Function at 0x100375b8
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov r14d, edx
mov r15, rcx
mov word [rsp + 0x20], r14w
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x22], al
call fcn.10038487
mov qword [rsp + 0x60], rax
mov esi, 0x80000
lea rdi, [rsp + 0x24]
lea rbx, [rsp + 0x48]
mov rcx, rsi
xor edx, edx
call fcn.1003de93
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdx
and dword [rsp + 0x24], 0
mov qword [rsp + 0x58], rsi
mov ecx, 5
mov rdx, rax
mov r8d, esi
mov r9, rdi
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x10037659
mov ebp, dword [rsp + 0x24]
test ebp, ebp
je 0x1003764c
add ebp, 0x2800
mov rcx, rbx
call fcn.10036349
mov rsi, rbp
jmp 0x100375f9
add rsi, rsi
mov rcx, rbx
call fcn.10036349
jmp 0x100375f9
mov ecx, 0x1f4
xor edx, edx
call fcn.10022fdf
lea rdi, [rsp + 0x30]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
and qword [rdi + 0x10], 0
xor edx, edx
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
add rbp, rbx
cmp rdx, qword [rsp + 0x38]
jne 0x10037696
mov rcx, rdi
call fcn.10023e5e
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x30]
mov qword [rax + rdx*8], rbp
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
mov eax, dword [rbp]
add rbx, rax
test rax, rax
jne 0x1003767a
mov qword [rsp + 0x68], r15
test r14b, r14b
je 0x100376cc
lea rcx, [r15 + 0x50]
call fcn.1002662e
jmp 0x100376ce
xor eax, eax
mov qword [rsp + 0x28], r15
lea rcx, [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rax, [rsp + 0x68]
mov qword [rdx + 0x18], rax
lea rax, [rsp + 0x20]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rcx
lea rax, [rsp + 0x60]
mov qword [rdx + 0x30], rax
lea rcx, [rsp + 0x90]
call fcn.10028924
mov rsi, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
imul r12, qword [rsp + 0xa0], 0x148
lea rcx, [rsi + r12]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rcx
lea r14, [rsp + 0xb0]
lea r15, [rsp + 0x330]
test r12, r12
je 0x1003784f
lea r13, [rsi + 0x148]
mov qword [rsp + 0x80], r13
mov rbx, qword [rsi + 0xd0]
cmp rbx, 2
je 0x1003784f
lea rax, [rsi + 0xd8]
lea rdx, [rsi + 0x58]
mov r8, qword [rsi + 0x50]
mov ecx, 0xa
lea rbp, [rsp + 0x1f8]
mov rdi, rbp
rep movsq qword [rdi], qword [rsi]
mov ecx, 0xf
lea r9, [rsp + 0x2b8]
mov rdi, r9
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov ecx, 0xe
lea rdx, [rsp + 0x248]
mov rdi, rdx
mov rsi, rax
rep movsq qword [rdi], qword [rsi]
mov ecx, 0xa
mov rdi, r14
mov rsi, rbp
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x100], r8
mov ecx, 0xf
lea rdi, [rsp + 0x108]
mov rsi, r9
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x180], rbx
mov ecx, 0xe
lea rdi, [rsp + 0x188]
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov rcx, r15
mov rdx, qword [rsp + 0x28]
mov r9, r14
call fcn.10036228
mov rcx, r15
call fcn.1003668b
add r12, 0xfffffffffffffeb8
mov rsi, r13
jmp 0x1003776d
lea rcx, [rsp + 0x70]
call fcn.1002c853
mov rcx, qword [rsp + 0x28]
call fcn.1003ac2e
lea rcx, [rsp + 0x48]
call fcn.10036349
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret