Function at 0x140001420
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
mov rdx, rcx
mov qword [rsp + 0x2c0], rcx
lea rcx, [rsp + 0x2c0]
call fcn.1400772b0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x50]
mov r8d, 0x238
xor edx, edx
mov rcx, rdi
call fcn.140035ac0
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x28]
mov qword [0x140157047], rax
lea rax, [rsp + 0x30]
mov qword [0x14015705b], rax
lea rsi, [rsp + 0x38]
mov qword [0x14015706a], rsi
lea rax, [rsp + 0x2c0]
mov qword [0x14015707d], rax
lea rax, [rsp + 0x40]
mov qword [0x140157090], rax
mov qword [0x1401570a4], rdi
lea rax, [rsp + 0x48]
mov qword [0x1401570c2], rax
xor edx, edx
mov ecx, 0x9a
call fcn.140077ca0
xor edx, edx
xor ecx, ecx
call fcn.140079930
xor edx, edx
mov ecx, 0x110002b
call fcn.1400778c0
xor edx, edx
mov ecx, 0x110002c
call fcn.1400778c0
lea rbp, [0x14015d8a0]
mov rdx, rbp
mov rcx, rsi
call fcn.140077330
xor edx, edx
mov ecx, 0x110002c
call fcn.1400778c0
mov qword [rsp + 0x28], 0xffffffffffffffff
xor edx, edx
mov ecx, 0x110002d
call fcn.1400778c0
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov ecx, 0x110002d
call fcn.1400786b0
mov qword [rsp + 0x30], rbx
xor edx, edx
mov ecx, 0x110002e
call fcn.1400778c0
call fcn.140077130
call fcn.140077130
call fcn.140077060
mov edx, eax
mov rcx, qword [rsp + 0x2c0]
call fcn.140069e80
call fcn.140077060
mov edx, eax
lea rcx, [rsp + 0x2c0]
call fcn.140077200
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079650
xor edx, edx
mov ecx, 0x110002f
call fcn.1400778c0
cmp qword [rsp + 0x30], 0
jne 0x140001600
xor edx, edx
mov ecx, 0x1100044
call fcn.1400778c0
xor edx, edx
mov ecx, 0x1100045
call fcn.1400778c0
mov rbx, qword [rsp + 0x28]
call fcn.140078070
mov rcx, qword [rsp + 0x38]
call fcn.1400771d0
mov rcx, qword [rsp + 0x2c0]
call fcn.1400771d0
mov rax, rbx
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x1100031
call fcn.1400778c0
mov dword [rsp + 0x50], 0x238
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079650
xor edx, edx
mov ecx, 0x1100033
call fcn.1400778c0
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32FirstW
mov rbx, rax
mov ecx, 0x1100033
call fcn.1400786b0
test rbx, rbx
je 0x140001744
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x1400016e9
jmp 0x14000170c
xor edx, edx
mov ecx, 0x1100034
call fcn.1400778c0
xor edx, edx
mov ecx, 0x1100035
call fcn.1400778c0
movsxd rax, dword [rsp + 0x58]
mov qword [rsp + 0x48], rax
xor edx, edx
mov ecx, 0x1100036
call fcn.1400778c0
mov r8, qword [rsp + 0x48]
xor edx, edx
mov ecx, 0x410
call sub.KERNEL32.dll_OpenProcess
mov rbx, rax
mov ecx, 0x1100036
call fcn.1400786b0
mov qword [rsp + 0x40], rbx
xor edx, edx
mov ecx, 0x1100038
call fcn.1400778c0
cmp qword [rsp + 0x40], 0
jne 0x140001788
xor edx, edx
mov ecx, 0x110003f
call fcn.1400778c0
xor edx, edx
mov ecx, 0x1100040
call fcn.1400778c0
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14000170c
mov rdx, rdi
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
mov rbx, rax
mov ecx, 0x1100034
call fcn.1400786b0
test rbx, rbx
jne 0x140001660
xor edx, edx
mov ecx, 0x1100034
call fcn.1400778c0
xor edx, edx
mov ecx, 0x1100041
call fcn.1400778c0
mov rcx, qword [rsp + 0x40]
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0x1100041
call fcn.1400786b0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079650
xor edx, edx
mov ecx, 0x1100042
call fcn.1400778c0
xor edx, edx
mov ecx, 0x1100043
call fcn.1400778c0
mov rcx, qword [rsp + 0x30]
call sub.KERNEL32.dll_CloseHandle
mov ecx, 0x1100043
call fcn.1400786b0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079650
jmp 0x1400015b3
xor edx, edx
mov ecx, 0x1100039
call fcn.1400778c0
call fcn.140077130
call fcn.140077130
call fcn.140077060
mov edx, eax
mov rcx, qword [rsp + 0x40]
call fcn.140001220
mov ecx, 0x1100039
call fcn.1400786b0
call fcn.140077060
mov edx, eax
mov rcx, rsi
call fcn.140077200
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079650
xor edx, edx
mov ecx, 0x110003a
call fcn.1400778c0
call fcn.140077130
call fcn.140077130
call fcn.140077130
call fcn.140077130
call fcn.140077060
mov ebx, eax
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.14006cfa8
mov edx, ebx
mov rcx, qword [rsp + 0x38]
call fcn.14006d068
call fcn.140077100
mov rbx, rax
call fcn.140077060
mov edx, eax
mov rcx, rbx
call fcn.140069e80
mov rbx, qword [rsp + 0x2c0]
call fcn.1400770d0
mov rcx, rax
mov rdx, rbx
call fcn.140077410
xor edx, edx
test eax, eax
jne 0x140001870
mov ecx, 0x110003d
call fcn.1400778c0
xor edx, edx
mov ecx, 0x110003e
call fcn.1400778c0
mov rdx, rbp
mov rcx, rsi
call fcn.140077330
jmp 0x1400016c9
mov ecx, 0x110003b
call fcn.1400778c0
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor edx, edx
mov ecx, 0x110003c
call fcn.1400778c0
jmp 0x140001718