Function at 0x140002370
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x300], rbx
mov rax, qword [0x1400180a8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r13, rdx
mov rbx, rcx
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400025ef
xor r14d, r14d
or r15, 0xffffffffffffffff
movabs rsi, 0x6666666666666667
movabs r12, 0x7ffffffffffffffe
nop dword [rax]
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rbp - 0x74]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x38]
call fcn.140004f70
nop
mov r8, qword [rbx + 8]
lea rax, [rsp + 0x38]
cmp rax, r8
jae 0x1400024ad
mov rax, qword [rbx]
lea rcx, [rsp + 0x38]
cmp rax, rcx
ja 0x1400024ad
lea rcx, [rsp + 0x38]
sub rcx, rax
mov rax, rsi
imul rcx
mov rdi, rdx
sar rdi, 4
mov rax, rdi
shr rax, 0x3f
add rdi, rax
cmp r8, qword [rbx + 0x10]
jne 0x14000246e
mov rcx, rbx
call fcn.140004d20
lea rcx, [rdi + rdi*4]
mov rax, qword [rbx]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
test rcx, rcx
je 0x1400024a8
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
mov r9, r15
xor r8d, r8d
call fcn.140004b50
nop
jmp 0x1400025b4
cmp r8, qword [rbx + 0x10]
jne 0x1400024bb
mov rcx, rbx
call fcn.140004d20
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rdi
test rdi, rdi
je 0x1400025b4
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov rsi, qword [rsp + 0x48]
cmp rsi, 0xffffffffffffffff
cmova rsi, r15
lea rax, [rsp + 0x38]
cmp rdi, rax
jne 0x140002519
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.1400050d0
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400050d0
jmp 0x1400025aa
cmp rsi, r12
ja 0x1400025e2
mov rax, qword [rdi + 0x18]
cmp rax, rsi
jae 0x14000253c
mov r8, qword [rdi + 0x10]
mov rdx, rsi
mov rcx, rdi
call fcn.140005620
jmp 0x140002557
test rsi, rsi
jne 0x14000255a
mov qword [rdi + 0x10], r14
cmp rax, 8
jb 0x140002550
mov rax, qword [rdi]
jmp 0x140002553
mov rax, rdi
mov word [rax], r14w
test rsi, rsi
setne al
test al, al
je 0x1400025aa
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
cmp qword [rdi + 0x18], 8
jb 0x14000257e
mov rcx, qword [rdi]
jmp 0x140002581
mov rcx, rdi
lea r12, [rsi + rsi]
mov r8, r12
call fcn.140005c10
mov qword [rdi + 0x10], rsi
cmp qword [rdi + 0x18], 8
jb 0x14000259b
mov rdi, qword [rdi]
mov word [r12 + rdi], r14w
movabs r12, 0x7ffffffffffffffe
movabs rsi, 0x6666666666666667
add qword [rbx + 8], 0x28
cmp qword [rsp + 0x50], 8
jb 0x1400025cb
mov rcx, qword [rsp + 0x38]
call fcn.1400059f8
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400025ef
jmp 0x1400023f0
lea rcx, str.string_too_long
call fcn.140005910
nop
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140005a10
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret