Function at 0x14000a340
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14000a64f
mov dword [rbp - 0x80], 0x238
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000a64f
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14000a646
mov r12, qword [0x14012d148]
mov rax, qword [0x14012d150]
mov qword [rsp + 0x48], rax
cmp r12, rax
je 0x14000a3b9
nop word [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.140003d80
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rsp + 0x68]
sub rax, rsi
cmp rax, 4
jb 0x14000a681
lea r13, [rsp + 0x58]
mov r14, qword [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r13, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea r15, [rsi + 4]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
cmp r15, rbx
jbe 0x14000a4d1
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000a467
mov rbx, rcx
jmp 0x14000a474
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14000a4bb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a68d
mov rcx, rax
call fcn.140043a34
test rax, rax
je 0x14000a687
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000a4cc
test rcx, rcx
je 0x14000a4ca
call fcn.140043a34
mov rdi, rax
jmp 0x14000a4cc
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call fcn.1400459a0
mov dword [rdi + rsi], 0x6578652e
mov byte [rdi + r15], 0
mov edi, dword [rsp + 0x20]
or edi, 1
mov dword [rsp + 0x20], edi
lea rdx, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
mov r9, qword [rsp + 0x40]
cmp r9, 0x10
cmovae rdx, r8
lea rax, [rbp - 0x54]
sub rdx, rax
nop
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x14000a537
inc rax
test cl, cl
jne 0x14000a520
xor r15d, r15d
mov ebx, r15d
jmp 0x14000a53f
sbb ebx, ebx
or ebx, 1
xor r15d, r15d
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
cmp r9, 0x10
jb 0x14000a57d
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x14000a575
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a693
mov rcx, r8
call fcn.140043a2c
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
mov rax, qword [rsp + 0x70]
test ebx, ebx
je 0x14000a5fc
cmp rax, 0x10
jb 0x14000a5d0
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000a5c8
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a699
mov rcx, r14
call fcn.140043a2c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
add r12, 0x20
cmp r12, qword [rsp + 0x48]
jne 0x14000a3f0
mov rbx, qword [rsp + 0x50]
jmp 0x14000a3b9
cmp rax, 0x10
jb 0x14000a62f
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000a627
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a699
mov rcx, r14
call fcn.140043a2c
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov al, 1
jmp 0x14000a651
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400439e0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400028f0
int3
call fcn.140030524
int3
call fcn.140002830
nop
call fcn.140030524
nop
call fcn.140030524
int3