Function at 0x1400b1763
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x358
mov ebx, edx
mov rsi, rcx
mov word [rsp + 0x28], bx
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x2a], al
mov r15d, 0x80000
mov ecx, 0x80000
xor edx, edx
call fcn.14002fd42
lea r12, [rsp + 0x48]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
lea r13, [rsp + 0xb0]
lea rdi, [0x14013bcd0]
lea r14, [0x14013b690]
lea rbp, [0x14013ac00]
and dword [rsp + 0xb0], 0
mov rcx, r12
mov rdx, r15
call fcn.14002c425
mov rdx, qword [rsp + 0x48]
mov ecx, 5
mov r8d, r15d
mov r9, r13
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400b1824
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x1400b1816
add eax, 0x2800
jb 0x1400b1a98
mov r15d, eax
jmp 0x1400b17cc
test r15, r15
js 0x1400b1aa9
add r15, r15
jmp 0x1400b17cc
test eax, eax
jne 0x1400b1a5f
mov qword [rsp + 0x58], r15
mov ecx, 0x1f4
xor edx, edx
call fcn.1400a9817
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
and qword [rdi + 0x10], 0
xor eax, eax
xor r14d, r14d
mov r15, qword [rsp + 0x48]
add r15, r14
cmp rax, rdx
jne 0x1400b186d
mov rcx, rdi
call fcn.1400aa164
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + rax*8], r15
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov ecx, dword [r15]
test rcx, rcx
je 0x1400b189b
add r14, rcx
jo 0x1400b1a7e
mov rdx, qword [rsp + 0x38]
jmp 0x1400b1853
lea rdi, [rsi + 0x40]
mov qword [rsp + 0x60], rdi
test bl, bl
je 0x1400b18bf
lea rcx, [rsi + 0x110]
xor edx, edx
call fcn.1400ae7aa
mov rax, qword [rsi + 0x190]
jmp 0x1400b18c1
xor eax, eax
mov qword [rsp + 0x68], rax
call fcn.140096b70
shl rdx, 0x20
mov ecx, eax
or rcx, rdx
movabs r8, 0x19db1ded53e7fff
mov rax, rcx
sub rax, r8
mov edx, 1
sub rdx, rax
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovle rax, rdx
xor r9d, r9d
mov r10d, 0x989680
xor edx, edx
div r10
cmp rcx, r8
cmovle rax, r9
lea rcx, [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x60]
mov qword [rdx + 0x18], rax
lea rax, [rsp + 0x28]
mov qword [rdx + 0x20], rax
lea rax, [rsp + 0x68]
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x30], rcx
lea rcx, [rsp + 0x90]
call fcn.1400aa33e
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
imul rbp, qword [rsp + 0xa0], 0x150
lea rcx, [rdx + rbp]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rcx
lea r14, [rsp + 0x208]
lea r15, [rsp + 0xb0]
test rbp, rbp
je 0x1400b1a4d
lea rsi, [rdx + 0x150]
mov qword [rsp + 0x80], rsi
mov rbx, qword [rdx]
cmp rbx, 2
je 0x1400b1a4d
lea r12, [rdx + 0xc8]
mov r13, qword [rdx + 0xc0]
add rdx, 8
mov r8d, 0xb8
lea rcx, [rsp + 0xb8]
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
lea rcx, [rsp + 0x178]
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x170], r13
mov rcx, r14
mov rdx, rdi
mov r8, r13
mov r9, r15
call fcn.1400ac2a8
cmp dword [rsp + 0x208], 2
je 0x1400b1a3e
mov rcx, r14
call fcn.1400a83cc
add rbp, 0xfffffffffffffeb0
mov rdx, rsi
jmp 0x1400b19af
lea rcx, [rsp + 0x70]
call fcn.1400ababf
mov rcx, rdi
call fcn.1400ac487
lea rcx, [rsp + 0x48]
call fcn.1400304a6
nop
add rsp, 0x358
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14013ac00]
lea r8, [0x14013bca0]
mov edx, 0x1c
call fcn.14000e4c0
jmp 0x1400b1ab9
mov edx, 0x1c
mov r14, rbp
lea rdi, [0x14013bcb8]
jmp 0x1400b1aae
mov edx, 0x21
mov rcx, r14
mov r8, rdi
call fcn.14000e4c0
ud2