Function at 0x1400cc7d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x310
mov rax, qword [0x1401ed028]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x40], 0xffffffffffffffff
movss xmm2, dword [0x1401d7f9c]
movss xmm1, dword [0x1401d7f94]
lea rcx, [rsp + 0xf0]
call fcn.14002fdd0
mov qword [rsp + 0x90], rax
mov eax, dword [0x140211fa4]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x32]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x32]
call fcn.1400ccd20
mov rcx, rax
call fcn.1400896e0
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1400259b0
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x88]
call fcn.140027020
mov qword [rsp + 0x98], rax
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov r9, qword [rsp + 0x90]
mov r8d, dword [rsp + 0x60]
mov edx, 2
mov rcx, qword [rsp + 0x98]
call fcn.140165930
mov byte [rsp + 0x33], al
lea rcx, [rsp + 0x130]
call fcn.140025900
movzx eax, byte [rsp + 0x33]
test eax, eax
je 0x1400ccd01
lea rax, [rsp + 0x34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x34]
call fcn.1400ccd50
mov rcx, rax
call fcn.140089740
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400259b0
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa8]
call fcn.140027020
xor r9d, r9d
xorps xmm2, xmm2
xor edx, edx
mov rcx, rax
call fcn.14016fdf0
nop
lea rcx, [rsp + 0x150]
call fcn.140025900
lea rax, [rsp + 0x35]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x35]
call fcn.1400ccd70
mov rcx, rax
call fcn.1400896e0
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.1400259b0
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.140027020
xor r9d, r9d
xorps xmm2, xmm2
xor edx, edx
mov rcx, rax
call fcn.14016fdf0
nop
lea rcx, [rsp + 0x170]
call fcn.140025900
mov edx, 1
xor ecx, ecx
call fcn.1401707e0
call fcn.14016d040
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0xffffffffffffffff
je 0x1400cccfc
mov dword [rsp + 0x1b0], 0x130
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400cccf1
lea rdx, [rsp + 0x1dc]
lea rcx, [rsp + 0x2e0]
call fcn.1400259b0
nop
mov rax, qword [rsp + 0x320]
add rax, 8
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.1400cd410
cmp rax, 0xffffffffffffffff
jne 0x1400ccaa1
mov rax, qword [rsp + 0x320]
add rax, 8
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x48]
cmp byte [rax + rcx], 0
jne 0x1400cca7b
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x1400cccc9
mov rax, qword [rsp + 0x320]
mov ecx, dword [rsp + 0x1b8]
cmp dword [rax + 0x558], ecx
jne 0x1400ccac2
mov dword [rsp + 0x38], 1
jmp 0x1400ccaca
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x36], al
xorps xmm1, xmm1
xor ecx, ecx
call fcn.14016e190
call fcn.14016e0d0
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0xf8]
call fcn.14002fdd0
mov qword [rsp + 0xd8], rax
mov edx, dword [rsp + 0x1b8]
lea rcx, [rsp + 0x190]
call fcn.1400cc6f0
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call fcn.140027020
mov qword [rsp + 0xe0], rax
mov r9, qword [rsp + 0xd8]
mov r8d, 2
movzx edx, byte [rsp + 0x36]
mov rcx, qword [rsp + 0xe0]
call fcn.140159170
mov byte [rsp + 0x37], al
lea rcx, [rsp + 0x190]
call fcn.140025900
movzx eax, byte [rsp + 0x37]
test eax, eax
je 0x1400ccbf3
mov rax, qword [rsp + 0x320]
mov ecx, dword [rsp + 0x1b8]
mov dword [rax + 0x558], ecx
lea rax, [rsp + 0x1dc]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x320]
add rax, 0x10d
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x70]
inc rax
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x30], 0
jne 0x1400ccbba
xor ecx, ecx
call fcn.14011a370
movzx eax, al
test eax, eax
je 0x1400cccb6
xor ecx, ecx
call fcn.14011aab0
movzx eax, al
test eax, eax
je 0x1400cccb6
mov rax, qword [rsp + 0x320]
mov rax, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x320]
mov edx, dword [rax + 0x558]
mov rcx, qword [rsp + 0x320]
call qword [rsp + 0xe8]
lea rax, [rsp + 0x1dc]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x320]
add rax, 0x10d
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rsp + 0x31]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
cmp byte [rsp + 0x31], 0
jne 0x1400ccc78
call fcn.140103140
call fcn.14016e0d0
lea rcx, [rsp + 0x1dc]
call fcn.1401602c0
nop
lea rcx, [rsp + 0x2e0]
call fcn.140025900
lea rdx, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400cca23
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140167350
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1400d63a0
add rsp, 0x310
pop rdi
ret