Function at 0x140027302
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140037fc0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x548
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xea
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x568]
mov rax, qword [0x140087040]
xor rax, rbp
mov qword [rbp + 0x518], rax
lea rcx, [0x140091120]
call fcn.140028211
nop
mov ecx, 0xe
call fcn.140027eab
nop
lea rdx, str._PROCESSOS_EM_SEGUNDO_PLANO_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002793d
mov qword [rbp + 0x4f8], rax
lea rdx, [0x1400278bb]
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov ecx, 7
call fcn.140027eab
nop
xor edx, edx
mov ecx, 2
call fcn.140027875
mov qword [rbp + 8], rax
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140027aff
test eax, eax
je 0x1400381cd
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x288]
call fcn.140027604
nop
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x468]
mov rcx, qword [rbp + 0x540]
call fcn.1400272e4
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea rdx, [rbp + 0x498]
mov rcx, qword [rbp + 0x540]
call fcn.140027091
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x510], rax
mov rdx, qword [rbp + 0x510]
mov rcx, qword [rbp + 0x500]
call fcn.140027929
mov byte [rbp + 0x444], al
lea rcx, [rbp + 0x498]
call fcn.14002744c
lea rcx, [rbp + 0x468]
call fcn.14002744c
movzx eax, byte [rbp + 0x444]
test eax, eax
je 0x1400381ab
lea rdx, str.Processo:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002793d
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.14002793d
lea rdx, str.___PID:
mov rcx, rax
call fcn.14002793d
mov qword [rbp + 0x4f8], rax
mov edx, dword [rbp + 0x38]
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x500], rax
lea rdx, [0x1400278bb]
mov rcx, qword [rbp + 0x500]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x4c8]
mov rcx, qword [rbp + 0x540]
call fcn.14002798d
lea rcx, [rbp + 0x4c8]
call fcn.140027e51
nop
lea rcx, [rbp + 0x288]
call fcn.140027f96
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140027faa
test eax, eax
jne 0x14003807b
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, 0xf
call fcn.140027eab
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14007c120]
call fcn.140027f0a
mov rcx, qword [rbp + 0x518]
xor rcx, rbp
call fcn.1400278ac
lea rsp, [rbp + 0x528]
pop rdi
pop rbp
ret