Function at 0x18001e010
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov dword [rax + 8], ecx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r15, r9
mov rsi, r8
mov r12d, ecx
xor edi, edi
mov eax, 0x10000
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
and qword [r8], rdi
and qword [r9], rdi
mov r14, qword [rsp + 0xb0]
and qword [r14], rdi
test cl, 6
je 0x18001e106
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rsi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
nop dword [rax + rax]
mov edi, eax
mov dword [rsp + 0x34], eax
jmp 0x18001e0c4
test edi, edi
js 0x18001e106
mov rax, qword [rsp + 0x38]
mov dword [rsp + 0x30], eax
lea r9, [rsp + 0x30]
mov r8d, eax
mov rdx, qword [rsi]
mov ecx, 5
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0xc0000004
je 0x18001e1e8
cmp edi, 0xc0000004
je 0x18001e062
test r12b, 0x18
jne 0x18001e160
mov r13d, 0xc0000001
test r12b, 1
jne 0x180034589
test edi, edi
js 0x18001e132
mov eax, edi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
cmp qword [rsi], 0
jne 0x1800345f7
cmp qword [r15], 0
je 0x18001e155
mov rcx, qword [r15]
call qword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
nop dword [rax + rax]
and qword [r15], 0
cmp qword [r14], 0
je 0x18001e120
jmp 0x18003462a
test edi, edi
js 0x18003457e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
nop dword [rax + rax]
mov qword [r15], rax
mov r13d, 0xc0000001
test rax, rax
cmove edi, r13d
test edi, edi
js 0x18001e112
mov rax, qword [r15]
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0xa0]
mov qword [rax], rcx
mov rax, qword [r15]
mov rcx, qword [rax + 0x58]
mov rax, qword [rsp + 0xa8]
mov qword [rax], rcx
mov edx, r12d
and edx, 0x10
or edx, 0xe0000000
shl edx, 2
mov eax, r12d
shr eax, 3
and eax, 1
or edx, eax
movsxd rcx, dword [rsp + 0x88]
mov r8, qword [r15]
call qword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
nop dword [rax + rax]
mov edi, eax
jmp 0x18001e112
mov r9d, 0x8000
lea r8, [rsp + 0x38]
mov rdx, rsi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
nop dword [rax + rax]
and qword [rsi], 0
mov eax, dword [rsp + 0x30]
add eax, 0x1fff
and eax, 0xffffe000
mov dword [rsp + 0x30], eax
jmp 0x18001e0fa
mov r13d, 0xc0000001
jmp 0x18001e188
test edi, edi
js 0x18001e132
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlCreateQueryDebugBuffer]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
cmove edi, r13d
test edi, edi
js 0x18001e132
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
mov rax, qword [r14]
mov rcx, qword [rax + 0x58]
mov rax, qword [rsp + 0xc0]
mov qword [rax], rcx
movsxd rcx, dword [rsp + 0x88]
mov r8, qword [r14]
mov edx, 4
call qword [sym.imp.ntdll.dll_RtlQueryProcessDebugInformation]
nop dword [rax + rax]
mov edi, eax
jmp 0x18001e11c
and qword [rsp + 0xb0], 0
mov r9d, 0x8000
lea r8, [rsp + 0xb0]
mov rdx, rsi
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtFreeVirtualMemory]
nop dword [rax + rax]
and qword [rsi], 0
jmp 0x18001e13c
mov rcx, qword [r14]
call qword [sym.imp.ntdll.dll_RtlDestroyQueryDebugBuffer]
nop dword [rax + rax]
and qword [r14], 0
jmp 0x18001e120