Function at 0x14000a3f0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2f0], 0xfffffffffffffffe
mov qword [rbp + 0x2e0], r9
test rdx, rdx
je 0x14000a44f
mov rdi, r8
test r8, r8
je 0x14000a6b4
mov qword [rbp + 0x2b0], rcx
lea rax, [0x140042998]
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x278], rdx
mov r15, rdx
jmp 0x14000a473
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x278], rdx
lea rax, [0x140042968]
mov qword [rbp + 0x2b8], rax
mov r15d, 8
xor edi, edi
movzx eax, byte [0x14005a181]
mov ebx, 0x80000
mov ecx, 0x80000
mov edx, 1
call fcn.140003aa0
test rax, rax
je 0x14000ab48
mov r12, rax
mov qword [rbp + 0x298], 0x80000
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], 0
xor edx, edx
lea rsi, [rbp + 0x2c0]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, 0x80000
jmp 0x14000a4de
mov rbx, qword [rbp + 0x298]
mov rdx, qword [rbp + 0x2a8]
mov dword [rbp + 0x2c0], 0
sub rbx, rdx
cmp rbx, r14
jae 0x14000a506
lea rcx, [rbp + 0x298]
mov r8, r14
call fcn.14003c1d0
mov r12, qword [rbp + 0x2a0]
mov ecx, 5
mov rdx, r12
mov r8d, r14d
mov r9, rsi
call r13
test eax, eax
jns 0x14000a577
or eax, 0x10000000
mov ecx, eax
call fcn.14000f560
cmp edx, 0xd0000004
jne 0x14000a67c
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], 0xd0000004
mov ecx, dword [rbp + 0x2c0]
mov rdx, r14
add rdx, r14
lea r14d, [rcx + 0x2800]
test ecx, ecx
cmove r14, rdx
test rax, rax
je 0x14000a4d0
lea rcx, [rbp + 0x100]
call fcn.14000f5d0
jmp 0x14000a4d0
mov qword [rbp + 0x2a8], r14
mov qword [rbp + 0x270], 0
movzx eax, byte [0x14005a181]
mov ecx, 0xfa0
mov edx, 8
call fcn.140003aa0
test rax, rax
je 0x14000ab57
mov qword [rbp + 0x280], 0x1f4
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], 0
mov rax, qword [rbp + 0x2b8]
mov rbx, qword [rax + 0x28]
xor r14d, r14d
jmp 0x14000a601
lea rax, [r12 + r14]
mov rcx, qword [rbp + 0x288]
mov qword [rcx + rsi*8], rax
inc rsi
mov qword [rbp + 0x290], rsi
add r14, r13
test r13d, r13d
je 0x14000a647
mov r13d, dword [r12 + r14]
mov rdx, qword [r12 + r14 + 0x50]
mov byte [rbp + 0x2ef], 1
mov ecx, 1
mov r8, r15
mov r9, rdi
call rbx
test al, al
je 0x14000a5f9
mov rsi, qword [rbp + 0x290]
cmp rsi, qword [rbp + 0x280]
jne 0x14000a5e0
mov byte [rbp + 0x2ef], 1
lea rcx, [rbp + 0x280]
call fcn.140001590
jmp 0x14000a5e0
mov rcx, qword [rbp + 0x2b0]
lea rdi, [rcx + 0x40]
mov qword [rbp + 0x268], rdi
mov rax, qword [rbp + 0x2e0]
cmp byte [rax], 0
je 0x14000a6bb
mov byte [rbp + 0x2ef], 1
mov rsi, rcx
xor edx, edx
call fcn.140004090
mov rax, qword [rsi + 0x10]
jmp 0x14000a6bd
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], edx
test rax, rax
je 0x14000a69a
lea rcx, [rbp + 0x100]
call fcn.14000f5d0
mov rdx, qword [rbp + 0x298]
test rdx, rdx
je 0x14000a6b4
mov r8d, 1
mov rcx, r12
call fcn.140003ab0
xor eax, eax
jmp 0x14000ab34
xor eax, eax
mov qword [rbp + 0x260], rax
mov byte [rbp + 0x2ef], 1
call fcn.1400283e0
mov dword [rbp + 0x2c0], eax
mov dword [rbp + 0x2c4], edx
mov byte [rbp + 0x2ef], 1
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0x2c0]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140028410
cmp qword [rbp + 0x100], 0
je 0x14000a710
xor eax, eax
jmp 0x14000a717
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2c8], 8
mov qword [rbp + 0x2d0], 0
lea rax, [rbp + 0x270]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x268]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x2e0]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x260]
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x258]
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x2c0]
lea rdx, [rbp + 0x100]
call fcn.1400069b0
mov rcx, qword [rbp + 0x2c0]
mov r9, qword [rbp + 0x2c8]
mov rdx, qword [rbp + 0x2d0]
imul rax, rdx, 0x158
add rax, r9
mov qword [rbp + 0x2c0], r9
mov r8, r9
mov qword [rbp + 0x2c8], r9
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], rax
test rdx, rdx
je 0x14000aa67
mov rdx, r8
lea rcx, [r8 + 0x158]
mov qword [rbp + 0x2c8], rcx
mov rcx, qword [r8]
cmp rcx, 2
je 0x14000aa5e
lea rbx, [rbp - 0x50]
lea r15, [rbp + 0x100]
lea r12, [rbp - 0x58]
movabs rsi, 0x8000000000000000
nop word cs:[rax + rax]
add rdx, 8
mov qword [rbp - 0x58], rcx
mov r8d, 0x150
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rbp + 0x88]
mov rcx, r15
mov rdx, rdi
mov r9, r12
call fcn.1400078f0
cmp dword [rbp + 0x100], 2
je 0x14000aa30
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x14000a896
mov rcx, qword [rbp + 0x118]
mov r8d, 1
call fcn.140003ab0
mov r13, qword [rbp + 0x140]
test r13, r13
je 0x14000a8e0
mov r14, qword [rbp + 0x138]
add r14, 8
jmp 0x14000a8b9
add r14, 0x20
dec r13
je 0x14000a8e0
mov rdx, qword [r14 - 8]
test rdx, rdx
je 0x14000a8b0
mov rcx, qword [r14]
mov r8d, 1
call fcn.140003ab0
jmp 0x14000a8b0
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x14000a902
mov rcx, qword [rbp + 0x138]
shl rdx, 5
mov r8d, 8
call fcn.140003ab0
mov rdx, qword [rbp + 0x160]
cmp rdx, rsi
je 0x14000a925
test rdx, rdx
je 0x14000a925
mov rcx, qword [rbp + 0x168]
mov r8d, 1
call fcn.140003ab0
mov rdx, qword [rbp + 0x180]
cmp rdx, rsi
je 0x14000a948
test rdx, rdx
je 0x14000a948
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.140003ab0
mov r13, qword [rbp + 0x158]
test r13, r13
je 0x14000a9a0
mov r14, qword [rbp + 0x150]
add r14, 8
jmp 0x14000a979
add r14, 0x20
dec r13
je 0x14000a9a0
mov rdx, qword [r14 - 8]
test rdx, rdx
je 0x14000a970
mov rcx, qword [r14]
mov r8d, 1
call fcn.140003ab0
jmp 0x14000a970
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x14000a9c2
mov rcx, qword [rbp + 0x150]
shl rdx, 5
mov r8d, 8
call fcn.140003ab0
mov rdx, qword [rbp + 0x198]
cmp rdx, rsi
je 0x14000a9e5
test rdx, rdx
je 0x14000a9e5
mov rcx, qword [rbp + 0x1a0]
mov r8d, 1
call fcn.140003ab0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, rsi
je 0x14000aa08
test rdx, rdx
je 0x14000aa08
mov rcx, qword [rbp + 0x1c0]
mov r8d, 1
call fcn.140003ab0
mov rax, qword [rbp + 0x1f8]
test rax, rax
je 0x14000aa30
lock dec qword [rax]
jne 0x14000aa30
lea rcx, [rbp + 0x1f8]
call fcn.14000f080
nop word cs:[rax + rax]
mov rdx, qword [rbp + 0x2c8]
mov rax, qword [rbp + 0x2d8]
cmp rdx, rax
je 0x14000aa6c
lea rcx, [rdx + 0x158]
mov qword [rbp + 0x2c8], rcx
mov rcx, qword [rdx]
cmp rcx, 2
jne 0x14000a840
add rdx, 0x158
jmp 0x14000aa6f
mov rdx, r8
jmp 0x14000aa6f
mov rdx, rax
sub rax, rdx
movabs rcx, 0xbe82fa0be82fa0bf
mov r8, rdx
mul rcx
shr rdx, 8
mov qword [rbp + 0x2b8], rdx
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2b0], r8
mov rcx, r8
mov rax, qword [rbp + 0x2e0]
cmp qword [rbp + 0x2b8], rax
je 0x14000aacb
inc rax
mov qword [rbp + 0x2e0], rax
lea rsi, [rcx + 0x158]
call fcn.140006590
mov rcx, rsi
jmp 0x14000aaa0
mov rax, qword [rbp + 0x2d0]
test rax, rax
je 0x14000aaf0
mov rcx, qword [rbp + 0x2c0]
imul rdx, rax, 0x158
mov r8d, 8
call fcn.140003ab0
cmp qword [rbp + 0x278], 0
jne 0x14000ab09
mov byte [rbp + 0x2ef], 0
mov rcx, rdi
call fcn.140007dd0
mov rax, qword [rbp + 0x270]
mov rdx, qword [rbp + 0x298]
test rdx, rdx
je 0x14000ab34
mov rcx, qword [rbp + 0x2a0]
mov r8d, 1
mov rsi, rax
call fcn.140003ab0
mov rax, rsi
add rsp, 0x378
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x80000
call fcn.140040530
mov ecx, 8
mov edx, 0xfa0
call fcn.140040530
ud2