Function at 0x1400028d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x140090040]
xor rax, rsp
mov qword [rbp + 0x460], rax
movzx ebx, dl
mov r14, rcx
mov dword [rbp + 0x1f0], 0xc740c765
mov dword [rbp + 0x1f4], 0x6959753d
mov dword [rbp + 0x1f8], 0x1ec4ff7
mov dword [rbp + 0x1fc], 0x9d5b989a
mov dword [rbp + 0x200], 0xc82912aa
mov dword [rbp + 0x204], 0xb2f5783c
mov dword [rbp + 0x208], 0x46510fc4
mov dword [rbp + 0x20c], 0x373af679
mov dword [rbp + 0x210], 0xb5700d6d
mov dword [rbp + 0x214], 0xb6a63b2b
mov dword [rbp + 0x218], 0x28232dd2
mov dword [rbp + 0x21c], 0x427e0819
mov dword [rbp + 0x220], 0x252160ef
mov dword [rbp + 0x224], 0x3ccfef4f
mov dword [rbp + 0x228], 0xf4c33e17
mov dword [rbp + 0x22c], 0x4a028a35
mov dword [rbp + 0x230], 0x21d9511d
mov dword [rbp + 0x234], 0xe1cbdaa9
mov dword [rbp + 0x238], 0xa011cfa5
mov dword [rbp + 0x23c], 0x52cd1457
mov dword [rbp + 0x240], 0x4d60ca61
mov dword [rbp + 0x244], 0x1788dbd8
mov dword [rbp + 0x248], 0xa61ae472
mov dword [rbp + 0x24c], 0x70ec34ef
lea rcx, [rsp + 0x58]
call fcn.140027480
nop
movabs r12, 0x1000000000000000
movabs r13, 0x4000000000000000
xor r15d, r15d
test bl, bl
je 0x140002b41
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140004d50
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140028290
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140002ac4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030a2
call fcn.140031ce0
movdqa xmm0, xmmword [0x14007df10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002b2c
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030a8
call fcn.140031ce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140002b41
call fcn.14000e3d0
mov rax, qword [r14]
or qword [rax], r12
mov rax, qword [r14]
or qword [rax], r13
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140004d50
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140028290
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140002bdd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030ae
call fcn.140031ce0
movdqa xmm0, xmmword [0x14007df10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002c45
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030b4
call fcn.140031ce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140002d23
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x250]
call fcn.140057330
lea rcx, [rbp + 0x250]
call fcn.14002a260
mov esi, r15d
mov rbx, r15
mov qword [rbp - 0x50], 0x238
mov dword [rbp - 0x48], r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x28], r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x24]
call fcn.140057330
xor eax, eax
mov dword [rbp + 0x1e4], eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140002cfe
nop dword [rax]
lea rdx, [rbp + 0x250]
lea rcx, [rbp - 0x24]
call fcn.140041420
lea rcx, [rbx + 1]
test eax, eax
cmovne rcx, rbx
mov rbx, rcx
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002cd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 1
jbe 0x140002d23
mov ecx, Ordinal_101
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x50
jb 0x140002c70
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140004d50
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140028290
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140002dbf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030ba
call fcn.140031ce0
movdqa xmm0, xmmword [0x14007df10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002e27
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030c0
call fcn.140031ce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140002e37
mov rax, qword [r14]
or qword [rax], r12
mov rax, qword [r14]
or qword [rax], r13
lea rax, [0x14007af40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140004d50
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140027e60
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140002ec7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ec2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030c6
call fcn.140031ce0
movdqa xmm0, xmmword [0x14007df10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002f2f
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030cc
call fcn.140031ce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140002f3a
mov byte [0x14009a42c], 1
lea rax, str.__review
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140004d50
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.140027e60
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140002fc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400030d2
call fcn.140031ce0
movdqa xmm0, xmmword [0x14007df10]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000302f
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000301c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000309c
call fcn.140031ce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.140028ab0
mov edx, 0x50
mov rcx, qword [rsp + 0x70]
call fcn.140031ce0
nop
lea rcx, [rsp + 0x58]
call fcn.140028510
nop
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.140031cc0
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
nop
call fcn.14003c714
int3