Function at 0x1400078b0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
xor ebp, ebp
lea rcx, [rsp + 0x30]
mov r8d, 0x238
xor edx, edx
call fcn.140035a20
mov dword [rsp + 0x30], 0x238
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
mov qword [rsp + 0x28], rax
mov eax, 0xf770153b
mov ebx, 0xaf876882
jmp 0x140007920
mov eax, 0xaee6183e
xor edi, edi
nop word cs:[rax + rax]
cmp eax, 0x1eaaa3
jg 0x140007970
cmp eax, 0xc724782d
jg 0x1400079d0
cmp eax, 0xacb5afe9
jg 0x140007a78
cmp eax, 0x968f07f0
jle 0x140007b80
cmp eax, 0x968f07f1
je 0x140007b95
cmp eax, 0x9c907e1e
jne 0x140007920
lea rdx, [r15 + 1]
mov rcx, rsi
call fcn.140035ee0
mov eax, 0x79dfb919
jmp 0x140007920
cmp eax, 0x33f56317
jg 0x140007a40
cmp eax, 0x1ac43129
jg 0x140007ae0
cmp eax, 0x1eaaa4
je 0x140007bb2
cmp eax, 0x3e94792
je 0x140007bd3
cmp eax, 0xcb369c0
jne 0x140007920
mov ecx, 0x410
xor edx, edx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
mov eax, 0x1c131d7d
mov ecx, 0xe87f5ee9
cmove eax, ecx
jmp 0x140007920
cmp eax, 0xefa12d17
jg 0x140007b26
cmp eax, 0xc724782e
je 0x140007bdd
cmp eax, 0xe84a3814
je 0x14000790c
cmp eax, 0xe87f5ee9
jne 0x140007920
mov eax, dword [0x140044c68]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0xe84a3814
mov r8d, 0xaee6183e
cmove eax, r8d
cmp dword [0x140044c6c], 0xa
mov edx, 0xe84a3814
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, r8d
jmp 0x140007920
cmp eax, 0x726fb2a2
jg 0x140007b51
cmp eax, 0x33f56318
je 0x140007bfe
cmp eax, 0x4c6cc4c1
je 0x140007c08
cmp eax, 0x668e7378
jne 0x140007920
mov eax, 0xaf876882
xor edi, edi
jmp 0x140007920
cmp eax, 0xacb5afea
je 0x140007c43
cmp eax, 0xaee6183e
je 0x140007c5d
cmp eax, 0xaf876882
jne 0x140007920
mov eax, dword [0x140044c68]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x668e7378
mov r8d, 0xefa12d18
cmove eax, r8d
cmp dword [0x140044c6c], 0xa
setl dl
mov r9d, 0x668e7378
cmovge eax, r9d
xor dl, cl
cmovne eax, r8d
xor edi, edi
jmp 0x140007920
cmp eax, 0x1ac4312a
je 0x140007cab
cmp eax, 0x1c131d7d
je 0x140007cb5
cmp eax, 0x242b765d
jne 0x140007920
mov rcx, r12
mov edx, 0x5c
call fcn.14001d860
mov r15, rax
test rax, rax
mov eax, 0x9c907e1e
mov ecx, 0x79dfb919
cmove eax, ecx
jmp 0x140007920
cmp eax, 0xefa12d18
je 0x140007cf1
cmp eax, 0xf770153b
je 0x140007cfb
cmp eax, 0xf80e55c7
jne 0x140007920
mov eax, 0xacb5afea
jmp 0x140007920
cmp eax, 0x726fb2a3
je 0x140007d16
cmp eax, 0x79dfb919
je 0x140007d22
cmp eax, 0x7a893377
jne 0x140007920
mov eax, 0x1ac4312a
mov ebp, dword [rsp + 0x50]
jmp 0x140007920
cmp eax, 0x8865d605
jne 0x140007d49
mov eax, 0x863a4979
jmp 0x140007920
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
mov eax, 0xcb369c0
mov ecx, 0x4c6cc4c1
cmove eax, ecx
jmp 0x140007920
mov rcx, r14
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, 0xacb5afea
mov ecx, 0x1ac4312a
cmove eax, ecx
jmp 0x140007920
mov eax, 0x8865d605
jmp 0x140007920
mov rcx, r14
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
mov eax, 0xf80e55c7
mov ecx, 0x968f07f1
cmove eax, ecx
jmp 0x140007920
mov eax, 0x1eaaa4
jmp 0x140007920
mov eax, dword [0x140044c68]
lea ecx, [rax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x668e7378
cmove eax, ebx
cmp dword [0x140044c6c], 0xa
mov edx, 0x668e7378
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x140007920
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x38], eax
mov eax, 0x33f56318
mov ecx, 0x7a893377
cmove eax, ecx
jmp 0x140007920
mov eax, dword [0x140044c68]
mov ecx, dword [0x140044c6c]
lea edx, [rax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl r9b
xor r9b, r8b
mov r8d, 0xe84a3814
mov r9d, 0x3e94792
cmovne r8d, r9d
test eax, edx
mov eax, r8d
cmove eax, r9d
cmp ecx, 0xa
cmovge eax, r8d
xor edi, edi
jmp 0x140007920
mov eax, 0x968f07f1
jmp 0x140007920
mov ecx, 0x104
call fcn.140024520
mov r12, rax
mov dword [rsp + 0x24], 0x104
mov rcx, r13
xor edx, edx
mov r8, rax
lea r9, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameA]
test eax, eax
mov eax, 0x242b765d
mov ecx, 0x8e4406a0
cmove eax, ecx
jmp 0x140007920
mov eax, 0x863a4979
jmp 0x140007920
mov rax, qword [rsp + 0x28]
cmp rax, 0xffffffffffffffff
mov eax, 0xc724782e
mov ecx, 0x726fb2a3
cmove eax, ecx
jmp 0x140007920
mov eax, 0x863a4979
xor edi, edi
jmp 0x140007920
mov rcx, rsi
call qword [sym.imp.USER32.dll_CharUpperA]
mov rcx, r12
call fcn.140023c30
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x8865d605
mov dil, 1
jmp 0x140007920
cmp eax, 0x863a4979
jne 0x140007920
and dil, 1
mov eax, edi
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret