Function at 0x140002c50
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
lea rdi, [rsi + rbx]
lea rax, [rsp + 0x40]
lea r13, [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x80], rbx
cmp rbx, 7
ja 0x140002cd0
mov r8, rbx
mov rdx, r13
cmp rsi, rdi
je 0x140002ff4
xor eax, eax
nop word [rax + rax]
movsx cx, byte [rsi + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbx, rax
jne 0x140002cb0
jmp 0x140002e41
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.1400402b0
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rdx, rax
mov qword [rsp + 0x50], r8
cmp rsi, rdi
je 0x140002e41
lea rax, [rax + rbx*2]
lea rcx, [rbx - 1]
cmp rsi, rax
jae 0x140002d13
cmp rdx, rdi
jb 0x140002ca8
cmp rcx, 0xe
jbe 0x140002ffc
mov r9, rbx
mov rcx, rbx
pxor xmm3, xmm3
xor eax, eax
shr r9, 4
and rcx, 0xfffffffffffffff0
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x140002d38
mov rax, r9
lea r9, [rsi + rcx]
shl rax, 5
add rax, rdx
cmp rbx, rcx
je 0x140002e41
sub rbx, rcx
lea r10, [rbx - 1]
cmp r10, 6
jbe 0x140002dc7
movq xmm0, qword [rsi + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbx
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r9, rcx
and ebx, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x140002e41
movsx cx, byte [r9]
mov word [rax], cx
lea rcx, [r9 + 1]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 1]
mov word [rax + 2], cx
lea rcx, [r9 + 2]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 2]
mov word [rax + 4], cx
lea rcx, [r9 + 3]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 3]
mov word [rax + 6], cx
lea rcx, [r9 + 4]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 4]
mov word [rax + 8], cx
lea rcx, [r9 + 5]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 5]
mov word [rax + 0xa], cx
lea rcx, [r9 + 6]
cmp rdi, rcx
je 0x140002e41
movsx cx, byte [r9 + 6]
mov word [rax + 0xc], cx
xor eax, eax
mov qword [rsp + 0x48], r8
mov ecx, 2
mov word [rdx + r8*2], ax
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002ff0
lea r12, [rsp + 0x80]
mov rcx, rax
mov dword [rsp + 0x80], 0x130
mov rdx, r12
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140002fe8
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x70]
lea rsi, [rsp + 0xac]
jmp 0x140002ed7
cmp rcx, rbp
je 0x140002ec4
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.140043fa0
mov rdx, r12
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140002fe8
mov dword [rsp + 0x28], 0
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
call rdi
movsxd rdx, eax
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x60], rbp
mov r14, rdx
call fcn.14003b440
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r14d
mov r8, rsi
xor edx, edx
mov r9d, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rdi
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
cmp rdx, qword [rsp + 0x68]
jne 0x140002eb0
mov r8, qword [rsp + 0x40]
test rdx, rdx
je 0x140002f90
cmp r8, rcx
je 0x140002f90
test r8, r8
setne r9b
test rcx, rcx
setne al
cmp r9b, al
jne 0x140002eb0
xor eax, eax
nop word [rax + rax]
movzx r11d, word [rcx + rax*2]
cmp word [r8 + rax*2], r11w
jne 0x140002eb0
add rax, 1
cmp rdx, rax
jne 0x140002f70
nop dword [rax]
mov rcx, rbx
call fcn.140001e00
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x140002fb1
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.140043fa0
mov ebx, 1
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x140002fcf
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call fcn.140043fa0
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.140001e00
xor ebx, ebx
jmp 0x140002fb6
xor r8d, r8d
jmp 0x140002e41
mov rax, rdx
mov r9, rsi
xor ecx, ecx
jmp 0x140002d87