Function at 0x1b10c
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x30
and dword [rax + 0x18], 0
xor edx, edx
lea r9, [rax + 0x18]
lea edi, [rdx + 5]
xor r8d, r8d
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ebx, eax
cmp eax, 0xc0000004
jne 0x1b4e0
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x1b4e0
add ecx, 0x1000
mov r8d, 0x6c616e41
mov dword [rsp + 0x60], ecx
mov edx, ecx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r13, rax
test rax, rax
je 0x1b4e0
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call fcn.00091d10
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, r13
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ecx, eax
mov ebx, eax
mov eax, 0xc0000000
and ecx, eax
cmp ecx, eax
je 0x1b4d2
inc dword [0x000b3694]
lea rcx, [0x000b3680]
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPopEntrySList]
mov r12, rax
test rax, rax
jne 0x1b1f6
mov edx, dword [0x000b36ac]
mov r8d, dword [0x000b36a8]
mov ecx, dword [0x000b36a4]
inc dword [0x000b3698]
call qword [0x000b36b0]
mov r12, rax
test rax, rax
je 0x1b4d2
mov rbp, r13
mov ebx, 0x12b
xor edx, edx
mov r8d, 0x1380
mov rcx, r12
call fcn.00091d10
mov r8, qword [0x000b5100]
cmp byte [r8 + 0x862c4], 0
je 0x1b24a
mov eax, dword [rbp + 0x58]
and eax, 0xfff
mov edx, eax
add rdx, rdx
imul rax, rax, 0x68
xor r9d, r9d
lea rcx, [rax + r8 + 0xde8]
lea r8, [r8 + rdx*8 + 0x68de8]
mov qword [rsp + 0x20], rcx
jmp 0x1b25e
lea r9, [r8 + 0xdcc]
add r8, 0xdd4
and qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x58]
mov rdx, r12
call fcn.0003141c
mov rcx, qword [rbp + 0x50]
cmp rcx, 4
je 0x1b321
cmp rcx, 8
je 0x1b321
test al, al
je 0x1b321
mov rdx, qword [rbp + 0x58]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call fcn.0001ab98
mov rsi, rax
test rax, rax
je 0x1b482
mov ecx, dword [rax + 0x137c]
mov rdx, qword [rax + 0x1c]
lea r9, [r12 + 0x848]
add ecx, ecx
mov qword [rsp + 0x28], rdx
mov rdx, rbx
lea r8, [rcx + rax + 0x38]
lea rcx, [rax + 0x848]
mov qword [rsp + 0x20], r8
lea r8, [0x00093a90]
call fcn.00014458
mov r11d, dword [rsi + 0x137c]
mov rax, qword [rsi + 0x1c]
lea rdx, [r11 + rsi + 0x240]
mov qword [rsp + 0x28], rax
lea r9, [r12 + 0xaa0]
mov qword [rsp + 0x20], rdx
lea rcx, [rsi + 0xaa0]
lea r8, [0x00093ab0]
mov rdx, rbx
call fcn.000183c0
jmp 0x1b39a
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.0001ab98
mov rsi, rax
test rax, rax
je 0x1b482
mov ecx, dword [rax + 0x137c]
mov rdx, qword [rax + 0x1c]
lea r8, [0x00093a70]
add ecx, ecx
mov qword [rsp + 0x20], rdx
mov rdx, rbx
lea r9, [rcx + rax + 0x38]
lea rcx, [rax + 0x848]
call fcn.00014458
mov r11d, dword [rsi + 0x137c]
mov rax, qword [rsi + 0x1c]
lea r9, [r11 + rsi + 0x240]
lea rcx, [rsi + 0xaa0]
lea r8, [0x00093a80]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.000183c0
mov r11, qword [rbp + 0x20]
mov rcx, qword [0x000b5100]
mov qword [rsi + 0x28], r11
cmp byte [rcx + 0x862c4], 0
je 0x1b412
mov eax, dword [rbp + 0x50]
mov qword [rsi + 8], rsi
mov dl, 1
and eax, 0xfff
mov qword [rsi], rsi
mov edi, eax
mov ebx, eax
imul rdi, rdi, 0x68
lea rcx, [rdi + rcx + 0xde8]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
mov rdx, qword [0x000b5100]
add rbx, rbx
lea rcx, [rdx + rbx*8 + 0x68de8]
mov rax, qword [rcx + 8]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov qword [rax], rsi
mov qword [rcx + 8], rsi
lea rcx, [rdi + rdx + 0xde8]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
mov ebx, 0x12b
jmp 0x1b455
mov qword [rsi + 8], rsi
add rcx, 0xdcc
mov qword [rsi], rsi
call qword [sym.imp.ntoskrnl.exe_KeAcquireSpinLockRaiseToDpc]
mov r8, qword [0x000b5100]
lea rdx, [r8 + 0xdd4]
mov rcx, qword [rdx + 8]
mov qword [rsi], rdx
mov qword [rsi + 8], rcx
mov qword [rcx], rsi
mov qword [rdx + 8], rsi
lea rcx, [r8 + 0xdcc]
mov dl, al
call qword [sym.imp.ntoskrnl.exe_KeReleaseSpinLock]
mov rcx, qword [0x000b5100]
mov r9d, 0x1380
mov r8, rsi
add rcx, 0x70c
mov edx, 0x7270774b
call fcn.0003a228
mov rcx, qword [rbp + 0x50]
mov rdx, rsi
call fcn.00019464
cmp dword [rbp], 0
je 0x1b493
mov eax, dword [rbp]
add rbp, rax
jmp 0x1b1fe
inc dword [0x000b369c]
lea rcx, [0x000b3680]
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_ExQueryDepthSList]
cmp ax, word [0x000b3690]
jb 0x1b4c2
inc dword [0x000b36a0]
mov rcx, r12
call qword [0x000b36b8]
jmp 0x1b4d2
lea rcx, [0x000b3680]
mov rdx, r12
call qword [sym.imp.ntoskrnl.exe_ExpInterlockedPushEntrySList]
mov edx, 0x6c616e41
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret