Function at 0x140003680
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r13, rdx
xor r12d, r12d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140003907
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400038fe
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r13 + r8*2], 0
jne 0x140003720
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1400236a0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003760
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.1400236a0
mov r9, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x38]
cmp r9, rdx
je 0x140003794
xor bl, bl
jmp 0x140003838
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rax, qword [rsp + 0x40]
lea rdx, [rax + rdx*2]
lea r14, [rsp + 0x40]
cmova r14, qword [rsp + 0x40]
lea rax, [rsp + 0x20]
cmp r8, 7
cmova rax, qword [rsp + 0x20]
lea r15, [rax + r9*2]
lea rbx, [rsp + 0x20]
cmova rbx, qword [rsp + 0x20]
sub rdx, r14
mov rax, r15
sub rax, rbx
xor rdx, rax
test rdx, 0xfffffffffffffffe
je 0x1400037eb
xor bl, bl
jmp 0x140003838
cmp rbx, r15
je 0x140003831
sub r14, rbx
nop dword [rax]
nop word [rax + rax]
movzx esi, word [r14 + rbx]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx edi, ax
movzx ecx, si
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp di, ax
jne 0x1400038df
add rbx, 2
cmp rbx, r15
jne 0x140003800
mov r8, qword [rsp + 0x38]
mov bl, 1
mov rdi, qword [rsp + 0x60]
cmp r8, 7
jbe 0x140003871
lea rdx, [r8*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000386c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038eb
call fcn.14008aad4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
mov r8, qword [rsp + 0x58]
cmp r8, 7
jbe 0x1400038c3
lea rdx, [r8*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038f2
call fcn.14008aad4
test bl, bl
jne 0x1400038f9
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003700
jmp 0x1400038fe
xor bl, bl
mov r8, qword [rsp + 0x38]
jmp 0x140003833
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r12d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14008a760
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret