Function at 0x14005a4e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1401f41c0]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x14005a557
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14005a55e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14005a7d1
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r12b
jne 0x14005a580
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.1400056b0
nop
lea rdi, [rbp + 0x80]
mov r8, qword [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdi, r8
lea rcx, [rbp + 0x80]
cmova rcx, r8
mov rsi, qword [rbp + 0x90]
add rsi, rcx
lea rbx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rbx, r8
cmp rbx, rsi
je 0x14005a600
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.140175910
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x14005a5e3
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rsp + 0x5c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14005a620
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x60]
call fcn.1400056b0
nop
lea rdi, [rbp + 0x60]
mov rsi, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0xf
cmova rdi, rsi
lea r14, [rbp + 0x60]
cmova r14, rsi
mov rcx, qword [rbp + 0x70]
add r14, rcx
lea rbx, [rbp + 0x60]
cmp r13, 0xf
cmova rbx, rsi
cmp rbx, r14
je 0x14005a68f
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.140175910
mov byte [rdi + rbx], al
inc rbx
cmp rbx, r14
jne 0x14005a670
mov r13, qword [rbp + 0x78]
mov rcx, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x60]
lea r14, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r14, qword [rbp + 0x80]
lea r15, [rbp + 0x60]
cmp r13, 0xf
cmova r15, rsi
mov rdi, qword [rbp + 0x90]
cmp rdi, rcx
ja 0x14005a733
sub rcx, rdi
test rdi, rdi
je 0x14005a801
lea r12, [r15 + rcx]
movsx edx, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov rcx, r15
call fcn.140192260
mov rbx, rax
test rax, rax
je 0x14005a730
nop word [rax + rax]
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call fcn.140191dc0
test eax, eax
je 0x14005a723
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
movsx edx, byte [r14]
mov rcx, rbx
call fcn.140192260
mov rbx, rax
test rax, rax
jne 0x14005a6f0
jmp 0x14005a730
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x14005a801
xor r12d, r12d
cmp r13, 0xf
jbe 0x14005a76a
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005a762
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a856
mov rcx, rsi
call fcn.14016aab8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14005a600
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14005a7ce
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a7c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a85c
call fcn.14016aab8
mov rax, r12
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14016ab50
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14005a781
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005a84c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005a856
call fcn.14016aab8
jmp 0x14005a781
call fcn.140170de4
nop
call fcn.140170de4
int3