Function at 0x1400017c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x2e0], xmm15
movdqa xmmword [rbp + 0x2d0], xmm14
movdqa xmmword [rbp + 0x2c0], xmm13
movdqa xmmword [rbp + 0x2b0], xmm12
movdqa xmmword [rbp + 0x2a0], xmm11
movdqa xmmword [rbp + 0x290], xmm10
movdqa xmmword [rbp + 0x280], xmm9
movdqa xmmword [rbp + 0x270], xmm8
movdqa xmmword [rbp + 0x260], xmm7
movdqa xmmword [rbp + 0x250], xmm6
mov qword [rbp + 0x248], 0xfffffffffffffffe
xor ebx, ebx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
lea r12, [rbp - 0x2c]
mov r8d, 0x208
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x58], 0x238
mov dword [rbp - 0x50], 0
pxor xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movdqu xmmword [rbp - 0x3c], xmm0
lea rdx, [rbp - 0x58]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140001cf8
movdqa xmm6, xmmword [str.Your_Friends.exeGolf_With_Your_FGGGGGGGGGGGGGGGGeeeeeeeeeeeeeeee]
movdqa xmm7, xmmword [0x14001f3d0]
movdqa xmm8, xmmword [0x14001f3e0]
movdqa xmm9, xmmword [0x14001f3f0]
mov qword [rbp + 0x218], rsi
nop
mov r8d, 0x104
lea rcx, [rbp + 0x1f8]
mov rdx, r12
call fcn.140007230
mov rdx, qword [rbp + 0x1f8]
mov r8, qword [rbp + 0x208]
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x240], rdx
call fcn.14000d0c0
mov rdi, qword [rbp + 0x1e0]
mov r14, qword [rbp + 0x1e8]
test rdi, rdi
mov r13, rdi
cmove r13, r14
mov r15, qword [rbp + 0x1f0]
cmp r15, 0x1b
jb 0x140001970
cmp r15, 0x28
ja 0x1400019b0
nop word cs:[rax + rax]
cmp r15, 0x1a
jb 0x140001c1c
movdqu xmm0, xmmword [r13]
movdqu xmm1, xmmword [r13 + 0xa]
pcmpeqb xmm1, xmm6
pcmpeqb xmm0, xmm7
pand xmm0, xmm1
pmovmskb eax, xmm0
inc r13
dec r15
cmp eax, 0xffff
jne 0x140001930
jmp 0x140001c97
cmp r15, 0x1a
jne 0x140001c1c
movdqu xmm0, xmmword [r13]
movdqu xmm1, xmmword [r13 + 0xa]
pcmpeqb xmm1, xmm6
pcmpeqb xmm0, xmm7
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
jne 0x140001c1c
jmp 0x140001c97
mov qword [rbp + 0x220], r13
mov qword [rbp + 0x228], r15
lea rax, [0x1400f2309]
mov qword [rbp + 0x230], rax
mov qword [rbp + 0x238], 0x19
cmp r15, 0x5a
jb 0x140001b65
xor ebx, ebx
xor r12d, r12d
nop word cs:[rax + rax]
movdqu xmm0, xmmword [r13 + rbx]
movdqu xmm14, xmmword [r13 + rbx + 0x10]
movdqu xmm1, xmmword [r13 + rbx + 0x19]
movdqu xmm12, xmmword [r13 + rbx + 0x20]
pcmpeqb xmm0, xmm8
pcmpeqb xmm1, xmm9
pand xmm1, xmm0
pmovmskb r8d, xmm1
movdqu xmm15, xmmword [r13 + rbx + 0x29]
movdqu xmm13, xmmword [r13 + rbx + 0x39]
movdqu xmm10, xmmword [r13 + rbx + 0x30]
movdqu xmm11, xmmword [r13 + rbx + 0x49]
test r8d, r8d
jne 0x140001ac5
pcmpeqb xmm14, xmm8
pcmpeqb xmm15, xmm9
pand xmm15, xmm14
pmovmskb r8d, xmm15
test r8w, r8w
jne 0x140001ae8
pcmpeqb xmm12, xmm8
pcmpeqb xmm13, xmm9
pand xmm13, xmm12
pmovmskb r8d, xmm13
test r8w, r8w
jne 0x140001b0c
pcmpeqb xmm10, xmm8
pcmpeqb xmm11, xmm9
pand xmm11, xmm10
pmovmskb r8d, xmm11
test r8w, r8w
jne 0x140001b30
lea rsi, [rbx + 0x40]
add rbx, 0x99
cmp rbx, r15
jae 0x140001b6a
mov eax, r12d
mov rbx, rsi
and al, 1
je 0x1400019f0
jmp 0x140001b6a
mov r9d, r12d
and r9b, 1
lea rcx, [rbp + 0x220]
mov rdx, rbx
call fcn.14001d0b0
or al, r12b
and al, 1
mov r12d, eax
jmp 0x140001a44
lea rdx, [rbx + 0x10]
mov r9d, r12d
and r9b, 1
lea rcx, [rbp + 0x220]
call fcn.14001d0b0
or al, r12b
and al, 1
mov r12d, eax
jmp 0x140001a62
lea rdx, [rbx + 0x20]
mov r9d, r12d
and r9b, 1
lea rcx, [rbp + 0x220]
call fcn.14001d0b0
or al, r12b
and al, 1
mov r12d, eax
jmp 0x140001a80
lea rdx, [rbx + 0x30]
mov r9d, r12d
and r9b, 1
lea rcx, [rbp + 0x220]
call fcn.14001d0b0
or al, r12b
and al, 1
mov r12d, eax
lea rsi, [rbx + 0x40]
add rbx, 0x99
cmp rbx, r15
jb 0x140001ab2
jmp 0x140001b6a
xor r12d, r12d
xor esi, esi
lea rax, [rsi + 0x29]
mov r9d, r12d
and r9b, 1
cmp rax, r15
jae 0x140001be0
nop word [rax + rax]
test r9b, r9b
jne 0x140001be0
movdqu xmm0, xmmword [r13 + rsi]
movdqu xmm1, xmmword [r13 + rsi + 0x19]
pcmpeqb xmm0, xmm8
pcmpeqb xmm1, xmm9
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140001bc6
lea rax, [rsi + 0x39]
mov r9d, r12d
and r9b, 1
cmp rax, r15
jae 0x140001be0
add rsi, 0x10
test r9b, r9b
je 0x140001b85
jmp 0x140001be0
lea rcx, [rbp + 0x220]
mov rdx, rsi
xor r9d, r9d
call fcn.14001d0b0
mov r12d, eax
jmp 0x140001bab
movdqu xmm0, xmmword [r13 + r15 - 0x29]
movdqu xmm1, xmmword [r13 + r15 - 0x10]
pcmpeqb xmm0, xmm8
pcmpeqb xmm1, xmm9
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x140001c73
test r12b, 1
mov ebx, 0
mov rsi, qword [rbp + 0x218]
lea r12, [rbp - 0x2c]
jne 0x140001c97
test rdi, rdi
je 0x140001c37
test r14, r14
je 0x140001c37
mov r8d, 1
mov rcx, rdi
mov rdx, r14
call fcn.140002380
mov rcx, rsi
lea rdx, [rbp - 0x58]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140001cda
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x1400018c0
mov r8d, 1
mov rcx, qword [rbp + 0x240]
call fcn.140002380
jmp 0x1400018c0
add r15, 0xffffffffffffffd7
test r9b, r9b
setne bl
lea rcx, [rbp + 0x220]
mov rdx, r15
call fcn.14001d0b0
mov r12d, eax
or r12b, bl
jmp 0x140001c06
test rdi, rdi
je 0x140001cb2
test r14, r14
je 0x140001cb2
mov r8d, 1
mov rcx, rdi
mov rdx, r14
call fcn.140002380
mov esi, dword [rbp - 0x50]
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x140001cd3
mov r8d, 1
mov rcx, qword [rbp + 0x240]
call fcn.140002380
mov ebx, 1
jmp 0x140001cf8
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x140001cf8
mov r8d, 1
mov rcx, qword [rbp + 0x240]
call fcn.140002380
mov eax, ebx
mov edx, esi
movaps xmm6, xmmword [rbp + 0x250]
movaps xmm7, xmmword [rbp + 0x260]
movaps xmm8, xmmword [rbp + 0x270]
movaps xmm9, xmmword [rbp + 0x280]
movaps xmm10, xmmword [rbp + 0x290]
movaps xmm11, xmmword [rbp + 0x2a0]
movaps xmm12, xmmword [rbp + 0x2b0]
movaps xmm13, xmmword [rbp + 0x2c0]
movaps xmm14, xmmword [rbp + 0x2d0]
movaps xmm15, xmmword [rbp + 0x2e0]
add rsp, 0x378
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret