Function at 0x1400a8bb4
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movdqa xmmword [rsp + 0x380], xmm6
mov rbx, rdx
mov qword [rsp + 0x40], rcx
mov r14d, 0x80000
mov ecx, 0x80000
xor edx, edx
call fcn.1400dadff
lea r15, [rsp + 0xc0]
mov qword [r15], rax
mov qword [r15 + 8], rdx
and qword [r15 + 0x10], 0
lea r12, [rsp + 0x240]
lea r13, [rsp + 0xf0]
and dword [rsp + 0x240], 0
mov rcx, r15
mov rdx, r14
call fcn.1400dac9d
mov rdi, qword [rsp + 0xc0]
mov ecx, 5
mov rdx, rdi
mov r8d, r14d
mov r9, r12
call sub.ntdll.dll_NtQuerySystemInformation
mov rcx, r13
mov edx, eax
call fcn.1400a566f
cmp qword [rsp + 0xf0], 0
je 0x1400a8c94
cmp dword [rsp + 0x100], 0xd0000004
mov rcx, qword [rsp + 0xf8]
jne 0x1400a8d35
mov eax, dword [rsp + 0x240]
mov rdx, r14
add rdx, r14
lea r14d, [rax + 0x2800]
test eax, eax
cmove r14, rdx
test rcx, rcx
je 0x1400a8c0e
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1400a8c0e
mov qword [rsp + 0xd0], r14
mov ecx, 8
mov edx, 0xfa0
call fcn.14003d4c0
test rax, rax
je 0x1400a9350
lea r14, [rsp + 0x68]
mov qword [r14], rax
mov qword [r14 + 8], 0x1f4
and qword [r14 + 0x10], 0
xor edx, edx
xor r15d, r15d
mov r12d, dword [rdi + r15]
cmp rdx, qword [rsp + 0x70]
jne 0x1400a8ceb
mov rcx, r14
call fcn.14006b4d6
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
lea rcx, [rdi + r15]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x78]
inc rdx
mov qword [rsp + 0x78], rdx
add r15, r12
test r12, r12
jne 0x1400a8cce
mov rsi, qword [rsp + 0x40]
lea r14, [rsi + 0x40]
mov qword [rsp + 0xd8], r14
cmp byte [rbx], 0
je 0x1400a8d50
lea rcx, [rsi + 0x90]
xor edx, edx
call fcn.1400a937b
mov rax, qword [rsi + 0x110]
jmp 0x1400a8d52
test rcx, rcx
je 0x1400a8d40
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
jmp 0x1400a932f
xor eax, eax
mov qword [rsp + 0xe0], rax
lea rdi, [rsp + 0xf0]
and qword [rdi], 0
mov rax, qword [0x1400ee450]
mov rcx, rdi
call rax
mov rax, qword [rdi]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x1400a8d88
xor eax, eax
jmp 0x1400a8d9f
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0xe8]
mov qword [rcx], rax
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x100], r14
movups xmm0, xmmword [rsp + 0x68]
movaps xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x48], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rbx
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rcx
mov rbx, qword [rsp + 0xf8]
cmp rbx, r14
jb 0x1400a9361
lea rdi, [rsp + 0x108]
mov r15, qword [rdi - 0x18]
call fcn.140057ebb
xor r9d, r9d
cmp r14, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 1
lea rdi, [rsp + 0x2f8]
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
call fcn.1400a5fdb
test rbx, rbx
je 0x1400a8e85
shl rbx, 3
mov edx, 8
mov rcx, r15
mov r8, rbx
call fcn.140039392
mov rax, qword [rsp + 0x308]
xor edx, edx
sub rax, 1
jb 0x1400a8ea7
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400a8ea7
add rdx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x1400a8e8f
lea rcx, [rsp + 0x48]
call fcn.1400a7155
mov rax, qword [rsp + 0x308]
lea r14, [rsp + 0x240]
mov qword [r14 + 0x10], rax
movups xmm0, xmmword [rsp + 0x2f8]
movaps xmmword [r14], xmm0
lea rbx, [rsp + 0xf8]
lea r15, [rsp + 0xf0]
mov rcx, r14
call fcn.1400a5fa2
test rax, rax
je 0x1400a8f74
mov rdi, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, rax
call fcn.1400a5fd0
test rdi, rdi
je 0x1400a8f74
mov qword [rsp + 0xf0], rdi
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rbx], xmm0
mov r12, qword [rsp + 0x100]
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.1400a7155
mov r13, qword [rsp + 0x58]
imul rcx, r13, 0x150
add rcx, qword [rsp + 0x48]
imul r8, r12, 0x150
mov rdx, rdi
call sub.msvcrt.dll_memcpy
add r13, r12
mov qword [rsp + 0x58], r13
and qword [rsp + 0x100], 0
mov rcx, r15
call fcn.1400a3773
jmp 0x1400a8ee1
lea rcx, [rsp + 0x240]
call fcn.1400a5f70
mov r13, qword [rsp + 0x48]
imul rcx, qword [rsp + 0x58], 0x150
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa8], rax
lea rax, [rcx + r13]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x40]
add rax, 0x60
mov qword [rsp + 0x98], rax
lea rsi, [rsp + 0x2f8]
lea rbx, [rsp + 0xf0]
mov qword [rsp + 0xb0], r13
test rcx, rcx
je 0x1400a91e6
mov r14, qword [r13]
cmp r14, 2
je 0x1400a91df
mov qword [rsp + 0xb8], rcx
lea rdi, [r13 + 0xc8]
mov r12, qword [r13 + 0xc0]
lea rdx, [r13 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
mov rcx, rsi
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x80], r12
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov r8, r12
call fcn.1400a5871
mov rdi, rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
cmp qword [rbp + 0x50], 0
je 0x1400a91c8
lea rax, [rsp + 0x48]
mov qword [rsp + 0xf0], rax
mov r15, qword [rsp + 0x60]
mov qword [rsp + 0xf8], r15
mov rcx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x48]
lea rax, [0x1400a7db5]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov r9, rbx
call fcn.1400a7c79
test rax, rax
je 0x1400a912d
mov r8, rbp
mov rbp, qword [rbp + 0x40]
movzx eax, byte [rbp + rdx]
and eax, 1
sub qword [r8 + 0x50], rax
mov rax, qword [rsp + 0x80]
shr rdi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [r8 + 0x48]
mov byte [rbp + rdx], dil
mov byte [rcx + rbp + 0x10], dil
inc qword [r8 + 0x58]
neg rdx
imul r15, rdx, 0x158
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb8
mov qword [rdi - 0x10], rax
mov qword [rdi - 8], r14
mov r8d, 0xb8
mov rcx, rdi
lea rdx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov qword [rdi + 0xb8], r12
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.msvcrt.dll_memcpy
jmp 0x1400a91ad
mov r15, qword [r15]
neg rdx
imul rbp, rdx, 0x158
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_memcpy
mov qword [rdi], r14
lea rdi, [r15 + rbp]
add rdi, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, rdi
lea rdx, [rsp + 0x240]
call sub.msvcrt.dll_memcpy
mov qword [rdi + 0xb8], r12
lea rcx, [r15 + rbp]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0xf0], 2
je 0x1400a91ad
mov rcx, rbx
call fcn.1400a37de
add r13, 0x150
mov rcx, qword [rsp + 0xb8]
add rcx, 0xfffffffffffffeb0
jmp 0x1400a8fd1
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x98]
call fcn.1400a7ddb
jmp 0x1400a905e
add r13, 0x150
mov rax, qword [rsp + 0xa0]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
mov rdx, rax
call fcn.1400a37b4
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
call fcn.1400a379d
mov r8, qword [rsp + 0x40]
mov rbx, qword [r8 + 0x40]
mov r14, qword [r8 + 0x48]
lea rax, [r14 + rbx]
inc rax
movdqa xmm0, xmmword [rbx]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rbx + 0x10]
mov r15, qword [r8 + 0x58]
lea rdi, [rsp + 0xf0]
mov qword [rdi], rbx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], cx
mov qword [rdi + 0x20], r15
mov r12, qword [r8 + 0x50]
mov r13d, 0x158
pcmpeqd xmm6, xmm6
mov rcx, rdi
call fcn.1400a74af
test rax, rax
je 0x1400a931f
mov rcx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x1400a926a
mov rax, rbx
sub rax, rcx
cqo
idiv r13
lea rdx, [rax - 0x10]
and rdx, r14
movdqu xmm0, xmmword [rbx + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400a92bd
bsr r8w, r8w
xor r8d, 0xf
jmp 0x1400a92c2
mov r8w, 0x10
movdqu xmm0, xmmword [rbx + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
jbe 0x1400a92ef
mov r8, qword [rsp + 0x40]
jmp 0x1400a92fe
inc r12
mov r8, qword [rsp + 0x40]
mov qword [r8 + 0x50], r12
mov r9b, 0xff
mov byte [rbx + rax], r9b
mov byte [rdx + rbx + 0x10], r9b
dec r15
mov qword [r8 + 0x58], r15
add rcx, 0xfffffffffffffeb0
call fcn.1400a37de
jmp 0x1400a926a
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.1400a3651
movaps xmm6, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0xfa0
call fcn.140007760
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenLazy_instance_has_previously_been_poisoned
lea r8, [0x140114f18]
mov edx, 0x2f
call fcn.1400323f0
ud2