Function at 0x2100974d0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12d, 0x100
mov qword [rsp + 0xa0], rcx
lea rsi, [rsp + 0x44]
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], r8
jmp 0x210097547
mov r8d, edi
mov r9, rsi
mov rdx, rax
mov ecx, 5
call sym.NtQuerySystemInformation
mov edi, eax
test eax, eax
jns 0x21009757f
call sym.GetProcessHeap
add r12d, r12d
mov r8, rbx
xor edx, edx
mov rcx, rax
call sym.HeapFree
cmp r12d, 0xfffff
ja 0x210097568
cmp edi, 0xc0000004
jne 0x210097568
call sym.GetProcessHeap
imul edi, r12d, 0x150
xor edx, edx
mov rcx, rax
mov r8d, edi
call sym.HeapAlloc
mov rbx, rax
test rax, rax
jne 0x210097508
xor r13d, r13d
mov rax, r13
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.GetProcessHeap
mov r8d, r12d
xor edx, edx
mov rcx, rax
shl r8, 2
call sym.HeapAlloc
mov r13, rax
test rax, rax
je 0x210097830
mov rax, qword [rbx + 0x50]
mov dword [r13], eax
mov eax, dword [rbx]
test eax, eax
je 0x210097817
mov rdx, rbx
mov ecx, 1
nop dword [rax + rax]
add rdx, rax
mov eax, ecx
add ecx, 1
mov r8, qword [rdx + 0x50]
mov rdi, rax
mov dword [r13 + rax*4], r8d
mov eax, dword [rdx]
test eax, eax
jne 0x2100975c0
call sym.GetProcessHeap
xor edx, edx
mov r8, rbx
mov rcx, rax
call sym.HeapFree
test edi, edi
js 0x2100976a1
movsxd rdi, edi
lea r14, [rsp + 0x48]
nop dword [rax]
mov r8d, dword [r13 + rdi*4]
xor edx, edx
mov ecx, 0x440
call sym.OpenProcess
mov r12, rax
test rax, rax
je 0x210097695
mov ebx, 0x100
jmp 0x210097669
mov qword [rax], 0
mov r9d, ebp
mov r8, rax
mov rcx, r12
mov qword [rsp + 0x20], rsi
mov edx, 0x33
call sym.NtQueryInformationProcess
mov ebp, eax
test eax, eax
jns 0x2100976c0
call sym.GetProcessHeap
add ebx, ebx
mov r8, r15
xor edx, edx
mov rcx, rax
call sym.HeapFree
cmp ebx, 0xfffff
ja 0x21009768d
cmp ebp, 0xc0000004
jne 0x21009768d
lea eax, [rbx + rbx*4]
lea ebp, [rax*8 + 0x10]
call sym.GetProcessHeap
mov r8d, ebp
xor edx, edx
mov rcx, rax
call sym.HeapAlloc
mov r15, rax
test rax, rax
jne 0x210097620
mov rcx, r12
call sym.CloseHandle
sub rdi, 1
test edi, edi
jns 0x210097600
call sym.GetProcessHeap
mov r8, r13
xor edx, edx
mov rcx, rax
call sym.HeapFree
jmp 0x210097568
mov rdx, qword [r15]
cmp rdx, rbx
ja 0x210097847
xor ebx, ebx
xor eax, eax
test rdx, rdx
jne 0x2100976ef
jmp 0x2100977b0
lea eax, [rbx + 1]
mov rbx, rax
cmp rax, qword [r15]
jae 0x2100977b0
lea rax, [rax + rax*4]
lea rbp, [r15 + rax*8]
cmp dword [rbp + 0x28], 0x120199
jne 0x2100976e0
mov rax, qword [rbp + 0x10]
mov qword [rsp + 0x48], rax
call sym.GetCurrentProcess
mov rdx, qword [rsp + 0x48]
mov r9, r14
mov rcx, r12
mov dword [rsp + 0x30], 0
mov r8, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call sym.DuplicateHandle
test eax, eax
je 0x2100976e0
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsp + 0x48]
mov edx, 1
mov r9d, 0x10000
mov r8, qword [rsp + 0xb0]
call sym.NtQueryObject
test eax, eax
js 0x210097792
mov rax, qword [rsp + 0xb0]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x210097792
movzx eax, word [rax]
xor ecx, ecx
and rax, 0xfffffffffffffffe
mov word [rdx + rax], cx
mov rcx, qword [rsp + 0xa8]
call sym.msys_2.0.dll_wcscmp
test eax, eax
je 0x2100977c7
mov rcx, qword [rsp + 0x48]
call sym.CloseHandle
lea eax, [rbx + 1]
mov rbx, rax
cmp rax, qword [r15]
jb 0x2100976ef
nop dword [rax + rax]
call sym.GetProcessHeap
mov r8, r15
xor edx, edx
mov rcx, rax
call sym.HeapFree
jmp 0x21009768d
mov rax, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xa0]
mov qword [rax + 0x1f8], r12
mov rax, qword [rbp + 0x10]
mov qword [rsi + 0x200], rax
call sym.GetProcessHeap
mov r8, r15
xor edx, edx
mov rcx, rax
call sym.HeapFree
call sym.GetProcessHeap
mov r8, r13
xor edx, edx
mov rcx, rax
call sym.HeapFree
mov r13, qword [rsp + 0x48]
jmp 0x21009756b
call sym.GetProcessHeap
mov r8, rbx
xor edx, edx
xor edi, edi
mov rcx, rax
call sym.HeapFree
jmp 0x2100975f4
call sym.GetProcessHeap
mov r8, rbx
xor edx, edx
mov rcx, rax
call sym.HeapFree
jmp 0x21009756b
lea r9, str.phi__NumberOfHandles___n_handle
lea r8, str.void_fhandler_pipe::get_query_hdl_per_process_WCHAR__OBJECT_NAME_INFORMATION_
mov edx, 0x519
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygwin_fhandler_pipe.cc
call sym.msys_2.0.dll___assert_func
nop
nop
nop dword [rax + rax]