Function at 0x1400035c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140102040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r13, rdx
xor r12d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x140003849
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003840
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r13 + r8*2], 0
jne 0x140003660
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140022ab0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400036a0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.140022ab0
mov r10, qword [rsp + 0x30]
mov r9, qword [rsp + 0x50]
cmp r10, r9
je 0x1400036d4
xor bl, bl
mov r9, qword [rsp + 0x38]
jmp 0x14000377a
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
seta dl
cmova rcx, qword [rsp + 0x40]
lea r8, [rcx + r9*2]
lea r14, [rsp + 0x40]
test dl, dl
cmovne r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 7
seta dl
cmova rcx, qword [rsp + 0x20]
lea r15, [rcx + r10*2]
lea rbx, [rsp + 0x20]
test dl, dl
cmovne rbx, qword [rsp + 0x20]
sub r8, r14
mov rax, r15
sub rax, rbx
xor r8, rax
test r8, 0xfffffffffffffffe
je 0x14000373a
xor bl, bl
jmp 0x14000377a
cmp rbx, r15
je 0x140003773
sub r14, rbx
movzx esi, word [r14 + rbx]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx edi, ax
movzx ecx, si
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp di, ax
jne 0x140003821
add rbx, 2
cmp rbx, r15
jne 0x140003742
mov r9, qword [rsp + 0x38]
mov bl, 1
mov rdi, qword [rsp + 0x60]
cmp r9, 7
jbe 0x1400037b3
lea rdx, [r9*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000382d
call fcn.14008a3a4
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
mov r8, qword [rsp + 0x58]
cmp r8, 7
jbe 0x140003805
lea rdx, [r8*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003800
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003834
call fcn.14008a3a4
test bl, bl
jne 0x14000383b
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003640
jmp 0x140003840
xor bl, bl
mov r9, qword [rsp + 0x38]
jmp 0x140003775
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r12d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14008a030
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret