Function at 0x200001510
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x11e0
call fcn.200014ce0
sub rsp, rax
lea rcx, [rsp + 0x2e1]
xor edx, edx
mov r8d, 0xeff
mov byte [rsp + 0x2e0], 0
call fcn.20000d940
xor esi, esi
xor r13d, r13d
xor ebp, ebp
xor r12d, r12d
lea r14, [0x200000000]
cmp byte [0x20001bbd4], sil
je 0x2000016cd
lea rbx, [0x20001bbd4]
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x21]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
mov rdi, rbx
xor r9d, r9d
repne scasb al, byte [rdi]
mov rax, qword [r14 + 0x17c68]
xor r11d, r11d
mov qword [rdx], rax
movzx eax, word [r14 + 0x17c70]
not rcx
mov word [rdx + 8], ax
movzx eax, byte [r14 + 0x17c72]
dec rcx
movsxd r10, ecx
mov byte [rdx + 0xa], al
test ecx, ecx
jle 0x20000162e
lea r8, [rsp + 0x1d0]
mov r11, r10
sub r8, rbx
nop word [rax + rax]
movzx edi, byte [rbx]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x20]
cmp dil, cl
je 0x20000161e
xor dil, cl
mov byte [r8 + rbx], dil
inc rbx
inc r9d
sub r10, 1
jne 0x2000015f0
lea rdx, [0x200017c64]
lea rcx, [rsp + 0x1d0]
mov byte [rsp + r11 + 0x1d0], 0
call fcn.200008164
mov rdx, rax
test rax, rax
je 0x2000016a6
movsxd rcx, ebp
lea rdi, [rcx + rcx*4]
add rdi, rdi
nop dword [rax]
movsxd rcx, esi
add rcx, rdi
shl rcx, 4
sub rcx, rdx
lea rcx, [rsp + rcx + 0x2e0]
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x200001680
lea rdx, [0x200017c94]
xor ecx, ecx
call fcn.200008164
inc esi
mov rdx, rax
test rax, rax
jne 0x200001660
inc r12
inc ebp
xor esi, esi
mov rax, r12
mov r13d, ebp
imul rax, rax, 0x54
cmp byte [rax + r14 + 0x1bbd4], sil
lea rbx, [rax + r14 + 0x1bbd4]
jne 0x200001580
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
mov qword [rsp + 0x1228], rax
cmp rax, 0xffffffffffffffff
je 0x2000017f8
lea rdx, [rsp + 0xa0]
mov rcx, rax
mov dword [rsp + 0xa0], 0x130
movsxd r14, r13d
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x2000017ef
xor r12d, r12d
xor ebp, ebp
test r13d, r13d
jle 0x2000017cc
mov r15, qword [rsp + 0x1220]
nop dword [rax + rax]
or rcx, 0xffffffffffffffff
movsxd rax, r12d
xor ebx, ebx
lea rsi, [rax + rax*4]
add rsi, rsi
mov rax, rsi
add rax, rax
lea rdx, [rsp + rax*8 + 0x2e0]
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x2000017b5
nop
lea rcx, [rsp + 0xcc]
call fcn.200007cc4
test eax, eax
je 0x20000179a
or rcx, 0xffffffffffffffff
inc ebx
movsxd rax, ebx
add rax, rsi
add rax, rax
lea rdx, [rsp + rax*8 + 0x2e0]
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x200001760
jmp 0x2000017b5
imul rbp, rbp, 0x54
lea rax, [0x200000000]
mov r12d, r13d
mov eax, dword [rax + rbp + 0x1bbd0]
mov rbp, r14
or dword [r15], eax
inc r12d
inc rbp
cmp r12d, r13d
jl 0x200001730
mov r15, qword [rsp + 0x1228]
lea rdx, [rsp + 0xa0]
mov rcx, r15
mov dword [rsp + 0xa0], 0x130
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x200001712
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x1230]
add rsp, 0x11e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret