Function at 0x140020a42
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x388
movdqa xmmword [rsp + 0x370], xmm6
mov rsi, rdx
mov qword [rsp + 0x40], rcx
lea r14, [rsp + 0x150]
mov edi, 0x80000
mov edx, 0x80000
mov rcx, r14
xor r8d, r8d
call fcn.140022294
cmp qword [r14], 0
mov rcx, qword [r14 + 8]
jne 0x14002145b
lea r15, [rsp + 0x150]
mov rax, qword [r15 + 0x10]
lea r12, [rsp + 0x58]
mov qword [r12], rcx
mov qword [r12 + 8], rax
and qword [r12 + 0x10], 0
xor edx, edx
movabs r13, 0x8000000000000001
mov rbp, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
and dword [rsp + 0x150], 0
sub rcx, rdx
cmp rcx, rdi
jae 0x140020ae8
mov rcx, r12
mov r8, rdi
call fcn.1400071a8
cmp rax, r13
jne 0x140021453
mov r14, qword [rsp + 0x60]
mov ecx, 5
mov rdx, r14
mov r8d, edi
mov r9, r15
call rbp
test eax, eax
jns 0x140020b4f
or eax, 0x10000000
mov ecx, eax
call fcn.14002264a
cmp edx, 0xd0000004
jne 0x140020bf4
mov ecx, dword [rsp + 0x150]
mov rdx, rdi
add rdx, rdi
lea edi, [rcx + 0x2800]
test ecx, ecx
cmove rdi, rdx
test rax, rax
je 0x140020b40
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
jmp 0x140020ac4
mov qword [rsp + 0x68], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.1400217d3
test rax, rax
je 0x140021468
lea rdi, [rsp + 0x98]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
xor r15d, r15d
xor r12d, r12d
mov r13d, dword [r14 + r12]
cmp r15, qword [rsp + 0x98]
jne 0x140020ba8
mov rcx, rdi
call fcn.140021a52
mov rax, qword [rsp + 0xa0]
lea rcx, [r14 + r12]
mov qword [rax + r15*8], rcx
inc r15
mov qword [rsp + 0xa8], r15
add r12, r13
test r13d, r13d
jne 0x140020b8a
mov rdi, qword [rsp + 0x40]
lea rax, [rdi + 0x90]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xb0], rax
cmp byte [rsi], 0
je 0x140020c14
mov rcx, rdi
xor edx, edx
call fcn.14001e934
mov rax, qword [rdi + 0x80]
jmp 0x140020c16
test rax, rax
je 0x140020c07
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, r14
jmp 0x14002141e
xor eax, eax
lea r14, [rsp + 0xd0]
mov qword [r14], rax
lea rdi, [rsp + 0x150]
and qword [rdi], 0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetSystemTimePreciseAsFileTime]
mov rcx, qword [rdi]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovl rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovl rax, r9
lea rcx, [rsp + 0xd8]
mov qword [rcx], rax
mov r15, qword [rsp + 0xa8]
mov qword [rdi + 0x10], r15
movups xmm0, xmmword [rsp + 0x98]
and qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 8
and qword [rsp + 0xf0], 0
movaps xmmword [rdi], xmm0
lea rax, [rsp + 0xb0]
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rsi
mov qword [rdi + 0x28], r14
mov qword [rdi + 0x30], rcx
mov rdi, qword [rdi]
cmp rdi, r15
jb 0x140021477
lea rsi, [rsp + 0x168]
mov r12, qword [rsi - 0x10]
call fcn.140009b0f
xor r9d, r9d
cmp r15, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
mov rdx, r15
xor r8d, r8d
call fcn.14001f1f3
test rdi, rdi
je 0x140020d43
shl rdi, 3
mov edx, 8
mov rcx, r12
mov r8, rdi
call fcn.140021710
mov rax, qword [rsp + 0x2b0]
xor r8d, r8d
sub rax, 1
jb 0x140020d66
mov rsi, qword [rsi]
test rsi, rsi
je 0x140020d66
add r8, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140020d4e
test r8, r8
jne 0x14002143f
movups xmm0, xmmword [rsp + 0x2a0]
lea rbp, [rsp + 0x158]
movaps xmmword [rbp - 8], xmm0
mov r14, qword [rsp + 0x2b0]
mov qword [rbp + 8], r14
mov rcx, qword [rbp - 8]
lea rbx, [rsp + 0xe0]
test rcx, rcx
je 0x140020e54
mov rsi, qword [rcx + 0x18]
lea rax, [rsi + 0x20]
test rsi, rsi
cmove rax, rbp
and qword [rax], 0
mov rdi, qword [rcx]
mov r15, qword [rcx + 8]
mov r12, qword [rcx + 0x10]
mov edx, 8
call fcn.140002310
movabs rax, 0x8000000000000000
cmp rdi, rax
je 0x140020e58
mov rax, qword [rsp + 0xe0]
mov r13, qword [rsp + 0xf0]
sub rax, r13
cmp rax, r12
jb 0x140020e3c
imul rcx, r13, 0x150
add rcx, qword [rsp + 0xe8]
imul r8, r12, 0x150
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add r13, r12
mov qword [rsp + 0xf0], r13
mov rcx, r15
xor edx, edx
call fcn.140021529
mov rcx, rdi
mov rdx, r15
call fcn.140021bb6
dec r14
mov rcx, rsi
jmp 0x140020d9b
mov rcx, rbx
mov rdx, r13
mov r8, r12
call fcn.140025662
mov r13, qword [rsp + 0xf0]
jmp 0x140020df3
xor esi, esi
jmp 0x140020e5b
dec r14
lea rcx, [rsp + 0x150]
mov qword [rcx], rsi
mov qword [rcx + 0x10], r14
call fcn.1400216ba
lea rbx, [rsp + 0xe0]
mov rax, qword [rbx]
mov qword [rsp + 0x90], rax
imul rsi, qword [rbx + 0x10], 0x150
mov r13, qword [rbx + 8]
lea rax, [rsi + r13]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x40]
add rax, 0xb0
mov qword [rsp + 0x78], rax
lea r14, [rsp + 0x2a0]
mov qword [rsp + 0x88], r13
test rsi, rsi
je 0x140021180
mov rbp, qword [r13]
cmp rbp, 2
je 0x140021179
mov qword [rsp + 0x50], rsi
lea rdx, [r13 + 8]
mov r8d, 0xd0
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [r13 + 0xd8]
lea rsi, [r13 + 0xe0]
mov ecx, 0xe
mov rdi, rbx
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x70], r15
mov r14, qword [rsp + 0x40]
mov rcx, qword [r14 + 0xb0]
mov rdx, qword [r14 + 0xb8]
mov r8, r15
call fcn.1400205b3
mov rsi, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0xb8], rax
cmp qword [r14 + 0xa0], 0
je 0x140021165
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc8], rax
mov rcx, qword [r14 + 0x90]
mov rdx, qword [r14 + 0x98]
lea rax, [0x140020a1c]
mov qword [rsp + 0x20], rax
mov r8, rsi
lea r9, [rsp + 0xc0]
call fcn.1400208f9
mov rdi, qword [r14 + 0x90]
test rax, rax
je 0x140021021
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [r14 + 0xa0], rax
mov rax, qword [rsp + 0x70]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [r14 + 0x98]
mov byte [rdi + rdx], sil
mov byte [rdi + rcx + 0x10], sil
inc qword [r14 + 0xa8]
neg rdx
imul r12, rdx, 0x158
lea rsi, [rdi + r12]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], rbp
mov r8d, 0xd0
mov rcx, rsi
lea r14, [rsp + 0x2a0]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi + 0xd0], r15
add rdi, r12
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
mov rsi, qword [rsp + 0x50]
jmp 0x140021152
neg rdx
imul r12, rdx, 0x158
lea rsi, [rdi + r12]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x150]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], rbp
lea rsi, [rdi + r12]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
mov rcx, rsi
lea r14, [rsp + 0x2a0]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi + 0xd0], r15
add rdi, r12
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, rbx
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x150], 2
mov rsi, qword [rsp + 0x50]
je 0x140021152
mov rcx, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x168]
call fcn.1400223a8
lea rcx, [rsp + 0x178]
call fcn.14001d5f1
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
call fcn.14001db4e
mov rcx, qword [rsp + 0x1c8]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x1400210fb
mov rdx, qword [rsp + 0x1d0]
call fcn.1400223a8
lea rcx, [rsp + 0x190]
call fcn.14001d5f1
mov rcx, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1e8]
call fcn.14001db4e
mov rcx, qword [rsp + 0x200]
mov rdx, qword [rsp + 0x208]
call fcn.14001db4e
mov rax, qword [rsp + 0x240]
test rax, rax
je 0x140021152
lock dec qword [rax]
jne 0x140021152
lea rcx, [rsp + 0x240]
call fcn.140021fe6
add r13, 0x150
add rsi, 0xfffffffffffffeb0
jmp 0x140020eba
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x78]
call fcn.14002547f
jmp 0x140020f3f
add r13, 0x150
mov rax, qword [rsp + 0x80]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rsi, rax
add r13, 0xf0
movabs rdi, 0x8000000000000000
mov rbx, qword [rsp + 0x40]
sub rsi, 1
jb 0x140021245
mov rcx, qword [r13 - 0xe0]
mov rdx, qword [r13 - 0xd8]
call fcn.1400223a8
lea rcx, [r13 - 0xc8]
call fcn.14001d5f1
mov rcx, qword [r13 - 0x98]
mov rdx, qword [r13 - 0x90]
call fcn.14001db4e
mov rcx, qword [r13 - 0x78]
cmp rcx, rdi
je 0x1400211fc
mov rdx, qword [r13 - 0x70]
call fcn.1400223a8
lea rcx, [r13 - 0xb0]
call fcn.14001d5f1
mov rcx, qword [r13 - 0x60]
mov rdx, qword [r13 - 0x58]
call fcn.14001db4e
mov rcx, qword [r13 - 0x40]
mov rdx, qword [r13 - 0x38]
call fcn.14001db4e
mov rax, qword [r13]
test rax, rax
je 0x140021239
lock dec qword [rax]
jne 0x140021239
mov rcx, r13
call fcn.140021fe6
add r13, 0x150
jmp 0x1400211ae
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
call fcn.140021bb6
mov rax, qword [rbx + 0x90]
mov rcx, qword [rbx + 0x98]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
lea rsi, [rsp + 0x150]
mov word [rsi + 0x18], dx
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rax, qword [rbx + 0xa8]
mov qword [rsi + 0x20], rax
mov r14d, 0x158
pcmpeqd xmm6, xmm6
test rax, rax
je 0x140021414
mov rcx, rsi
call fcn.14001e46d
dec qword [rsp + 0x170]
test rax, rax
je 0x140021414
mov rdi, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
je 0x1400212e1
mov rax, qword [rsp + 0x170]
jmp 0x1400212a8
mov rcx, qword [rbx + 0x90]
mov rax, rcx
sub rax, rdi
cqo
idiv r14
lea rdx, [rax - 0x10]
and rdx, qword [rbx + 0x98]
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140021321
bsr r8w, r8w
xor r8d, 0xf
jmp 0x140021326
mov r8w, 0x10
movdqu xmm0, xmmword [rcx + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
ja 0x140021356
inc qword [rbx + 0xa0]
mov r9b, 0xff
mov byte [rcx + rax], r9b
mov byte [rcx + rdx + 0x10], r9b
dec qword [rbx + 0xa8]
mov rcx, qword [rdi - 0x140]
mov rdx, qword [rdi - 0x138]
call fcn.1400223a8
lea rcx, [rdi - 0x128]
call fcn.14001d5f1
mov rcx, qword [rdi - 0xf8]
mov rdx, qword [rdi - 0xf0]
call fcn.14001db4e
mov rcx, qword [rdi - 0xd8]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x1400213ba
mov rdx, qword [rdi - 0xd0]
call fcn.1400223a8
lea rcx, [rdi - 0x110]
call fcn.14001d5f1
mov rcx, qword [rdi - 0xc0]
mov rdx, qword [rdi - 0xb8]
call fcn.14001db4e
mov rcx, qword [rdi - 0xa0]
mov rdx, qword [rdi - 0x98]
call fcn.14001db4e
mov rax, qword [rdi - 0x60]
test rax, rax
je 0x1400212d7
lock dec qword [rax]
jne 0x1400212d7
add rdi, 0xffffffffffffffa0
mov rcx, rdi
call fcn.140021fe6
jmp 0x1400212d7
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
call fcn.1400223a8
movaps xmm6, xmmword [rsp + 0x370]
add rsp, 0x388
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xe0]
xor edx, edx
call fcn.140025662
jmp 0x140020d6f
mov rcx, rax
call fcn.140023660
mov rdx, qword [rsp + 0x160]
call fcn.140023660
mov ecx, 8
mov edx, 0xfa0
call fcn.140023660
lea rcx, str.assertion_failed:_vec.capacity_____start___len_sources_rayon_1.10.0_b418a60154510ca1a002a752ca9714984e21e4241e804d32555251faf8b78ffa_src_vec.rsO
lea r8, [0x14004beb0]
mov edx, 0x2f
call fcn.1400238d0
int3