Function at 0x1800034f8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x180012008]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov rsi, r8
lea rcx, [rbp + 0xb0]
mov rbx, rdx
mov r8d, 0x800
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.180003020
mov edx, 0x8000
mov rcx, rsi
mov r14d, eax
call fcn.180003178
test r14d, r14d
jle 0x180003566
mov edx, r14d
mov rcx, rsi
call fcn.180003210
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.18000388c
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800035ae
lea rax, [0x18000f3d8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1800032d8
mov eax, 0x1f
jmp 0x180003776
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1800035da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.CreateToolhelp32Snapshot__Process32First
jmp 0x18000358f
mov rcx, qword [0x1817747c0]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rsp + 0x58]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x180003658
movzx ecx, word [0x18000f430]
movsd xmm0, qword [str._nd__td__ts_]
mov word [rbp + 0x88], cx
lea rcx, [rbp + 0x80]
movsd qword [rbp + 0x80], xmm0
call sub.msvcrt.dll__strrev
mov ecx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
mov r9d, dword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.180003240
jmp 0x180003743
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180003697
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov r8d, 0x800
call fcn.180005d3c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x18000369e
mov byte [rbp + 0xb0], 0
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, r15
call fcn.18000388c
movups xmm0, xmmword [str._nd__ts__ts__td__td__ts_]
test eax, eax
lea rcx, [0x18000f3d0]
movzx eax, word [0x18000f448]
lea rbx, [0x18000f3d4]
mov word [rbp + 0xa0], ax
cmove rbx, rcx
mov al, byte [0x18000f44a]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0xa2], al
movups xmmword [rbp + 0x90], xmm0
call sub.msvcrt.dll__strrev
mov r9d, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov rdx, rax
mov rcx, rsi
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.180003240
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800035da
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg r14d
sbb eax, eax
and eax, 5
add eax, 0x11
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.18000d570
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret