Function at 0x315c0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
xor ebx, ebx
mov eax, 0x1000
mov edx, eax
mov ecx, 1
mov dword [rsp + 0x38], eax
call fcn.000365b8
mov rsi, rax
cmp rax, rbx
je 0x31660
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rax
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x31628
mov rcx, rsi
call fcn.00036630
mov eax, dword [rsp + 0x38]
add eax, 0x4000
jmp 0x315de
cmp eax, ebx
jl 0x31653
mov rdi, rsi
mov rcx, qword [rdi + 0x40]
cmp rcx, rbx
je 0x31644
mov rdx, rbp
call fcn.0003ad4e
cmp eax, ebx
je 0x3164f
cmp dword [rdi], ebx
je 0x31653
mov eax, dword [rdi]
add rdi, rax
jmp 0x3162f
mov rbx, qword [rdi + 0x50]
mov rcx, rsi
call fcn.00036630
mov rax, rbx
jmp 0x31662
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x317f4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 0x18]
lea rdx, [rax + 0x10]
lea rcx, [rax + 8]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
cmp dword [rsp + 0x40], 5
jne 0x31823
cmp dword [rsp + 0x48], 2
jne 0x31823
mov al, 1
jmp 0x31825
xor al, al
add rsp, 0x38
ret

Function at 0x31830
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
xor edi, edi
mov r13, rdx
mov r14, rcx
lea esi, [rdi + 0xb]
lea r9, [rax + 0x18]
xor r8d, r8d
xor edx, edx
mov ecx, esi
mov r12, rdi
mov dword [rax + 0x18], edi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
je 0x31877
xor eax, eax
jmp 0x31909
mov edx, dword [rsp + 0x60]
mov ecx, 1
call fcn.000365b8
mov rbx, rax
cmp rax, rdi
je 0x31870
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x60]
mov rdx, rax
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, edi
jl 0x318fe
mov esi, edi
cmp dword [rbx], edi
jbe 0x318fb
lea rbp, [rbx + 0x2e]
movzx ecx, word [rbp]
mov eax, esi
mov rdx, r14
imul rax, rax, 0x128
add rax, rbx
lea rcx, [rcx + rax + 0x30]
call sub.ntoskrnl.exe__stricmp
cmp eax, edi
je 0x318e0
inc esi
add rbp, 0x128
cmp esi, dword [rbx]
jb 0x318b0
jmp 0x318fb
mov eax, esi
imul rax, rax, 0x128
mov r12, qword [rax + rbx + 0x18]
cmp r13, rdi
je 0x318fb
mov eax, dword [rax + rbx + 0x20]
mov dword [r13], eax
mov rdi, r12
mov rcx, rbx
call fcn.00036630
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x31968
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x38], 0
lea rdx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x31987
xor eax, eax
jmp 0x319a2
mov rcx, qword [rsp + 0x38]
call fcn.0003b2ba
mov rcx, qword [rsp + 0x38]
mov rbx, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rbx
add rsp, 0x20
pop rbx
ret