Function at 0x140008860
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
xor edx, edx
mov r15, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400088b9
call fcn.1400023f0
mov r8, rax
lea rdx, str.Impossible_to_generate_a_snapshot.___ws_
lea ecx, [r14 + 0xa]
call fcn.14002a3c0
jmp 0x140008ace
mov qword [rsp + 0x430], rsi
lea rcx, [rbp - 0x4c]
xor edx, edx
mov r8d, 0x234
xor esi, esi
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x238
mov rcx, r14
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140008aa8
mov qword [rsp + 0x428], rbx
mov qword [rsp + 0x438], rdi
mov r8d, dword [rbp - 0x48]
test r8d, r8d
jne 0x140008911
xor dil, dil
jmp 0x140008a76
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140008949
call fcn.1400023f0
mov r8d, dword [rbp - 0x48]
lea rdx, str.Process_ID__u:_Impossible_to_open_the_process._Skipped.___ws_
mov r9, rax
lea ecx, [rbx + 9]
call fcn.14002a650
xor dil, dil
jmp 0x140008a76
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x80
lea r8, [rbp + 0x1f0]
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
jne 0x140008995
call fcn.1400023f0
mov r8d, dword [rbp - 0x48]
lea rdx, str.Process_ID__u:_Impossible_to_get_the_module_base_name.___ws_
mov r9, rax
mov ecx, 9
call fcn.14002a650
xorps xmm0, xmm0
lea rdx, [rsp + 0x60]
mov r8d, 0x50
mov rcx, rbx
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
test eax, eax
setne dil
test eax, eax
je 0x140008a3e
mov rax, qword [rbp - 0x68]
lea r8, [rbp + 0x1f0]
mov rcx, qword [rbp - 0x58]
lea rdx, str._ls__u__I64u__I64u__I64u__I64u__I64u__I64u__I64u__I64u_n
mov r9d, dword [rsp + 0x64]
test rax, rax
cmovne rcx, rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x58], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x50], rcx
mov rcx, r15
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.1400079c0
jmp 0x140008a6d
call fcn.1400023f0
mov r8, rax
lea rdx, str.Process_ID__u:_Failed_to_get_process_memory_information___ws_
mov ecx, 9
call fcn.14002a650
lea r8, [rbp + 0x1f0]
mov rcx, r15
lea rdx, str._ls__________n
call fcn.1400079c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [rsi + 1]
test dil, dil
lea rdx, [rbp - 0x50]
mov rcx, r14
cmove bx, si
movzx esi, bx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x140008900
mov rdi, qword [rsp + 0x438]
mov rbx, qword [rsp + 0x428]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r8d, si
lea rdx, str.Procstats_file_generated___u_processes_has_been_read.
mov ecx, 9
call fcn.14002a430
mov rsi, qword [rsp + 0x430]
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x400
pop r15
pop r14
pop rbp
ret