcx
jae 0x1400286d3
mov qword [rsp + 0x28], r8
mov rcx, rdi
movzx r8d, dl
mov qword [rsp + 0x20], r11
lea rdx, [rsp + 0x88]
call fcn.14000ca10
jmp 0x1400286db
mov rcx, r8
call fcn.140002a60
inc ebx
cmp ebx, dword [rsi + 4]
jb 0x140028585
jmp 0x1400286ee
cmp qword [rsi + 0x50], r15
je 0x140028725
mov eax, dword [rsi]
test eax, eax
je 0x1400286fd
add rsi, rax
jne 0x140028571
mov edx, 0x54585342
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov eax, r12d
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
cmp dword [rsi + 4], ebp
jbe 0x1400286fd
nop word [rax + rax]
mov ecx, 0x28
call fcn.140002a20
mov rdx, rax
test rax, rax
je 0x1400287b2
mov rcx, qword [rdi]
mov qword [rax], rcx
add rax, 8
je 0x140028754
mov rcx, qword [rdi]
mov qword [rax], rcx
lea rcx, [rdx + 0x10]
test rcx, rcx
je 0x140028763
mov rax, qword [rdi]
mov qword [rcx], rax
lea r9, [rdx + 0x20]
mov word [rdx + 0x18], 0
test r9, r9
je 0x14002878b
lea rax, [rbp*4]
add rax, rbp
add rax, rax
mov rax, qword [rsi + rax*8 + 0x130]
mov qword [r9], rax
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400092d0
inc ebp
cmp ebp, dword [rsi + 4]
jb 0x140028730
jmp 0x1400286fd
call fcn.140002a80
int3
call fcn.140002a80
int3