Function at 0x1400a85f0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movdqa xmmword [rsp + 0x380], xmm6
mov rbx, rdx
mov qword [rsp + 0x40], rcx
mov r14d, 0x80000
mov ecx, 0x80000
xor edx, edx
call fcn.1400da6cb
lea r15, [rsp + 0xc0]
mov qword [r15], rax
mov qword [r15 + 8], rdx
and qword [r15 + 0x10], 0
lea r12, [rsp + 0x240]
lea r13, [rsp + 0xf0]
and dword [rsp + 0x240], 0
mov rcx, r15
mov rdx, r14
call fcn.1400da569
mov rdi, qword [rsp + 0xc0]
mov ecx, 5
mov rdx, rdi
mov r8d, r14d
mov r9, r12
call sub.ntdll.dll_NtQuerySystemInformation
mov rcx, r13
mov edx, eax
call fcn.1400a509d
cmp qword [rsp + 0xf0], 0
je 0x1400a86d0
cmp dword [rsp + 0x100], 0xd0000004
mov rcx, qword [rsp + 0xf8]
jne 0x1400a8771
mov eax, dword [rsp + 0x240]
mov rdx, r14
add rdx, r14
lea r14d, [rax + 0x2800]
test eax, eax
cmove r14, rdx
test rcx, rcx
je 0x1400a864a
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400a864a
mov qword [rsp + 0xd0], r14
mov ecx, 8
mov edx, 0xfa0
call fcn.14003cf80
test rax, rax
je 0x1400a8d8c
lea r14, [rsp + 0x68]
mov qword [r14], rax
mov qword [r14 + 8], 0x1f4
and qword [r14 + 0x10], 0
xor edx, edx
xor r15d, r15d
mov r12d, dword [rdi + r15]
cmp rdx, qword [rsp + 0x70]
jne 0x1400a8727
mov rcx, r14
call fcn.14006af56
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
lea rcx, [rdi + r15]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x78]
inc rdx
mov qword [rsp + 0x78], rdx
add r15, r12
test r12, r12
jne 0x1400a870a
mov rsi, qword [rsp + 0x40]
lea r14, [rsi + 0x40]
mov qword [rsp + 0xd8], r14
cmp byte [rbx], 0
je 0x1400a878c
lea rcx, [rsi + 0x90]
xor edx, edx
call fcn.1400a8db7
mov rax, qword [rsi + 0x110]
jmp 0x1400a878e
test rcx, rcx
je 0x1400a877c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
jmp 0x1400a8d6b
xor eax, eax
mov qword [rsp + 0xe0], rax
lea rdi, [rsp + 0xf0]
and qword [rdi], 0
mov rax, qword [0x1400ee450]
mov rcx, rdi
call rax
mov rax, qword [rdi]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x1400a87c4
xor eax, eax
jmp 0x1400a87db
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0xe8]
mov qword [rcx], rax
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x100], r14
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x48], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rcx
mov rbx, qword [rsp + 0xf8]
cmp rbx, r14
jb 0x1400a8d9d
lea rdi, [rsp + 0x108]
mov r15, qword [rdi - 0x18]
call fcn.14005797b
xor r9d, r9d
cmp r14, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 1
lea rdi, [rsp + 0x2f8]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.1400a5a17
test rbx, rbx
je 0x1400a88c1
shl rbx, 3
mov edx, 8
mov rcx, r15
mov r8, rbx
call fcn.140038d62
mov rax, qword [rsp + 0x308]
xor edx, edx
sub rax, 1
jb 0x1400a88e3
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400a88e3
add rdx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x1400a88cb
lea rcx, [rsp + 0x48]
call fcn.1400a6b91
mov rax, qword [rsp + 0x308]
lea r14, [rsp + 0x240]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x2f8]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0xf8]
lea r15, [rsp + 0xf0]
mov rcx, r14
call fcn.1400a59de
test rax, rax
je 0x1400a89b0
mov rdi, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, rax
call fcn.1400a5a0c
test rdi, rdi
je 0x1400a89b0
mov qword [rsp + 0xf0], rdi
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rbx], xmm0
mov r12, qword [rsp + 0x100]
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1400a6b91
mov r13, qword [rsp + 0x58]
imul rcx, r13, 0x150
add rcx, qword [rsp + 0x48]
imul r8, r12, 0x150
mov rdx, rdi
call sub.msvcrt.dll_memcpy
add r13, r12
mov qword [rsp + 0x58], r13
and qword [rsp + 0x100], 0
mov rcx, r15
call fcn.1400a3193
jmp 0x1400a891d
lea rcx, [rsp + 0x240]
call fcn.1400a59ac
mov r13, qword [rsp + 0x48]
imul rcx, qword [rsp + 0x58], 0x150
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa8], rax
lea rax, [rcx + r13]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x40]
add rax, 0x60
mov qword [rsp + 0x98], rax
lea rsi, [rsp + 0x2f8]
lea rbx, [rsp + 0xf0]
mov qword [rsp + 0xb0], r13
test rcx, rcx
je 0x1400a8c22
mov r14, qword [r13]
cmp r14, 2
je 0x1400a8c1b
mov qword [rsp + 0xb8], rcx
lea rdi, [r13 + 0xc8]
mov r12, qword [r13 + 0xc0]
lea rdx, [r13 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x80], r12
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov r8, r12
call fcn.1400a52ad
mov rdi, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
cmp qword [rbp + 0x50], 0
je 0x1400a8c04
lea rax, [rsp + 0x48]
mov qword [rsp + 0xf0], rax
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0xf8], r15
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea rax, [0x1400a77f1]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov r9, rbx
call fcn.1400a76b5
test rax, rax
je 0x1400a8b69
mov r8, rbp
mov rbp, qword [rbp + 0x40]
movzx eax, byte [rbp + rdx]
and eax, 1
sub qword [r8 + 0x50], rax
mov rax, qword [rsp + 0x80]
shr rdi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [r8 + 0x48]
mov byte [rbp + rdx], dil
mov byte [rcx + rbp + 0x10], dil
inc qword [r8 + 0x58]
neg rdx
imul r15, rdx, 0x158
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb8
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], r14
mov r8d, 0xb8
mov rcx, rdi
lea rdx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov qword [rdi + 0xb8], r12
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.msvcrt.dll_memcpy
jmp 0x1400a8be9
mov r15, qword [r15]
neg rdx
imul rbp, rdx, 0x158
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rdi], r14
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, rdi
lea rdx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov qword [rdi + 0xb8], r12
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0xf0], 2
je 0x1400a8be9
mov rcx, rbx
call fcn.1400a31fe
add r13, 0x150
mov rcx, qword [rsp + 0xb8]
add rcx, 0xfffffffffffffeb0
jmp 0x1400a8a0d
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x98]
call fcn.1400a7817
jmp 0x1400a8a9a
add r13, 0x150
mov rax, qword [rsp + 0xa0]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
mov rdx, rax
call fcn.1400a31d4
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
call fcn.1400a31bd
mov r8, qword [rsp + 0x40]
mov rbx, qword [r8 + 0x40]
mov r14, qword [r8 + 0x48]
lea rax, [r14 + rbx]
inc rax
movdqa xmm0, xmmword [rbx]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rbx + 0x10]
mov r15, qword [r8 + 0x58]
lea rdi, [rsp + 0xf0]
mov qword [rdi], rbx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], cx
mov qword [rdi + 0x20], r15
mov r12, qword [r8 + 0x50]
mov r13d, 0x158
pcmpeqd xmm6, xmm6
mov rcx, rdi
call fcn.1400a6eeb
test rax, rax
je 0x1400a8d5b
mov rcx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x1400a8ca6
mov rax, rbx
sub rax, rcx
cqo
idiv r13
lea rdx, [rax - 0x10]
and rdx, r14
movdqu xmm0, xmmword [rbx + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400a8cf9
bsr r8w, r8w
xor r8d, 0xf
jmp 0x1400a8cfe
mov r8w, 0x10
movdqu xmm0, xmmword [rbx + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
jbe 0x1400a8d2b
mov r8, qword [rsp + 0x40]
jmp 0x1400a8d3a
inc r12
mov r8, qword [rsp + 0x40]
mov qword [r8 + 0x50], r12
mov r9b, 0xff
mov byte [rbx + rax], r9b
mov byte [rdx + rbx + 0x10], r9b
dec r15
mov qword [r8 + 0x58], r15
add rcx, 0xfffffffffffffeb0
call fcn.1400a31fe
jmp 0x1400a8ca6
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.1400a3071
movaps xmm6, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0xfa0
call fcn.140007810
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenLazy_instance_has_previously_been_poisoned
lea r8, [0x140121888]
mov edx, 0x2f
call fcn.140031dc0
ud2