Function at 0x140006670
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x770
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400ad280]
xor rax, rsp
mov qword [rbp + 0x720], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400068c4
movabs rdx, 0x34b67fd49373b712
movabs rax, 0x369aef50249b26d
mov qword [rbp], rax
movabs rcx, 0x369aef5020bb205
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x2a8], rax
movabs rax, 0x306ae870279b240
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x34c47f979353b760
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xf36c73cb11a6e152
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xf9c54b6e45731d52
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xa8f05d12821a67ab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x86c337e04707d3f5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xd88c284b09124365
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x6dac6c1e66330848
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0xf30573bf11c7e137
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0xf9954b4e45141d3c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0xa8955d71827567d9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rax, 0x869037c04774d386
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movabs rax, 0xd8ff283b0973430b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x6dac6c6a665c0820
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x2c0]
mov qword [rbp + 0x2f8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x2e0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, 0x10
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140006960
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140006957
lea r8, [rbp + 0x8c]
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.1400613a4
mov edx, 0x104
lea rcx, [rbp + 0x510]
call fcn.14006611c
mov r8, rdi
lea rcx, [rbp + 0x300]
mov edx, 0x104
call fcn.1400613a4
mov edx, 0x104
lea rcx, [rbp + 0x300]
call fcn.14006611c
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x510]
call fcn.1400504ec
mov rcx, rbx
test rax, rax
jne 0x140006986
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400068e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x720]
xor rcx, rsp
call fcn.14004e350
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x68]
jmp 0x140006962