Function at 0x14006c1e0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x258]
sub rsp, 0x330
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov edx, 0x84
lea rcx, [rbp - 0x40]
call fcn.140016310
nop
mov edx, 0x85
lea rcx, [rbp - 0x60]
call fcn.140016310
nop
mov edx, 0x86
lea rcx, [rbp - 0x80]
call fcn.140016310
nop
mov edx, 0x87
lea rcx, [rsp + 0x60]
call fcn.140016310
nop
mov edx, 0x88
lea rcx, [rsp + 0x40]
call fcn.140016310
nop
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x14006c5ac
mov dword [rbp - 0x10], 0x238
lea rdx, [rbp - 0x10]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x14006c299
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006c5ac
or rbx, 0xffffffffffffffff
nop dword [rax]
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rbp + 0x1c], 0
jne 0x14006c2bf
mov r8, rdi
jmp 0x14006c2db
lea rax, [rbp + 0x1c]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14006c2d0
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x20]
call fcn.14000b804
nop
lea rbx, [rsp + 0x20]
mov r12, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 8
cmovae rbx, r12
lea rax, [rsp + 0x20]
cmovae rax, r12
mov r10, qword [rsp + 0x30]
lea rax, [rax + r10*2]
lea rsi, [rsp + 0x20]
cmovae rsi, r12
mov r14, rax
sub r14, rsi
inc r14
shr r14, 1
cmp rsi, rax
mov eax, 0
cmova r14, rax
test r14, r14
je 0x14006c367
sub rsi, rbx
nop dword [rax]
movzx ecx, word [rsi + rbx]
call fcn.140155970
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x14006c340
mov r15, qword [rsp + 0x38]
mov r10, qword [rsp + 0x30]
mov r12, qword [rsp + 0x20]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x30]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14006c3c6
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14006c3ab
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14006c3c6
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
mov rbx, 0xffffffffffffffff
cmovb r8d, ebx
xor edi, edi
jmp 0x14006c3d1
jne 0x14006c395
xor edi, edi
or rbx, 0xffffffffffffffff
mov r8d, edi
test r8d, r8d
jne 0x14006c3e1
cmp r10, r9
jb 0x14006c3e1
jbe 0x14006c584
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x50]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14006c438
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14006c426
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14006c438
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14006c43d
jne 0x14006c410
mov r8d, edi
test r8d, r8d
jne 0x14006c44d
cmp r10, r9
jb 0x14006c44d
jbe 0x14006c584
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rbp - 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14006c4a8
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14006c496
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14006c4a8
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14006c4ad
jne 0x14006c480
mov r8d, edi
test r8d, r8d
jne 0x14006c4bd
cmp r10, r9
jb 0x14006c4bd
jbe 0x14006c584
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x20]
cmp r15, 8
cmovae rdx, r12
mov r9, qword [rsp + 0x70]
mov r8, r9
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14006c518
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14006c506
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x14006c518
mov r8d, 1
movzx eax, word [rcx]
cmp word [rdx], ax
cmovb r8d, ebx
jmp 0x14006c51d
jne 0x14006c4f0
mov r8d, edi
test r8d, r8d
jne 0x14006c529
cmp r10, r9
jb 0x14006c529
jbe 0x14006c584
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
cmp r15, 8
cmovae rcx, r12
mov r9, qword [rsp + 0x50]
mov rdx, r10
call fcn.140006964
test eax, eax
je 0x14006c584
cmp r15, 8
jb 0x14006c56f
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.14000c6f4
lea rdx, [rbp - 0x10]
mov rcx, r13
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14006c59f
jmp 0x14006c2a0
mov bl, 1
cmp r15, 8
jb 0x14006c5a1
lea r8, [r15 + 1]
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.14000c6f4
jmp 0x14006c5a1
xor bl, bl
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14006c5ae
xor bl, bl
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14006c5cb
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000c6f4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rdi
mov word [rsp + 0x40], di
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14006c5fb
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.14000c6f4
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rdi
mov word [rsp + 0x60], di
mov r8, qword [rbp - 0x68]
cmp r8, 8
jb 0x14006c628
inc r8
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp - 0x80]
call fcn.14000c6f4
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rdi
mov word [rbp - 0x80], di
mov r8, qword [rbp - 0x48]
cmp r8, 8
jb 0x14006c652
inc r8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x60]
call fcn.14000c6f4
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x60], di
mov r8, qword [rbp - 0x28]
cmp r8, 8
jb 0x14006c67c
inc r8
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000c6f4
movzx eax, bl
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret