Function at 0x29e30
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
mov eax, 0x1000
mov edx, eax
mov ecx, 1
mov dword [rsp + 0x38], eax
call fcn.0002e424
mov rsi, rax
cmp rax, rbx
je 0x29ed0
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x29e98
mov rcx, rsi
call fcn.0002e49c
mov eax, dword [rsp + 0x38]
add eax, 0x4000
jmp 0x29e4e
cmp eax, ebx
jl 0x29ec3
mov rdi, rsi
mov rcx, qword [rdi + 0x40]
cmp rcx, rbx
je 0x29eb4
mov rdx, rbp
call sub.ntoskrnl.exe__wcsicmp
cmp eax, ebx
je 0x29ebf
cmp dword [rdi], ebx
je 0x29ec3
mov eax, dword [rdi]
add rdi, rax
jmp 0x29e9f
mov rbx, qword [rdi + 0x50]
mov rcx, rsi
call fcn.0002e49c
mov rax, rbx
jmp 0x29ed2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x2a064
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 0x18]
lea rdx, [rax + 0x10]
lea rcx, [rax + 8]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x40], 5
jne 0x2a093
cmp dword [rsp + 0x48], 2
jne 0x2a093
mov al, 1
jmp 0x2a095
xor al, al
add rsp, 0x38
ret

Function at 0x2a0a0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
xor edi, edi
mov r13, rdx
mov r14, rcx
lea esi, [rdi + 0xb]
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
mov ecx, esi
mov r12, rdi
mov dword [rax + 0x18], edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x2a0e7
xor eax, eax
jmp 0x2a179
mov edx, dword [rsp + 0x60]
mov ecx, 1
call fcn.0002e424
mov rbx, rax
cmp rax, rdi
je 0x2a0e0
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, edi
jl 0x2a16e
mov esi, edi
cmp dword [rbx], edi
jbe 0x2a16b
lea rbp, [rbx + 0x2e]
movzx ecx, word [rbp]
mov eax, esi
mov rdx, r14
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call fcn.0002f246
cmp eax, edi
je 0x2a150
inc esi
add rbp, 0x128
cmp esi, dword [rbx]
jb 0x2a120
jmp 0x2a16b
mov eax, esi
imul rax, rax, 0x128
mov r12, qword [rax + rbx + 0x18]
cmp r13, rdi
je 0x2a16b
mov eax, dword [rax + rbx + 0x20]
mov dword [r13], eax
mov rdi, r12
mov rcx, rbx
call fcn.0002e49c
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x2a1d8
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x2a1f7
xor eax, eax
jmp 0x2a212
mov rcx, qword [rsp + 0x38]
call fcn.0002f7fa
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret