Function at 0x1400bba20
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2f0], 0xfffffffffffffffe
mov qword [rbp + 0x2e0], r9
test rdx, rdx
je 0x1400bba78
mov r14, r8
test r8, r8
je 0x1400bbcd4
mov rsi, rdx
mov qword [rbp + 0x2b0], rcx
lea rax, [0x14024e9f0]
mov qword [rbp + 0x2b8], rax
jmp 0x1400bba95
mov qword [rbp + 0x2b0], rcx
lea rax, [0x14024e9c0]
mov qword [rbp + 0x2b8], rax
mov esi, 8
xor r14d, r14d
movzx eax, byte [0x14033c4a1]
mov edi, 0x80000
mov ecx, 0x80000
mov edx, 1
call fcn.1400b32d0
test rax, rax
je 0x1400bc14f
mov r15, rax
mov qword [rbp + 0x298], 0x80000
mov qword [rbp + 0x2a0], rax
mov qword [rbp + 0x2a8], 0
xor edx, edx
lea r13, [rbp + 0x2c0]
mov r12, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, 0x80000
jmp 0x1400bbafe
mov rdi, qword [rbp + 0x298]
mov rdx, qword [rbp + 0x2a8]
mov dword [rbp + 0x2c0], 0
sub rdi, rdx
cmp rbx, rdi
jbe 0x1400bbb26
lea rcx, [rbp + 0x298]
mov r8, rbx
call fcn.14022e730
mov r15, qword [rbp + 0x2a0]
mov ecx, 5
mov rdx, r15
mov r8d, ebx
mov r9, r13
call r12
test eax, eax
jns 0x1400bbb96
or eax, 0x10000000
mov ecx, eax
call fcn.1400c10a0
cmp edx, 0xd0000004
jne 0x1400bbc9c
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], 0xd0000004
mov ecx, dword [rbp + 0x2c0]
mov rdx, rbx
add rdx, rbx
lea ebx, [rcx + 0x2800]
test ecx, ecx
cmove rbx, rdx
test rax, rax
je 0x1400bbaf0
lea rcx, [rbp + 0x100]
call fcn.1400c10d0
jmp 0x1400bbaf0
mov qword [rbp + 0x2a8], rbx
mov qword [rbp + 0x278], 0
movzx eax, byte [0x14033c4a1]
mov ecx, 0xfa0
mov edx, 8
call fcn.1400b32d0
test rax, rax
je 0x1400bc15e
mov qword [rbp + 0x280], 0x1f4
mov qword [rbp + 0x288], rax
mov qword [rbp + 0x290], 0
mov rax, qword [rbp + 0x2b8]
mov rbx, qword [rax + 0x28]
xor r12d, r12d
jmp 0x1400bbc21
lea rax, [r15 + r12]
mov rcx, qword [rbp + 0x288]
mov qword [rcx + rdi*8], rax
inc rdi
mov qword [rbp + 0x290], rdi
add r12, r13
test r13d, r13d
je 0x1400bbc67
mov r13d, dword [r15 + r12]
mov rdx, qword [r15 + r12 + 0x50]
mov byte [rbp + 0x2ef], 1
mov ecx, 1
mov r8, rsi
mov r9, r14
call rbx
test al, al
je 0x1400bbc19
mov rdi, qword [rbp + 0x290]
cmp rdi, qword [rbp + 0x280]
jne 0x1400bbc00
mov byte [rbp + 0x2ef], 1
lea rcx, [rbp + 0x280]
call fcn.1400ba750
jmp 0x1400bbc00
mov rcx, qword [rbp + 0x2b0]
lea rsi, [rcx + 0x40]
mov qword [rbp + 0x270], rsi
mov rax, qword [rbp + 0x2e0]
cmp byte [rax], 0
je 0x1400bbcdb
mov byte [rbp + 0x2ef], 1
mov rdi, rcx
xor edx, edx
call fcn.1400b5e30
mov rax, qword [rdi + 0x10]
jmp 0x1400bbcdd
mov qword [rbp + 0x100], rax
mov dword [rbp + 0x108], edx
test rax, rax
je 0x1400bbcba
lea rcx, [rbp + 0x100]
call fcn.1400c10d0
mov rdx, qword [rbp + 0x298]
test rdx, rdx
je 0x1400bbcd4
mov r8d, 1
mov rcx, r15
call fcn.1400b32e0
xor eax, eax
jmp 0x1400bc13b
xor eax, eax
mov qword [rbp + 0x268], rax
mov byte [rbp + 0x2ef], 1
call fcn.140209aa0
mov dword [rbp + 0x2c0], eax
mov dword [rbp + 0x2c4], edx
mov byte [rbp + 0x2ef], 1
lea rcx, [rbp + 0x100]
lea rdx, [rbp + 0x2c0]
mov r8d, 0xd53e8000
mov r9d, 0x19db1de
call fcn.140209ad0
cmp qword [rbp + 0x100], 0
je 0x1400bbd30
xor eax, eax
jmp 0x1400bbd37
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x260], rax
mov rax, qword [rbp + 0x290]
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rbp + 0x280]
movaps xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2c8], 8
mov qword [rbp + 0x2d0], 0
lea rax, [rbp + 0x278]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0x270]
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x2e0]
mov qword [rbp + 0x128], rax
lea rax, [rbp + 0x268]
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x260]
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x2c0]
lea rdx, [rbp + 0x100]
call fcn.1400b8c00
mov rcx, qword [rbp + 0x2c0]
mov r9, qword [rbp + 0x2c8]
mov rdx, qword [rbp + 0x2d0]
imul rax, rdx, 0x158
add rax, r9
mov qword [rbp + 0x2c0], r9
mov r8, r9
mov qword [rbp + 0x2c8], r9
mov qword [rbp + 0x2d0], rcx
mov qword [rbp + 0x2d8], rax
test rdx, rdx
je 0x1400bc087
mov rdx, r8
lea rcx, [r8 + 0x158]
mov qword [rbp + 0x2c8], rcx
mov rcx, qword [r8]
cmp rcx, 2
je 0x1400bc07e
lea rdi, [rbp - 0x50]
lea r14, [rbp + 0x100]
lea r15, [rbp - 0x58]
movabs r12, 0x8000000000000000
nop word cs:[rax + rax]
add rdx, 8
mov qword [rbp - 0x58], rcx
mov r8d, 0x150
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rbp + 0x88]
mov rcx, r14
mov rdx, rsi
mov r9, r15
call fcn.1400ba190
cmp dword [rbp + 0x100], 2
je 0x1400bc050
mov rdx, qword [rbp + 0x110]
test rdx, rdx
je 0x1400bbeb6
mov rcx, qword [rbp + 0x118]
mov r8d, 1
call fcn.1400b32e0
mov r13, qword [rbp + 0x140]
test r13, r13
je 0x1400bbf00
mov rbx, qword [rbp + 0x138]
add rbx, 8
jmp 0x1400bbed9
add rbx, 0x20
dec r13
je 0x1400bbf00
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x1400bbed0
mov rcx, qword [rbx]
mov r8d, 1
call fcn.1400b32e0
jmp 0x1400bbed0
mov rdx, qword [rbp + 0x130]
test rdx, rdx
je 0x1400bbf22
mov rcx, qword [rbp + 0x138]
shl rdx, 5
mov r8d, 8
call fcn.1400b32e0
mov rdx, qword [rbp + 0x160]
cmp rdx, r12
je 0x1400bbf45
test rdx, rdx
je 0x1400bbf45
mov rcx, qword [rbp + 0x168]
mov r8d, 1
call fcn.1400b32e0
mov rdx, qword [rbp + 0x180]
cmp rdx, r12
je 0x1400bbf68
test rdx, rdx
je 0x1400bbf68
mov rcx, qword [rbp + 0x188]
mov r8d, 1
call fcn.1400b32e0
mov r13, qword [rbp + 0x158]
test r13, r13
je 0x1400bbfc0
mov rbx, qword [rbp + 0x150]
add rbx, 8
jmp 0x1400bbf99
add rbx, 0x20
dec r13
je 0x1400bbfc0
mov rdx, qword [rbx - 8]
test rdx, rdx
je 0x1400bbf90
mov rcx, qword [rbx]
mov r8d, 1
call fcn.1400b32e0
jmp 0x1400bbf90
mov rdx, qword [rbp + 0x148]
test rdx, rdx
je 0x1400bbfe2
mov rcx, qword [rbp + 0x150]
shl rdx, 5
mov r8d, 8
call fcn.1400b32e0
mov rdx, qword [rbp + 0x198]
cmp rdx, r12
je 0x1400bc005
test rdx, rdx
je 0x1400bc005
mov rcx, qword [rbp + 0x1a0]
mov r8d, 1
call fcn.1400b32e0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, r12
je 0x1400bc028
test rdx, rdx
je 0x1400bc028
mov rcx, qword [rbp + 0x1c0]
mov r8d, 1
call fcn.1400b32e0
mov rax, qword [rbp + 0x1f8]
test rax, rax
je 0x1400bc050
lock dec qword [rax]
jne 0x1400bc050
lea rcx, [rbp + 0x1f8]
call fcn.1400b8530
nop word cs:[rax + rax]
mov rdx, qword [rbp + 0x2c8]
mov rax, qword [rbp + 0x2d8]
cmp rdx, rax
je 0x1400bc08c
lea rcx, [rdx + 0x158]
mov qword [rbp + 0x2c8], rcx
mov rcx, qword [rdx]
cmp rcx, 2
jne 0x1400bbe60
add rdx, 0x158
jmp 0x1400bc08f
mov rdx, r8
jmp 0x1400bc08f
mov rdx, rax
sub rax, rdx
movabs rcx, 0xbe82fa0be82fa0bf
mov r8, rdx
mul rcx
shr rdx, 8
mov qword [rbp + 0x2b8], rdx
xor eax, eax
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2b0], r8
mov rcx, r8
mov rax, qword [rbp + 0x2e0]
cmp qword [rbp + 0x2b8], rax
je 0x1400bc0eb
inc rax
mov qword [rbp + 0x2e0], rax
lea rsi, [rcx + 0x158]
call fcn.1400b7430
mov rcx, rsi
jmp 0x1400bc0c0
mov rax, qword [rbp + 0x2d0]
test rax, rax
je 0x1400bc110
mov rcx, qword [rbp + 0x2c0]
imul rdx, rax, 0x158
mov r8d, 8
call fcn.1400b32e0
mov rax, qword [rbp + 0x278]
mov rdx, qword [rbp + 0x298]
test rdx, rdx
je 0x1400bc13b
mov rcx, qword [rbp + 0x2a0]
mov r8d, 1
mov rsi, rax
call fcn.1400b32e0
mov rax, rsi
add rsp, 0x378
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 1
mov edx, 0x80000
call fcn.14023db50
mov ecx, 8
mov edx, 0xfa0
call fcn.14023db50
ud2