Function at 0x140074b6e
Capabilities:
Enumerate processes via ntquerysysteminformation
Get memory capacity
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4b8
movaps xmmword [rsp + 0x4a0], xmm6
mov rbp, rdx
mov qword [rsp + 0xb0], rcx
lea rsi, [rsp + 0x200]
mov rcx, rsi
call fcn.1400759c3
mov rcx, rsi
call fcn.140075a2b
mov rsi, rax
mov rbx, rdx
lea r14, [rsp + 0x200]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, r14
call fcn.140074844
mov rdi, qword [r14]
test rdi, rdi
je 0x140074bef
mov r14, qword [rsp + 0x208]
mov r15, qword [rsp + 0x210]
mov r12, qword [rsp + 0x218]
jmp 0x140074bff
mov r14, qword [rsp + 0x208]
mov r15, qword [rsp + 0x210]
mov ecx, 9
call fcn.140043351
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
movups xmmword [rsp + 0x1a8], xmm0
movups xmmword [rsp + 0x1e8], xmm0
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
and qword [rsp + 0xe0], 0
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], r14
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], r12
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rdx
mov qword [rsp + 0x180], 9
mov eax, 1
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x1a0], rax
and qword [rsp + 0x1b8], 0
and qword [rsp + 0x1d0], 0
and dword [rsp + 0x1d8], 0
mov qword [rsp + 0x1e0], 8
mov byte [rsp + 0x1f8], 0
mov al, byte [rbp + 9]
cmp al, 2
je 0x140074dd6
mov bl, byte [rbp + 0xa]
test al, al
je 0x140074d3b
lea rcx, [rsp + 0x200]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140074d1a
xor ecx, ecx
jmp 0x140074d24
call fcn.140077b41
mov ecx, 1
movups xmm0, xmmword [rsp + 0x208]
movups xmmword [rsp + 0x150], xmm0
xor edx, edx
call fcn.140073d49
test bl, 1
je 0x140074dd6
xorps xmm0, xmm0
lea rcx, [rsp + 0x200]
movaps xmmword [rcx + 0x50], xmm0
movaps xmmword [rcx + 0x40], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
and qword [rcx + 0x60], 0
mov edx, 0x68
call qword [sym.imp.KERNEL32.dll_K32GetPerformanceInfo]
test eax, eax
je 0x140074dd6
mov r8, qword [rsp + 0x220]
mov r9, qword [rsp + 0x210]
xor r10d, r10d
sub r9, r8
cmovb r9, r10
mov rcx, qword [rsp + 0x250]
mov rax, rcx
mul r9
mov r9, 0xffffffffffffffff
cmovo rax, r9
mov r11, qword [rsp + 0x208]
sub r11, r8
cmovb r11, r10
mov qword [rsp + 0x160], rax
mov rax, rcx
mul r11
cmovo rax, r9
mov qword [rsp + 0x168], rax
lea r13, [rsp + 0x170]
cmp byte [rbp + 0xb], 2
je 0x1400751af
lea r12, [rsp + 0x1b8]
mov r15b, byte [rbp + 0xc]
cmp qword [r12 - 0xd8], 0
jne 0x14007507b
lea rdi, [rsp + 0xe8]
lea r8, [rsp + 0x360]
and qword [r8], 0
xor ebx, ebx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.pdh.dll_PdhOpenQueryA]
mov esi, eax
test esi, esi
jne 0x140074e5b
mov r14, qword [rsp + 0x360]
lea rbx, [rsp + 0x200]
mov rcx, rbx
call fcn.1400759c3
mov rcx, rbx
call fcn.140075a2b
xorps xmm0, xmm0
movaps xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
lea rbx, [0x140092670]
mov qword [rsp + 0xe0], rbx
mov rcx, qword [rsp + 0x210]
mov qword [rdi + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x200]
movups xmmword [rdi], xmm0
and qword [rsp + 0x118], 0
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], r14
test esi, esi
jne 0x140075072
mov qword [rsp + 0x68], rbp
mov byte [rsp + 0x60], r15b
mov ebx, r15d
and bl, 1
mov ecx, 0x1e
call fcn.140043351
movups xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140092dce]
movups xmmword [rax + 0xe], xmm0
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], 0x1e
mov ecx, 5
call fcn.140043351
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x200]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x360]
mov r8, r12
call fcn.140076336
mov rcx, r13
mov edx, ebx
call fcn.14007663e
mov r13, rax
mov qword [rsp + 0x70], rdx
xor eax, eax
mov qword [rsp + 0x40], rax
mov esi, 2
mov ebx, 1
cmp r13, qword [rsp + 0x70]
je 0x140075050
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x88], rax
inc rax
mov qword [rsp + 0x40], rax
lea rax, [0x140092df8]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rsi
and qword [rsp + 0x220], 0
lea r12, [rsp + 0x88]
mov qword [rsp + 0x360], r12
lea r15, [fcn.14003a840]
mov qword [rsp + 0x368], r15
lea rdi, [rsp + 0x360]
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], rbx
lea r14, [rsp + 0x418]
mov rcx, r14
lea rbp, [rsp + 0x200]
mov rdx, rbp
call fcn.140070591
lea rax, str._rustc_85bf07972a1041b9e25393b803d0e006bec3eaaflibrarycore_srccharmethods.rs
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rsi
and qword [rsp + 0x220], 0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], rbx
mov rcx, rdi
mov rdx, rbp
call fcn.140070591
lea r8, [r13 + 0x48]
mov rcx, r14
lea rdx, [rsp + 0xe0]
mov r9, rdi
call fcn.140076336
add r13, 0x70
jmp 0x140074f54
mov rbx, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x68]
lea r13, [rsp + 0x170]
mov r15b, byte [rsp + 0x60]
lea r12, [rsp + 0x1b8]
test rbx, rbx
je 0x1400751af
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.pdh.dll_PdhCollectQueryData]
cmp qword [rsp + 0x1b8], 0
je 0x1400750c1
lea rcx, [rsp + 0xe0]
mov rdx, r12
call fcn.140076660
test eax, eax
je 0x140075983
movss xmm1, dword [0x14007c820]
subss xmm1, xmm0
movss dword [rsp + 0x1d8], xmm1
mov edx, r15d
and dl, 1
mov rcx, r13
call fcn.14007663e
mov rsi, rax
mov rbx, rdx
add rsi, 0x48
lea r14, [rsp + 0xe0]
movss xmm6, dword [0x14007c820]
lea rax, [rsi - 0x48]
cmp rax, rbx
je 0x14007511d
cmp qword [rsi], 0
je 0x140075117
mov rcx, r14
mov rdx, rsi
call fcn.140076660
test eax, eax
je 0x140075969
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rsi + 0x20], xmm1
add rsi, 0x70
jmp 0x1400750e9
test r15b, 1
je 0x1400751af
cmp byte [rsp + 0x1f8], 0
jne 0x1400751af
mov rsi, qword [rsp + 0x1f0]
lea rbx, [rsp + 0x200]
mov rcx, rbx
mov rdx, rsi
call fcn.14007618b
mov rdi, qword [rsp + 0x1e0]
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rdi
test r8, r8
je 0x14007518d
cmp rax, r9
je 0x14007518d
mov r11, qword [rcx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x14007516d
call fcn.14001e76b
test rsi, rsi
je 0x14007519d
mov rax, qword [rdi + 0x60]
jmp 0x14007519f
xor eax, eax
mov qword [rsp + 0x1d0], rax
mov byte [rsp + 0x1f8], 1
mov al, byte [rbp]
cmp al, 2
je 0x140075932
mov rcx, qword [rbp + 1]
mov byte [rsp + 0x78], al
mov qword [rsp + 0x79], rcx
mov edi, 0x80000
mov ecx, 0x80000
call fcn.140043351
lea r14, [rsp + 0xb8]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
lea r15, [rsp + 0x360]
mov rbx, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea r12, [rsp + 0x200]
and dword [rsp + 0x360], 0
mov rcx, r14
mov rdx, rdi
call fcn.14003a11c
mov rsi, qword [rsp + 0xb8]
mov ecx, 5
mov rdx, rsi
mov r8d, edi
mov r9, r15
call rbx
mov rcx, r12
mov edx, eax
call fcn.140073b75
cmp qword [rsp + 0x200], 0
je 0x140075280
cmp dword [rsp + 0x210], 0xd0000004
mov rcx, qword [rsp + 0x208]
jne 0x140075330
mov eax, dword [rsp + 0x360]
mov rdx, rdi
add rdx, rdi
lea edi, [rax + 0x2800]
test eax, eax
cmove rdi, rdx
test rcx, rcx
je 0x140075201
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140075201
mov qword [rsp + 0xc8], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.140070735
test rax, rax
je 0x140075998
lea rdi, [rsp + 0x88]
mov qword [rdi], rax
mov qword [rdi + 8], 0x1f4
and qword [rdi + 0x10], 0
xor edx, edx
xor ebx, ebx
lea r15, [rsi + rbx]
mov r14d, dword [rsi + rbx]
cmp rdx, qword [rsp + 0x90]
jne 0x1400752e6
mov rcx, rdi
call fcn.14001e896
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
mov qword [rax + rdx*8], r15
mov rdx, qword [rsp + 0x98]
inc rdx
mov qword [rsp + 0x98], rdx
add rbx, r14
test r14d, r14d
jne 0x1400752bc
lea rax, [rsp + 0x120]
mov qword [rsp + 0xd0], rax
cmp byte [rsp + 0x78], 0
je 0x14007534b
mov rcx, r13
xor edx, edx
call fcn.140075a6d
mov rax, qword [rsp + 0x1f0]
jmp 0x14007534d
test rcx, rcx
je 0x14007533b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, qword [rsp + 0xc0]
mov rcx, rsi
jmp 0x14007592d
xor eax, eax
mov qword [rsp + 0xd8], rax
call fcn.14006bd50
shl rdx, 0x20
mov eax, eax
or rdx, rax
lea rsi, [rsp + 0x200]
mov rcx, rsi
call fcn.14006bde0
cmp qword [rsi], 0
je 0x14007537d
xor eax, eax
jmp 0x140075385
mov rax, qword [rsp + 0x208]
lea rcx, [rsp + 0x358]
mov qword [rcx], rax
mov r14, qword [rsp + 0x98]
mov qword [rsp + 0x210], r14
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x48], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x218], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x220], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rcx
mov rbx, qword [rsp + 0x208]
cmp rbx, r14
jb 0x1400759a9
lea rsi, [rsp + 0x218]
mov r15, qword [rsi - 0x18]
call fcn.140044730
xor r9d, r9d
cmp r14, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x418]
mov rcx, rsi
mov rdx, r14
xor r8d, r8d
call fcn.140070ebe
test rbx, rbx
je 0x140075471
shl rbx, 3
mov edx, 8
mov rcx, r15
mov r8, rbx
call fcn.140004542
mov rax, qword [rsp + 0x428]
xor edx, edx
sub rax, 1
jb 0x140075493
mov rsi, qword [rsi]
test rsi, rsi
je 0x140075493
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14007547b
lea rbp, [rsp + 0x48]
mov rcx, rbp
call fcn.140074488
mov rax, qword [rsp + 0x428]
lea rsi, [rsp + 0x360]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x418]
movaps xmmword [rsi], xmm0
lea rdi, [rsp + 0x208]
lea r14, [rsp + 0x200]
mov rcx, rsi
call fcn.140070e94
test rax, rax
je 0x140075560
mov r15, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0xa0], xmm0
mov rcx, rax
call fcn.1400423a0
test r15, r15
je 0x140075560
mov qword [rsp + 0x200], r15
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi], xmm0
mov r12, qword [rsp + 0x210]
mov rcx, rbp
mov rdx, r12
call fcn.140074488
mov rbx, qword [rsp + 0x58]
imul rcx, rbx, 0x150
add rcx, qword [rsp + 0x48]
imul r8, r12, 0x150
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add rbx, r12
mov qword [rsp + 0x58], rbx
and qword [rsp + 0x210], 0
mov rcx, r14
call fcn.140070779
jmp 0x1400754cf
lea rcx, [rsp + 0x360]
call fcn.140070e62
mov r13, qword [rsp + 0x48]
imul rcx, qword [rsp + 0x58], 0x150
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
lea rax, [rcx + r13]
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0x418]
lea rdi, [rsp + 0x200]
mov qword [rsp + 0x70], r13
test rcx, rcx
je 0x1400757e6
mov rbx, qword [r13]
cmp rbx, 2
je 0x1400757df
mov qword [rsp + 0x40], rcx
lea r12, [r13 + 0xc8]
mov r14, qword [r13 + 0xc0]
lea rdx, [r13 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x360]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x88
mov rcx, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0xa0], r14
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
mov r8, r14
call fcn.140073e29
mov r12, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x130], 0
je 0x1400757c5
mov qword [rsp + 0x200], rbp
lea rax, [rsp + 0x120]
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x128]
lea rax, [0x140074ab8]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9, rdi
call fcn.140074953
test rax, rax
je 0x140075721
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x120]
movzx r8d, byte [rcx + rdx]
and r8d, 1
sub qword [rsp + 0x130], r8
shr r12, 0x39
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x128]
mov byte [rcx + rdx], r12b
mov byte [r8 + rcx + 0x10], r12b
inc qword [rsp + 0x138]
mov r15, qword [rsp + 0x120]
neg rdx
imul rbp, rdx, 0x158
lea r12, [r15 + rbp]
add r12, 0xfffffffffffffeb8
mov qword [r12 - 0x10], rax
mov qword [r12 - 8], rbx
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x360]
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12 + 0xb8], r14
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400757a8
mov r15, qword [rsp + 0x120]
neg rdx
imul rbp, rdx, 0x158
lea r12, [r15 + rbp]
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, rdi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12], rbx
lea r12, [r15 + rbp]
add r12, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x360]
call sub.VCRUNTIME140.dll_memcpy
mov qword [r12 + 0xb8], r14
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rsp + 0x200], 2
je 0x1400757a8
mov rcx, rdi
call fcn.1400707e4
add r13, 0x150
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffeb0
lea rbp, [rsp + 0x48]
jmp 0x1400755a3
lea rcx, [rsp + 0x120]
lea rdx, [rsp + 0x140]
call fcn.14007add8
jmp 0x140075634
add r13, 0x150
mov rax, qword [rsp + 0x60]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
mov rdx, rax
call fcn.1400707ba
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
call fcn.1400707a3
mov rdi, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x128]
lea rax, [rbx + rdi]
inc rax
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rdi + 0x10]
mov r14, qword [rsp + 0x138]
lea rsi, [rsp + 0x200]
mov qword [rsi], rdi
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], r14
mov r15, qword [rsp + 0x130]
mov r12d, 0x158
pcmpeqd xmm6, xmm6
mov rcx, rsi
call fcn.14007472c
test rax, rax
je 0x14007591d
mov rcx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x14007586c
mov rax, rdi
sub rax, rcx
cqo
idiv r12
lea rdx, [rax - 0x10]
and rdx, rbx
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400758bf
bsr r8w, r8w
xor r8d, 0xf
jmp 0x1400758c4
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
ja 0x1400758f8
inc r15
mov qword [rsp + 0x130], r15
mov r9b, 0xff
mov byte [rdi + rax], r9b
mov byte [rdx + rdi + 0x10], r9b
dec r14
mov qword [rsp + 0x138], r14
add rcx, 0xfffffffffffffeb0
call fcn.1400707e4
jmp 0x14007586c
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
call fcn.1400423aa
lea rdx, [rsp + 0xe0]
mov r8d, 0x120
mov rcx, qword [rsp + 0xb0]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rsp + 0x4a0]
add rsp, 0x4b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.key_used_disappeared
lea r8, str._._t_
mov edx, 0x14
call fcn.1400790d0
ud2
lea rcx, str.global_key_idle_disappearedC:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.30.5_srcwindows_system.rs
lea r8, [0x140092ec8]
mov edx, 0x1b
jmp 0x14007597c
mov ecx, 8
mov edx, 0xfa0
call fcn.140078a00
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:UsersUser.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rayon_1.8.1_src_vec.rs
lea r8, [0x1400928e0]
mov edx, 0x2f
call fcn.140078da0
ud2