Function at 0x140022540
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x440], 0xfffffffffffffffe
mov r14, rcx
mov word [rbp + 0x438], dx
shr edx, 0x10
mov byte [rbp + 0x43a], dl
call fcn.1401e2420
mov dword [rbp + 0x60], eax
mov dword [rbp + 0x64], edx
lea rcx, [rbp + 0x1b0]
lea rdx, [rbp + 0x60]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.1401e2450
cmp qword [rbp + 0x1b0], 0
je 0x1400225ae
xor eax, eax
jmp 0x1400225b5
mov rax, qword [rbp + 0x1b8]
mov qword [rbp + 0x3b8], rax
mov edi, 0x80000
lea rsi, [rbp + 0x424]
mov rbx, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
jmp 0x1400225f9
mov edi, 0
test rdx, rdx
je 0x1400225f9
lea rdi, [rdx + rdx]
mov r8d, 1
call fcn.14001c240
mov eax, 1
test rdi, rdi
je 0x14002261f
js 0x140022aaf
mov edx, 1
mov rcx, rdi
call fcn.14001c230
test rax, rax
je 0x140022ab6
mov dword [rbp + 0x424], 0
mov ecx, 5
mov qword [rbp + 0x428], rax
mov rdx, rax
mov qword [rbp + 0x400], rdi
mov r8d, edi
mov r9, rsi
call rbx
cmp eax, 0xc0000004
jne 0x14002267e
mov edi, dword [rbp + 0x424]
test edi, edi
mov rdx, qword [rbp + 0x400]
mov rcx, qword [rbp + 0x428]
je 0x1400225e0
add edi, 0x2800
test rdx, rdx
jne 0x1400225ee
jmp 0x1400225f9
mov ecx, 0xfa0
mov edx, 8
call fcn.14001c230
test rax, rax
mov rdi, qword [rbp + 0x428]
je 0x140022ac5
mov qword [rbp + 0x408], 0x1f4
mov qword [rbp + 0x410], rax
mov qword [rbp + 0x418], 0
xor edx, edx
lea rsi, [rbp + 0x408]
xor ebx, ebx
jmp 0x1400226fa
lea rax, [rdi + rbx]
mov rcx, qword [rbp + 0x410]
mov qword [rcx + rdx*8], rax
mov rdx, qword [rbp + 0x418]
inc rdx
mov qword [rbp + 0x418], rdx
mov eax, dword [rax]
add rbx, rax
test rax, rax
je 0x140022722
cmp rdx, qword [rbp + 0x408]
jne 0x1400226d0
mov byte [rbp + 0x43f], 1
mov rcx, rsi
call fcn.140026b20
mov rdx, qword [rbp + 0x418]
mov rdi, qword [rbp + 0x428]
jmp 0x1400226d0
lea rax, [r14 + 0x40]
mov qword [rbp + 0x3f0], rax
mov qword [rbp + 0x3b0], rax
cmp byte [rbp + 0x438], 0
je 0x14002275e
lea rcx, [r14 + 0xa0]
mov byte [rbp + 0x43f], 1
xor edx, edx
xor r8d, r8d
call fcn.14001f460
mov rax, qword [r14 + 0x120]
jmp 0x140022760
xor eax, eax
mov qword [rbp + 0x3a8], rax
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 8
mov qword [rbp + 0x3e8], 0
lea rax, [rbp + 0x3b0]
mov qword [rbp + 0x1b0], rax
lea rax, [rbp + 0x438]
mov qword [rbp + 0x1b8], rax
lea rax, [rbp + 0x3a8]
mov qword [rbp + 0x1c0], rax
lea rax, [rbp + 0x3b8]
mov qword [rbp + 0x1c8], rax
movups xmm0, xmmword [rbp + 0x408]
movups xmmword [rbp + 0x1d0], xmm0
mov rax, qword [rbp + 0x418]
mov qword [rbp + 0x1e0], rax
lea rcx, [rbp + 0x3d8]
lea rdx, [rbp + 0x1b0]
call fcn.14002f420
mov rcx, qword [rbp + 0x3d8]
mov rbx, qword [rbp + 0x3e0]
mov rax, qword [rbp + 0x3e8]
imul r15, rax, 0x150
lea rdx, [rbx + r15]
mov qword [rbp + 0x3c8], rcx
mov qword [rbp + 0x388], rcx
mov qword [rbp + 0x390], rbx
mov qword [rbp + 0x430], rdx
mov qword [rbp + 0x398], rdx
mov qword [rbp + 0x3a0], rbx
mov qword [rbp + 0x3f8], rbx
test rax, rax
je 0x1400229dd
mov rax, qword [rbp + 0x3f8]
add rax, 0x150
lea rdi, [rbp - 0x58]
lea rsi, [rbp + 0x60]
jmp 0x140022874
lea rax, [rbx + 0x150]
add r15, 0xfffffffffffffeb0
je 0x1400229dd
mov rbx, rax
mov qword [rbp + 0x390], rax
mov r13, qword [rax - 0xd0]
cmp r13, 2
je 0x1400229dd
lea rax, [rbx - 0x150]
lea rdx, [rbx - 0xb8]
mov r12, qword [rbx - 0xc8]
mov r14, qword [rbx - 0xc0]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rbp + 0x300], xmm0
movaps xmmword [rbp + 0x310], xmm1
movaps xmmword [rbp + 0x320], xmm2
movaps xmmword [rbp + 0x330], xmm3
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rbp + 0x340], xmm0
movups xmm0, xmmword [rax + 0x50]
movaps xmmword [rbp + 0x350], xmm0
movups xmm0, xmmword [rax + 0x60]
movaps xmmword [rbp + 0x360], xmm0
movups xmm0, xmmword [rax + 0x70]
movaps xmmword [rbp + 0x370], xmm0
mov r8d, 0xb8
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movaps xmm0, xmmword [rbp + 0x370]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [rbp + 0x360]
movaps xmmword [rbp + 0x210], xmm0
movaps xmm0, xmmword [rbp + 0x350]
movaps xmmword [rbp + 0x200], xmm0
movaps xmm0, xmmword [rbp + 0x340]
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmm0, xmmword [rbp + 0x300]
movaps xmm1, xmmword [rbp + 0x310]
movaps xmm2, xmmword [rbp + 0x320]
movaps xmm3, xmmword [rbp + 0x330]
movaps xmmword [rbp + 0x1e0], xmm3
movaps xmmword [rbp + 0x1d0], xmm2
movaps xmmword [rbp + 0x1c0], xmm1
movaps xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x230], r13
mov qword [rbp + 0x238], r12
mov qword [rbp + 0x240], r14
mov r8d, 0xb8
lea rcx, [rbp + 0x248]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
mov rdx, qword [rbp + 0x3f0]
mov r8, r14
lea r9, [rbp + 0x1b0]
call fcn.1400290b0
cmp dword [rbp + 0xe0], 2
je 0x140022860
mov rcx, rsi
call fcn.14001ff00
jmp 0x140022860
mov rax, qword [rbp + 0x430]
sub rax, rbx
mov qword [rbp + 0x430], rax
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
imul rax, rdx, 0x150
add rax, rbx
mov qword [rbp + 0x3d0], rax
mov rax, qword [rbp + 0x430]
test rax, rax
je 0x140022a44
lea rsi, [rbx + 0x150]
add rax, 0xfffffffffffffeb0
mov qword [rbp + 0x430], rax
mov rcx, rbx
mov qword [rbp + 0x3c0], rsi
call fcn.14001ff00
mov rbx, rsi
jmp 0x140022a10
mov rax, qword [rbp + 0x3c8]
test rax, rax
je 0x140022a69
imul rdx, rax, 0x150
mov r8d, 8
mov rcx, qword [rbp + 0x3f8]
call fcn.14001c240
mov byte [rbp + 0x43f], 0
mov rcx, qword [rbp + 0x3f0]
call fcn.1400293a0
mov rdx, qword [rbp + 0x400]
test rdx, rdx
je 0x140022a9a
mov r8d, 1
mov rcx, qword [rbp + 0x428]
call fcn.14001c240
nop
add rsp, 0x4c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1401fa2d0
ud2
mov edx, 1
mov rcx, rdi
call fcn.1402179b0
ud2
mov ecx, 0xfa0
mov edx, 8
call fcn.1402179b0
ud2