Function at 0x1400021e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r15d, r15d
mov dword [rsp + 0x48], r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14000272a
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000272a
movabs r12, 0x7fffffffffffffff
mov edx, 0xa
movabs rcx, 0x7ffffffffffffffe
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r15
lea rax, [rbp - 0x44]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002290
cmp rbx, rcx
ja 0x14000277b
cmp rbx, 7
ja 0x1400022d4
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 7
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x70], r15w
jmp 0x14000236c
mov rsi, rbx
or rsi, 7
cmp rsi, rcx
jbe 0x1400022e9
mov rsi, rcx
lea rcx, [r12 + r12]
jmp 0x14000230a
cmp rsi, 0xa
cmovb rsi, rdx
lea rcx, [rsi + 1]
cmp rcx, r12
ja 0x140002775
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002336
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002775
mov rcx, rax
call fcn.140018790
test rax, rax
je 0x14000276e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002348
test rcx, rcx
je 0x140002345
call fcn.140018790
mov rdi, rax
jmp 0x140002348
mov rdi, r15
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x44]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r15w
lea rcx, [rsp + 0x70]
mov r14, qword [rbp - 0x78]
cmp r14, 7
seta dl
mov rbx, qword [rsp + 0x70]
cmova rcx, rbx
mov rax, qword [rbp - 0x80]
lea rsi, [rcx + rax*2]
lea rdi, [rsp + 0x70]
test dl, dl
cmovne rdi, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
cmp rdi, rsi
jne 0x1400023c1
mov r12, r15
mov esi, 0xf
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x50], 0
jmp 0x1400024d0
sub rsi, rdi
sar rsi, 1
mov qword [rsp + 0x68], 0xf
cmp rsi, r12
ja 0x140002787
mov ebx, 0xf
cmp rsi, rbx
jbe 0x14000247e
mov rbx, rsi
or rbx, 0xf
cmp rbx, r12
jbe 0x140002406
mov rbx, r12
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000242d
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002459
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002781
mov rcx, rax
call fcn.140018790
mov rcx, rax
test rax, rax
je 0x140002767
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
jmp 0x140002483
test rcx, rcx
je 0x14000246f
call fcn.140018790
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
jmp 0x140002483
mov rax, r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rbx
jmp 0x140002483
mov rax, qword [rsp + 0x50]
lea r8, [rsp + 0x50]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400024b3
nop dword [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x1400024a0
mov qword [rsp + 0x60], rsi
mov byte [r8 + rsi], 0
mov r14, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov eax, dword [str.r_Ruf:]
mov dword [rsp + 0x30], eax
movzx eax, word [0x14001d5ac]
mov word [rsp + 0x34], ax
movzx eax, byte [0x14001d5ae]
mov byte [rsp + 0x30], 0x46
xor byte [rsp + 0x31], 0x35
xor byte [rsp + 0x32], 0x36
xor byte [rsp + 0x33], 0x37
xor byte [rsp + 0x34], 0x38
xor byte [rsp + 0x35], 0x39
xor al, 0x3a
mov byte [rsp + 0x36], al
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002520
lea rcx, [rsp + 0x50]
cmp rsi, 0xf
seta r15b
mov rdi, qword [rsp + 0x50]
cmova rcx, rdi
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov rdx, r12
call fcn.14000f000
cmp rax, 0xffffffffffffffff
je 0x1400025f3
movsd xmm0, qword [str.sawgJVYON_]
movsd qword [rsp + 0x38], xmm0
movzx ecx, word [0x14001c988]
mov word [rsp + 0x40], cx
movzx eax, byte [0x14001c98a]
mov byte [rsp + 0x38], 0x47
xor byte [rsp + 0x39], 0x35
xor byte [rsp + 0x3a], 0x36
xor byte [rsp + 0x3b], 0x37
xor byte [rsp + 0x3c], 0x38
xor byte [rsp + 0x3d], 0x39
xor byte [rsp + 0x3e], 0x3a
xor byte [rsp + 0x3f], 0x3b
xor cl, 0x3c
mov byte [rsp + 0x40], cl
xor byte [rsp + 0x41], 0x3d
xor al, 0x3e
mov byte [rsp + 0x42], al
lea rcx, [rsp + 0x38]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400025c2
lea rcx, [rsp + 0x50]
test r15b, r15b
cmovne rcx, rdi
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov rdx, r12
call fcn.14000f000
cmp rax, 0xffffffffffffffff
jne 0x140002695
test r15b, r15b
je 0x140002632
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002621
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002767
mov rcx, rdi
call fcn.140018adc
mov r14, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], r15b
cmp r14, 7
jbe 0x140002683
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000267b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000276e
mov rcx, rbx
call fcn.140018adc
lea rdx, [rbp - 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x14000224c
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x48], eax
cmp rsi, 0xf
jbe 0x1400026dc
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400026cb
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002767
mov rcx, rdi
call fcn.140018adc
mov r14, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
cmp r14, 7
jbe 0x14000272a
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140002722
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000276e
mov rcx, rbx
call fcn.140018adc
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140018770
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001380
int3
call fcn.140001420
nop
call fcn.140001380
int3
call fcn.140001420
int3