Function at 0x140001520
Capabilities:
Enumerate processes
List tcp connections and listeners

Disassembly:
push rdi
push r14
sub rsp, 0x2a8
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor r14d, r14d
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x28], r14d
xor ecx, ecx
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x20], 3
lea r9d, [r14 + 2]
lea r8d, [r14 + 1]
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
cmp eax, 0x7a
je 0x140001576
xor eax, eax
jmp 0x1400017e5
mov ecx, dword [rsp + 0x30]
mov qword [rsp + 0x298], r13
call fcn.1400068fc
mov r13, rax
test rax, rax
je 0x1400017da
mov r9d, 2
mov dword [rsp + 0x28], r14d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], 3
mov rcx, rax
lea r8d, [r9 - 1]
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x1400017da
mov qword [rsp + 0x290], r15
mov r15d, r14d
cmp dword [r13], r14d
jbe 0x1400017d2
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0x2d0], rbp
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2a0], r12
nop word [rax + rax]
mov eax, r15d
lea rcx, [rax + rax*2]
lea rsi, [rcx*8]
add rsi, r13
cmp dword [rsi + 8], 0
jne 0x1400017a5
mov r8d, dword [rsi + 0x18]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400017a5
cmp qword [rdi + 0x10], 0
mov rbx, r14
mov ebp, dword [rsi + 0xc]
mov r12d, dword [rsi + 8]
mov esi, dword [rsi + 0x18]
jne 0x14000168f
mov ecx, 0x60218
mov dword [rdi + 4], r14d
mov dword [rdi + 8], 0x60218
call fcn.1400068fc
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1400017a5
xor edx, edx
mov r8d, 0x60218
mov rcx, rax
call fcn.140003560
call fcn.140001240
mov dword [rdi], eax
mov r8d, dword [rdi + 4]
mov eax, r14d
test r8d, r8d
je 0x1400016bc
mov r9, qword [rdi + 0x10]
nop
mov ecx, eax
imul rcx, rcx, 0x60218
add rcx, r9
cmp dword [rcx], esi
je 0x1400016b9
inc eax
cmp eax, r8d
jb 0x1400016a0
jmp 0x1400016bc
mov rbx, rcx
test rbx, rbx
je 0x1400016e8
mov eax, dword [rbx + 0x218]
mov word [rbx + rax*2 + 0x21c], bp
mov eax, dword [rbx + 0x218]
mov dword [rbx + rax*4 + 0x2021c], r12d
inc dword [rbx + 0x218]
jmp 0x1400017a5
imul r14, r8, 0x60218
mov ecx, esi
add r14, qword [rdi + 0x10]
mov dword [r14], esi
mov dword [r14 + 0x218], 1
mov word [r14 + 0x21c], bp
mov dword [r14 + 0x2021c], r12d
call fcn.140001070
xor edx, edx
mov qword [r14 + 0x210], rax
lea rbp, [0x14001c4c0]
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000177b
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001772
cmp dword [rsp + 0x48], esi
je 0x14000176d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001753
jmp 0x140001772
lea rbp, [rsp + 0x6c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [r14 + 4]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
add dword [rdi + 8], 0x60218
mov edx, dword [rdi + 8]
mov rcx, qword [rdi + 0x10]
call fcn.1400051d4
inc dword [rdi + 4]
xor r14d, r14d
mov qword [rdi + 0x10], rax
inc r15d
cmp r15d, dword [r13]
jb 0x140001600
mov r12, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2d8]
mov rbp, qword [rsp + 0x2d0]
mov rbx, qword [rsp + 0x2c8]
mov r15, qword [rsp + 0x290]
mov eax, dword [rdi + 4]
mov r13, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140002560
add rsp, 0x2a8
pop r14
pop rdi
ret