Function at 0x140003220
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
mov rax, 0x9c
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14000322a
sub rsp, 0x28
call fcn.14003bb40
mov rcx, qword [rsp + 0x540]
call fcn.140008fbc
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x4d8], rax
cmp qword [rsp + 0x4d8], 0
je 0x1400034b3
lea rbp, [rsp + 0x2a0]
mov dword [rbp], 0x238
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
and rax, rax
je 0x1400034a6
lea rax, [rsp + 0x2a0]
mov rax, rax
push rax
push qword [rsp + 0x4e0]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
and rax, rax
je 0x1400034a6
lea rbp, [rsp + 0x2a0]
movsxd rax, dword [rbp + 8]
push rax
pop rax
mov dword [rsp + 0x4e0], eax
movsxd rax, dword [rsp + 0x4e0]
mov rax, rax
push rax
push 0
push 0x410
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x4e8], rax
cmp qword [rsp + 0x4e8], 0
je 0x1400034a1
push gethostbyname
lea rax, [rsp + 0x30]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push 0x248
lea rax, [rsp + 0x60]
mov rax, rax
push rax
pop rcx
pop rdx
call sub.KERNEL32.dll_RtlZeroMemory
push qword [rsp + 0x4e8]
pop rcx
call fcn.140008942
mov rax, rax
push rax
lea rbp, [rsp + 0x30]
pop rax
mov qword [rbp + 8], rax
push qword [rbp + 8]
push qword [rsp + 0x4f0]
pop rcx
pop rdx
call fcn.140008f1e
mov rax, rax
push rax
lea rbp, [rsp + 0x60]
pop rax
mov qword [rbp + 0x20], rax
push rcx
sub rsp, 0x28
call fcn.14003b720
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14003b720
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0x4f8]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400358f0
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003b770
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14003b720
add rsp, 0x20
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x20
call fcn.14003b720
add rsp, 0x20
pop rcx
push rax
push qword [rbp + 0x20]
push qword [rsp + 0x510]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400028e5
add rsp, 0x30
pop rax
lea rcx, [rsp + 0x4f8]
pop rdx
call fcn.14003b7e0
push qword [rsp + 0x4e8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f0]
xor rdx, rdx
call fcn.14003ba90
or rax, rax
jne 0x14000349f
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003b720
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003b770
add rsp, 0x28
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003b770
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_ioctlsocket
sub rsp, 0x28
call fcn.14003b770
add rsp, 0x28
lea rcx, [rsp + 0x500]
pop rdx
call fcn.14003b7e0
jmp 0x1400034a1
jmp 0x1400034a6
jmp 0x1400032ab
push qword [rsp + 0x4d8]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0x4f8]
push rcx
sub rsp, 0x28
call fcn.14003b720
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003b770
add rsp, 0x28
pop rax
push rax
call fcn.14003b9b0
pop rdx
add rax, rdx
jmp 0x1400034ef
push rax
mov rcx, qword [rsp + 0x4f8]
sub rsp, 0x28
call fcn.14003bbe0
add rsp, 0x28
mov rcx, qword [rsp + 0x500]
sub rsp, 0x28
call fcn.14003bbe0
add rsp, 0x28
pop rax
add rsp, 0x508
pop r15
pop rbp
ret