Function at 0x1400618dc
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
mov edi, edx
mov rsi, rcx
mov word [rsp + 0x20], di
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x22], al
call fcn.14006297d
mov qword [rsp + 0x40], rax
mov r12d, 0x80000
lea r14, [rsp + 0x24]
mov r13, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea r15, [rsp + 0x50]
mov rcx, r12
xor edx, edx
call fcn.14003443b
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
and dword [rsp + 0x24], 0
mov qword [rsp + 0x60], r12
mov ecx, 5
mov r8d, r12d
mov r9, r14
call r13
cmp eax, 0xc0000004
jne 0x140061987
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x140061971
add eax, 0x2800
jb 0x140061b55
mov r12d, eax
jmp 0x14006197d
test r12, r12
js 0x140061b6a
add r12, r12
mov rcx, r15
call fcn.1400041c4
jmp 0x140061923
xor r15d, r15d
mov ecx, 0x1f4
xor edx, edx
call fcn.14005a4a3
lea r14, [rsp + 0x28]
mov qword [r14], rax
mov qword [r14 + 8], rdx
and qword [r14 + 0x10], 0
xor r12d, r12d
lea r13, [rbx + r12]
cmp r15, rax
jne 0x1400619c3
mov rcx, r14
mov rdx, rax
call fcn.14005ac69
mov r15, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov qword [rax + r15*8], r13
mov r15, qword [rsp + 0x38]
inc r15
mov qword [rsp + 0x38], r15
mov eax, dword [r13]
test rax, rax
je 0x1400619f2
add r12, rax
jo 0x140061b45
mov rax, qword [rsp + 0x28]
jmp 0x1400619aa
lea rbx, [rsi + 0x40]
mov qword [rsp + 0x48], rbx
test dil, dil
je 0x140061a11
add rsi, 0xa0
mov rcx, rsi
call fcn.14005e721
jmp 0x140061a13
xor eax, eax
lea rcx, [rsp + 0x88]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38]
lea r14, [rsp + 0x1f8]
mov qword [r14 + 0x30], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r14 + 0x20], xmm0
lea rax, [rsp + 0x48]
mov qword [r14], rax
lea rax, [rsp + 0x20]
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rcx
lea rax, [rsp + 0x40]
mov qword [r14 + 0x18], rax
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov rdx, r14
call fcn.14005ad68
mov rax, qword [rsi]
imul r13, qword [rsi + 0x10], 0x150
mov rsi, qword [rsi + 8]
lea rcx, [rsi + r13]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rsi
lea r15, [rsp + 0x130]
lea r12, [rsp + 0xa8]
test r13, r13
je 0x140061b14
lea rbp, [rsi + 0x150]
mov qword [rsp + 0x70], rbp
mov rax, qword [rsi + 0x80]
cmp rax, 2
je 0x140061b14
lea rdx, [rsi + 0x88]
mov ecx, 0x10
mov rdi, r12
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x128], rax
mov r8d, 0xc8
mov rcx, r15
call fcn.140063aa0
mov r8, qword [rsp + 0x138]
mov rcx, r14
mov rdx, rbx
mov r9, r12
call fcn.14005c646
mov rcx, r14
call fcn.1400598cc
add r13, 0xfffffffffffffeb0
mov rsi, rbp
jmp 0x140061aa4
lea rcx, [rsp + 0x68]
call fcn.14005bf31
mov rcx, rbx
call fcn.14005c70e
lea rcx, [rsp + 0x50]
call fcn.1400041c4
nop
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.attempt_to_add_with_overflow
lea r8, [0x1400978d0]
jmp 0x140061b63
lea rcx, str.attempt_to_add_with_overflow
lea r8, [0x1400978e8]
mov edx, 0x1c
jmp 0x140061b7d
lea rcx, str.attempt_to_multiply_with_overflow
lea r8, str.x_t_
mov edx, 0x21
call fcn.140071a80
ud2