Function at 0x140005690
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
xor edx, edx
mov r8d, 0x238
lea r15, [rsp + 0x80]
mov rsi, rcx
mov rcx, r15
call fcn.140010a70
xor edx, edx
mov ecx, 2
mov dword [rsp + 0x80], 0x238
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov r14, rax
je 0x140005b76
lea rdi, [rsp + 0x50]
mov rdx, r15
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
mov qword [rsp + 0x30], rdi
lea rdi, [rsp + 0xac]
movdqa xmm6, xmmword [0x1400c46b0]
test eax, eax
mov qword [rsp + 0x38], rdi
je 0x140005a17
nop dword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov rbp, rbx
sar rbp, 1
cmp rbx, 0xe
ja 0x140005a50
cmp rbp, 1
mov r12, qword [rsp + 0x40]
je 0x140005a9a
test rbp, rbp
je 0x140005771
mov rdx, qword [rsp + 0x38]
mov rcx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r12, qword [rsp + 0x40]
lea r13, [rsp + 0x70]
xor ecx, ecx
cmp rbx, 0x1e
mov qword [rsp + 0x48], rbp
lea rdi, [r12 + rbx]
mov rdx, r13
mov word [rdi], cx
mov qword [rsp + 0x60], r13
ja 0x140005ab0
cmp rdi, r12
je 0x140005925
sub rbx, 2
mov rcx, rbx
shr rcx, 1
lea r8, [rcx + 1]
lea rax, [rdx + r8]
cmp r12, rax
setae al
cmp rdx, rdi
setae r9b
or al, r9b
je 0x140005b40
cmp rbx, 0x1c
jbe 0x140005b40
mov rcx, r8
xor eax, eax
and rcx, 0xfffffffffffffff0
nop word [rax + rax]
movdqu xmm0, xmmword [r12 + rax*2]
movdqu xmm1, xmmword [r12 + rax*2 + 0x10]
pand xmm0, xmm6
pand xmm1, xmm6
packuswb xmm0, xmm1
movups xmmword [rdx + rax], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x1400057e0
mov rcx, r8
and rcx, 0xfffffffffffffff0
lea rax, [r12 + rcx*2]
add rdx, rcx
cmp rcx, r8
je 0x140005920
movzx ecx, word [rax]
mov byte [rdx], cl
lea rcx, [rax + 2]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 2]
mov byte [rdx + 1], cl
lea rcx, [rax + 4]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 4]
mov byte [rdx + 2], cl
lea rcx, [rax + 6]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 6]
mov byte [rdx + 3], cl
lea rcx, [rax + 8]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 8]
mov byte [rdx + 4], cl
lea rcx, [rax + 0xa]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0xa]
mov byte [rdx + 5], cl
lea rcx, [rax + 0xc]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0xc]
mov byte [rdx + 6], cl
lea rcx, [rax + 0xe]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0xe]
mov byte [rdx + 7], cl
lea rcx, [rax + 0x10]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x10]
mov byte [rdx + 8], cl
lea rcx, [rax + 0x12]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x12]
mov byte [rdx + 9], cl
lea rcx, [rax + 0x14]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x14]
mov byte [rdx + 0xa], cl
lea rcx, [rax + 0x16]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x16]
mov byte [rdx + 0xb], cl
lea rcx, [rax + 0x18]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x18]
mov byte [rdx + 0xc], cl
lea rcx, [rax + 0x1a]
cmp rdi, rcx
je 0x140005920
movzx ecx, word [rax + 0x1a]
mov byte [rdx + 0xd], cl
lea rcx, [rax + 0x1c]
cmp rdi, rcx
je 0x140005920
movzx eax, word [rax + 0x1c]
mov byte [rdx + 0xe], al
nop word [rax + rax]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbp
lea rdi, [rsi + 0x10]
mov byte [rdx + rbp], 0
mov rcx, qword [rsi]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsi + 8]
mov r9, qword [rsp + 0x60]
cmp rcx, rdi
lea rbx, [r8 + rdx]
je 0x140005b30
mov rax, qword [rsi + 0x10]
cmp rbx, rax
ja 0x140005b08
test r8, r8
je 0x14000597a
add rcx, rdx
cmp r8, 1
je 0x140005b68
mov rdx, r9
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsi]
mov qword [rsi + 8], rbx
mov byte [rcx + rbx], 0
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x14000599a
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.1400bf650
movabs rax, 0x7fffffffffffffff
mov rbx, qword [rsi + 8]
sub rax, rbx
cmp rax, 1
jbe 0x140005c20
mov rax, qword [rsi]
lea rbp, [rbx + 2]
cmp rdi, rax
je 0x140005b20
mov rdx, qword [rsi + 0x10]
cmp rbp, rdx
ja 0x140005ae0
mov edx, 0xa0d
mov word [rax + rbx], dx
mov rax, qword [rsi]
mov qword [rsi + 8], rbp
mov rdx, r15
mov rcx, r14
mov byte [rax + rbx + 2], 0
call sub.KERNEL32.dll_Process32NextW
mov rcx, qword [rsp + 0x40]
mov ebx, eax
cmp rcx, qword [rsp + 0x30]
je 0x140005a40
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call fcn.1400bf650
test ebx, ebx
jne 0x140005720
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
movaps xmm6, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test eax, eax
jne 0x140005720
jmp 0x140005a17
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x140005c38
lea rax, [rbp + 1]
movabs rdi, 0x3fffffffffffffff
cmp rax, rdi
ja 0x140005c0c
lea rcx, [rbx + 2]
call fcn.1400bf690
cmp rbp, 1
mov qword [rsp + 0x50], rbp
mov r12, rax
mov qword [rsp + 0x40], rax
jne 0x140005757
movzx eax, word [rsp + 0xac]
mov word [r12], ax
jmp 0x140005771
test rbx, rbx
js 0x140005c2c
mov rcx, rbp
add rcx, 1
js 0x140005c16
call fcn.1400bf690
mov rdx, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rbp
jmp 0x140005796
mov qword [rsp + 0x20], 2
lea r9, [0x1400c4393]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.1400acba0
jmp 0x1400059db
mov qword [rsp + 0x20], r8
mov rcx, rsi
xor r8d, r8d
call fcn.1400acba0
mov rcx, qword [rsi]
jmp 0x14000597a
mov edx, 0xf
jmp 0x1400059c9
mov eax, 0xf
jmp 0x140005954
xor eax, eax
nop word [rax + rax]
movzx r8d, word [r12 + rax*2]
mov byte [rdx + rax], r8b
mov r8, rax
add rax, 1
cmp rcx, r8
jne 0x140005b48
jmp 0x140005920
movzx eax, byte [r9]
mov byte [rcx], al
mov rcx, qword [rsi]
jmp 0x14000597a
mov rax, qword [0x1400c93d0]
mov ecx, 0x13
movabs rsi, 0x616e5320656b6154
lea r13, [rsp + 0x70]
mov qword [rsp + 0x60], r13
lea r14, [rsp + 0x60]
mov r12, qword [rax]
call fcn.1400bf690
mov r8d, 0x6c69
mov rdx, r14
mov qword [rsp + 0x70], 0x12
mov qword [rax], rsi
movabs rsi, 0x616620746f687370
mov word [rax + 0x10], r8w
mov r8d, 2
mov qword [rax + 8], rsi
mov rcx, r12
mov byte [rax + 0x12], 0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0x12
call fcn.14000f2d0
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x140005a21
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.1400bf650
jmp 0x140005a21
test rax, rax
js 0x140005c1b
call fcn.1400c0570
call fcn.1400c0570
call fcn.1400c05b0
lea rcx, [0x1400c437e]
call fcn.1400c0760
lea rcx, [0x1400c41d3]
call fcn.1400c0760
lea rcx, [0x1400c41d3]
call fcn.1400c0760
mov rcx, qword [rsp + 0x60]
mov r12, rax
cmp rcx, r13
je 0x140005c99
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.1400bf650
jmp 0x140005c99
mov rcx, qword [rsp + 0x40]
cmp rcx, qword [rsp + 0x30]
je 0x140005c99
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
add rdx, rdx
call fcn.1400bf650
mov rcx, r12
call fcn.14001b780
mov r12, rax
jmp 0x140005c7c