Function at 0x1400dad00
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1e8
mov r12, qword [0x14022c040]
mov ecx, 2
mov rdx, qword [r12]
mov qword [rsp + 0x1d8], rdx
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400dac21
mov rax, qword [0x14022c910]
pxor xmm0, xmm0
xor edx, edx
xor r13d, r13d
lea rbp, [rsp + 0x30]
movups xmmword [rsp + 0x40], xmm0
lea r14, [rsp + 0x70]
mov rcx, rbp
movups xmmword [rsp + 0x50], xmm0
mov rbx, r14
lea rdi, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], 0
call fcn.1401510f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov rdx, rdi
mov rcx, rsi
mov dword [rsp + 0xa0], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1400dac63
mov rcx, rbp
call fcn.140151580
mov rax, qword [0x14022c970]
lea r8, [0x140206404]
mov edx, 0x7a
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_ancestry
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1400a19a0
mov rcx, rbp
call fcn.140150cf0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x1d8]
sub rax, qword [r12]
jne 0x1400dacf2
add rsp, 0x1e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, rdi
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x1400dabd5
cmp r15d, dword [rsp + 0xa8]
jne 0x1400dac50
test r13d, r13d
jne 0x1400dac90
mov dword [rbx], r15d
add r13d, 1
mov r15d, dword [rsp + 0xc0]
add rbx, 4
jmp 0x1400dabb7
lea rdx, [rsp + 0xcc]
mov rcx, rbp
call fcn.1401511b0
mov rax, r14
jmp 0x1400dacb9
add rax, 4
cmp rax, rbx
je 0x1400dacd8
cmp dword [rax], r15d
jne 0x1400dacb0
lea rdx, str._cycle_
mov rcx, rbp
call fcn.1401511b0
jmp 0x1400dabd5
cmp r13d, 0xa
jne 0x1400dac72
lea rdx, str._truncated_
mov rcx, rbp
call fcn.1401511b0
jmp 0x1400dabd5
call fcn.1401d96b0
nop
nop dword [rax + rax]
push rsi
push rbx
sub rsp, 0xc8
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0xb8], rax
xor eax, eax
mov ebx, ecx
call fcn.1400a08e0
test eax, eax
je 0x1400dad70
test ebx, ebx
je 0x1400dad90
cmp ebx, 1
jne 0x1400daf41
movzx eax, byte [0x1401e49b8]
test al, 1
je 0x1400daeb0
mov rbx, qword [0x1401e49b0]
test rbx, rbx
je 0x1400dae88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x70]
mov r8d, 0x48
mov rcx, rax
call rbx
test eax, eax
jne 0x1400dadc0
nop
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsi]
jne 0x1400daf3c
add rsp, 0xc8
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400daf00
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsi]
jne 0x1400daf3c
add rsp, 0xc8
pop rbx
pop rsi
jmp 0x1400dab20
mov rax, qword [0x14022c910]
lea rbx, [rsp + 0x30]
pxor xmm0, xmm0
xor edx, edx
mov rcx, rbx
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x60], 0
call fcn.140150d10
mov r8d, dword [rsp + 0x74]
mov rcx, rbx
lea rdx, str.PageFaultCount
call fcn.140150e00
mov r8, qword [rsp + 0x78]
mov rcx, rbx
lea rdx, str.PeakWorkingSetSize
call fcn.140150e00
mov r8, qword [rsp + 0xb0]
lea rdx, str.PeakPagefileUsage
mov rcx, rbx
call fcn.140150e00
mov rcx, rbx
call fcn.140151580
mov rax, qword [0x14022c970]
lea r8, [0x140206404]
mov edx, 0xaa
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_memory
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1400a19a0
mov rcx, rbx
call fcn.140150cf0
jmp 0x1400dad70
call qword [sym.imp.msvcrt.dll__errno]
mov rbx, qword [0x1401e49b0]
mov dword [rax], 0x28
test rbx, rbx
je 0x1400dad70
jmp 0x1400dad54
or eax, 1
xor edx, edx
mov rcx, qword [0x1401e49a0]
mov r8d, 0x800
mov byte [0x1401e49b8], al
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x1400dad44
mov rdx, qword [0x1401e49a8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401e49b0], rax
mov rbx, rax
jmp 0x1400dad4b
mov rax, qword [0x14022c970]
lea r8, [0x140206404]
mov edx, 0x8d
lea rcx, str.compat_win32_trace2_win32_process_info.c
mov r9, qword [rax]
lea rax, str.windows_debugger_present
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.1400a18d0
jmp 0x1400dad9e
call fcn.1401d96b0
mov r9d, ebx
lea r8, str.trace2_collect_process_info:_unknown_reason__d
mov edx, 0xc1
lea rcx, str.compat_win32_trace2_win32_process_info.c
call fcn.1400b6d50
nop
nop
nop
nop