Function at 0x1400e6970
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4b8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x420], xmm6
mov qword [rbp + 0x418], 0xfffffffffffffffe
mov rsi, rcx
mov word [rbp + 0x410], dx
shr edx, 0x10
mov byte [rbp + 0x412], dl
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e69dd
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e735f
mov rcx, rax
mov qword [0x1402443c8], rax
mov r13d, 0x80000
mov r8d, 0x80000
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e735f
mov rdi, rax
mov qword [rbp + 0x3e0], rax
mov qword [rbp + 0x3e8], 0x80000
mov qword [rbp + 0x3f0], 0
xor edx, edx
lea rbx, [rbp + 0x3e0]
lea r15, [rbp + 0xf0]
mov r12, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, 0x80000
mov dword [rbp + 0xf0], 0
sub r13, rdx
cmp r13, r14
jae 0x1400e6a62
nop dword [rax]
mov rcx, rbx
mov r8, r14
call fcn.140165ee0
mov rdi, qword [rbp + 0x3e0]
mov ecx, 5
mov rdx, rdi
mov r8d, r14d
mov r9, r15
call r12
cmp eax, 0xc0000004
jne 0x1400e6ab1
mov eax, dword [rbp + 0xf0]
add r14, r14
lea ecx, [rax + 0x2800]
test eax, eax
cmovne r14, rcx
mov r13, qword [rbp + 0x3e8]
mov rdx, qword [rbp + 0x3f0]
mov dword [rbp + 0xf0], 0
sub r13, rdx
cmp r13, r14
jb 0x1400e6a50
jmp 0x1400e6a62
test eax, eax
jne 0x1400e6b87
mov qword [rbp + 0x3f0], r14
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e6aec
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e7370
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0xfa0
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e7370
mov rbx, rax
mov qword [rbp + 0x3c8], rax
mov qword [rbp + 0x3d0], 0x1f4
mov qword [rbp + 0x3d8], 0
xor r14d, r14d
lea r15, [rbp + 0x3c8]
xor r12d, r12d
jmp 0x1400e6b6a
mov rbx, qword [rbp + 0x3c8]
mov r14, qword [rbp + 0x3d8]
lea rax, [rdi + r12]
mov qword [rbx + r14*8], rax
inc r14
mov qword [rbp + 0x3d8], r14
mov eax, dword [rax]
add r12, rax
test rax, rax
je 0x1400e6ba6
cmp r14, qword [rbp + 0x3d0]
jne 0x1400e6b4e
mov byte [rbp + 0x417], 1
mov rcx, r15
mov rdx, r14
call fcn.140053040
jmp 0x1400e6b40
cmp qword [rbp + 0x3e8], 0
je 0x1400e7344
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, rdi
jmp 0x1400e733e
lea rax, [rsi + 0x40]
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x390], rax
cmp byte [rbp + 0x410], 0
je 0x1400e6bdf
lea rcx, [rsi + 0x110]
mov byte [rbp + 0x417], 1
xor edx, edx
call fcn.1400e9030
mov rax, qword [rsi + 0x190]
jmp 0x1400e6be1
xor eax, eax
mov qword [rbp + 0x388], rax
mov qword [rbp + 0xf0], 0
mov rax, qword [0x1402440b8]
lea rcx, [rbp + 0xf0]
call rax
mov rax, qword [rbp + 0xf0]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x1400e6c39
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
jmp 0x1400e6c3b
xor edx, edx
mov qword [rbp + 0x380], rdx
mov rax, qword [rbp + 0x3d0]
lea rcx, [rbx + r14*8]
mov qword [rbp + 0x2c8], rbx
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2d8], rbx
mov qword [rbp + 0x2e0], rcx
lea rax, [rbp + 0x390]
mov qword [rbp + 0x2e8], rax
lea rax, [rbp + 0x410]
mov qword [rbp + 0x2f0], rax
lea rax, [rbp + 0x388]
mov qword [rbp + 0x2f8], rax
lea rax, [rbp + 0x380]
mov qword [rbp + 0x300], rax
mov byte [rbp + 0x416], 1
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0x2c8]
call fcn.1400e9ed0
cmp dword [rbp + 0xf0], 2
jne 0x1400e6d29
cmp qword [rbp + 0x2d0], 0
je 0x1400e6ce4
mov r8, qword [rbp + 0x2c8]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rbp + 0x3a0], 8
mov qword [rbp + 0x3a8], 0
mov qword [rbp + 0x3b0], 8
mov qword [rbp + 0x3b8], 8
mov r13d, 8
xor r15d, r15d
mov ebx, 8
mov r14d, 8
jmp 0x1400e717a
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e6d55
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e7381
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0x540
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e7381
mov rbx, rax
lea r14, [rbp + 0xf0]
mov r8d, 0x150
mov rcx, rax
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x240], rbx
mov qword [rbp + 0x248], 4
mov qword [rbp + 0x250], 1
movdqu xmm0, xmmword [rbp + 0x2c8]
movdqu xmm1, xmmword [rbp + 0x2d8]
movdqu xmm2, xmmword [rbp + 0x2e8]
movups xmm3, xmmword [rbp + 0x2f8]
movaps xmmword [rbp - 0x30], xmm3
movdqa xmmword [rbp - 0x40], xmm2
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x60], xmm0
mov edi, 1
lea r15, [rbp - 0x60]
lea r12, [rbp + 0x240]
jmp 0x1400e6e12
imul rcx, rdi, 0x150
add rcx, rbx
mov r8d, 0x150
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc rdi
mov qword [rbp + 0x250], rdi
mov rcx, r14
mov rdx, r15
call fcn.1400e9ed0
cmp dword [rbp + 0xf0], 2
je 0x1400e6e43
cmp rdi, qword [rbp + 0x248]
jne 0x1400e6df0
mov rcx, r12
mov rdx, rdi
call fcn.140169c00
mov rbx, qword [rbp + 0x240]
jmp 0x1400e6df0
cmp qword [rbp - 0x58], 0
je 0x1400e6e5d
mov r8, qword [rbp - 0x60]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov r15, qword [rbp + 0x248]
imul r13, rdi, 0x150
add r13, rbx
mov qword [rbp + 0x3a0], rbx
mov qword [rbp + 0x3a8], r15
mov qword [rbp + 0x3b0], rbx
mov qword [rbp + 0x3b8], r13
test rdi, rdi
je 0x1400e6ebb
mov qword [rbp + 0x3c0], r15
mov qword [rbp + 0x408], rsi
lea rax, [rsi + 0x60]
mov qword [rbp + 0x398], rax
lea rdi, [rbp + 0x2c8]
pcmpeqd xmm6, xmm6
mov r12, rbx
jmp 0x1400e6f39
mov r14, rbx
jmp 0x1400e717a
and r8b, 1
movzx r8d, r8b
mov r9, qword [rbp + 0x408]
sub qword [r9 + 0x50], r8
lea r8, [rdx - 0x10]
and rax, r8
mov byte [r12 + rdx], cl
mov byte [rax + r12 + 0x10], cl
inc qword [r9 + 0x58]
neg rdx
imul rax, rdx, 0x158
mov qword [r12 + rax - 0x158], r15
lea rcx, [r12 + rax]
add rcx, 0xfffffffffffffeb0
mov r8d, 0x150
lea rdx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memcpy
mov r12, qword [rbp + 0x400]
mov r13, rsi
mov rdi, r14
nop word cs:[rax + rax]
cmp r12, r13
je 0x1400e7169
mov rsi, r13
lea r14, [r12 + 0x150]
mov qword [rbp + 0x3b0], r14
mov r13, qword [r12]
lea rdx, [r12 + 8]
mov r8d, 0xb8
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
cmp r13, 2
je 0x1400e715d
mov qword [rbp + 0x400], r14
mov r15, qword [r12 + 0xc0]
add r12, 0xc8
mov r8d, 0xb8
lea rcx, [rbp + 0xf8]
mov r14, rdi
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x88
lea rdi, [rbp + 0x240]
mov rcx, rdi
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0x1b0], r15
mov r8d, 0x88
lea rcx, [rbp + 0x1b8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0x408]
mov rcx, qword [rdi + 0x60]
mov rdx, qword [rdi + 0x68]
mov r8, r15
call fcn.1400ec600
mov r13, rax
cmp qword [rdi + 0x50], 0
jne 0x1400e7009
mov rcx, qword [rbp + 0x3f8]
mov rdx, qword [rbp + 0x398]
call fcn.140169cd0
mov r12, qword [rdi + 0x40]
mov rax, qword [rdi + 0x48]
mov rcx, r13
shr rcx, 0x39
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r8d, r8d
xor r9d, r9d
and r13, rax
movdqu xmm1, xmmword [r12 + r13]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r10d, xmm2
nop word cs:[rax + rax]
test r10w, r10w
je 0x1400e7090
lea edi, [r10 - 1]
and edi, r10d
tzcnt r10d, r10d
add r10, r13
and r10, rax
neg r10
imul r11, r10, 0x158
mov r10d, edi
cmp qword [r12 + r11 - 0x158], r15
jne 0x1400e7050
jmp 0x1400e70e0
cmp r9, 1
mov r9d, 1
je 0x1400e70b3
pmovmskb edx, xmm1
xor r9d, r9d
test edx, edx
setne r9b
tzcnt edx, edx
add rdx, r13
and rdx, rax
pcmpeqb xmm1, xmm6
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x1400e7137
add r13, r8
add r13, 0x10
add r8, 0x10
jmp 0x1400e7030
add r12, r11
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rbp - 0x60]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x150
mov rcx, r12
lea rdx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp - 0x60], 2
mov r12, qword [rbp + 0x400]
mov r13, rsi
mov rdi, r14
je 0x1400e6f30
lea rcx, [rbp - 0x60]
call fcn.1400e7990
jmp 0x1400e6f30
movzx r8d, byte [r12 + rdx]
test r8b, r8b
js 0x1400e6ec3
movdqa xmm0, xmmword [r12]
pmovmskb edx, xmm0
tzcnt edx, edx
movzx r8d, byte [r12 + rdx]
jmp 0x1400e6ec3
mov r15, qword [rbp + 0x3c0]
mov r13, rsi
jmp 0x1400e7173
mov r14, r13
mov r15, qword [rbp + 0x3c0]
mov rsi, qword [rbp + 0x408]
sub r13, r14
shr r13, 4
movabs rcx, 0xc30c30c30c30c31
mov rax, r13
mul rcx
mov qword [rbp + 0x3f8], rdx
xor eax, eax
mov qword [rbp + 0x408], rax
mov qword [rbp + 0x400], r14
mov rcx, r14
nop dword [rax + rax]
mov rax, qword [rbp + 0x408]
cmp qword [rbp + 0x3f8], rax
je 0x1400e71db
inc rax
mov qword [rbp + 0x408], rax
lea rdi, [rcx + 0x150]
call fcn.1400e7990
mov rcx, rdi
jmp 0x1400e71b0
test r15, r15
je 0x1400e71f2
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rdi, qword [rsi + 0x58]
test rdi, rdi
je 0x1400e7324
mov rbx, qword [rsi + 0x40]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
movabs r15, 0x82fa0be82fa0be83
pcmpeqd xmm6, xmm6
jmp 0x1400e7268
lea rcx, [rbx + rax]
add rcx, 0xfffffffffffffeb0
mov byte [rdx + r8], r10b
mov byte [r9 + rdx + 0x10], r10b
dec qword [rsi + 0x58]
mov byte [rbp + 0x417], 0
call fcn.1400e7990
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rdi
je 0x1400e7324
test r12w, r12w
jne 0x1400e7291
nop
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rbx, 0xffffffffffffea80
add r14, 0x10
cmp r12d, 0xffff
je 0x1400e7270
not r12d
tzcnt eax, r12d
neg rax
imul rax, rax, 0x158
cmp byte [rbx + rax - 4], 0
mov byte [rbx + rax - 4], 0
jne 0x1400e7254
mov rdx, qword [rsi + 0x40]
mov r8, rdx
sub r8, rbx
sub r8, rax
sar r8, 3
imul r8, r15
lea r9, [r8 - 0x10]
and r9, qword [rsi + 0x48]
movdqu xmm0, xmmword [rdx + r9]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb ecx, xmm0
test ecx, ecx
je 0x1400e72e9
bsr cx, cx
xor ecx, 0xf
jmp 0x1400e72ed
mov cx, 0x10
movdqu xmm0, xmmword [rdx + r8]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
tzcnt r10d, r10d
add ecx, r10d
mov r10b, 0x80
cmp cx, 0xf
ja 0x1400e7230
inc qword [rsi + 0x50]
mov r10b, 0xff
jmp 0x1400e7230
cmp qword [rbp + 0x3e8], 0
je 0x1400e7344
mov r8, qword [rbp + 0x3e0]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rbp + 0x420]
add rsp, 0x4b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x80000
call fcn.140162bd0
ud2
mov ecx, 8
mov edx, 0xfa0
call fcn.140162bd0
jmp 0x1400e7390
mov ecx, 8
mov edx, 0x540
call fcn.140162bd0
ud2