Function at 0x1400503b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbx, qword [0x1400884d8]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140050548
movdqa xmm0, xmmword [0x140079de0]
mov dword [rsp + 0x30], 0x45dad446
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x96c
mov eax, dword [rcx + rbx]
mov edi, 0x950
add rdi, rbx
test al, 1
jne 0x14005046b
or eax, 1
mov dword [rcx + rbx], eax
mov byte [rdi + 0x14], 1
lea rax, [rdi + 0x13]
lea rcx, [rsp + 0x33]
cmp rdi, rcx
ja 0x140050454
lea rcx, [rsp + 0x20]
cmp rax, rcx
jb 0x140050454
movups xmmword [rdi], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x10], eax
jmp 0x14005045e
movups xmmword [rdi], xmm0
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x10], eax
lea rcx, [0x14006f450]
call fcn.1400684c0
nop
cmp byte [rdi + 0x14], 0
je 0x1400504c4
xor byte [rdi], 0x35
xor byte [rdi + 1], 0xb1
xor byte [rdi + 2], 0xa9
xor byte [rdi + 3], 0x45
xor byte [rdi + 4], 0x39
xor byte [rdi + 5], 0x2b
xor byte [rdi + 6], 0xf5
xor byte [rdi + 7], 0x89
xor byte [rdi + 8], 0x35
xor byte [rdi + 9], 0xb1
xor byte [rdi + 0xa], 0xa9
xor byte [rdi + 0xb], 0x45
xor byte [rdi + 0xc], 0x39
xor byte [rdi + 0xd], 0x2b
xor byte [rdi + 0xe], 0xf5
xor byte [rdi + 0xf], 0x89
xor byte [rdi + 0x10], 0x35
xor byte [rdi + 0x11], 0xb1
xor byte [rdi + 0x12], 0xa9
xor byte [rdi + 0x13], 0x45
mov byte [rdi + 0x14], 0
mov ecx, 0x98c
mov eax, dword [rcx + rbx]
mov edx, 0x928
test al, 1
jne 0x140050504
or eax, 1
mov dword [rcx + rbx], eax
add rbx, rdx
mov word [rbx + 9], 0x1b1
mov dword [rbx], 0x29dcde76
mov dword [rbx + 4], 0xe69b0b5d
mov byte [rbx + 8], 0x41
lea rcx, [0x14006f470]
call fcn.1400684c0
nop
jmp 0x140050507
add rbx, rdx
cmp byte [rbx + 0xa], 0
je 0x140050538
xor byte [rbx], 0x35
xor byte [rbx + 1], 0xb1
xor byte [rbx + 2], 0xa9
xor byte [rbx + 3], 0x45
xor byte [rbx + 4], 0x39
xor byte [rbx + 5], 0x2b
xor byte [rbx + 6], 0xf5
xor byte [rbx + 7], 0x89
xor byte [rbx + 8], 0x35
xor byte [rbx + 9], 0xb1
mov byte [rbx + 0xa], 0
mov rdx, rdi
mov rcx, rbx
call fcn.140063900
jmp 0x14005077f
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400505c1
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400506e8
mov rdx, rdi
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140050562
mov r8d, dword [rsp + 0x48]
mov dword [rbx + 4], r8d
test r8d, r8d
je 0x140050562
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbx + 8], rax
test rax, rax
je 0x140050562
mov byte [rbx], 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140050781
movdqa xmm0, xmmword [0x140079bd0]
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov ecx, 0x94c
mov eax, dword [rcx + rbx]
mov edi, 0x938
add rdi, rbx
test al, 1
jne 0x140050620
or eax, 1
mov dword [rcx + rbx], eax
mov byte [rdi + 0x10], 1
lea rax, [rdi + 0xf]
lea rcx, [rsp + 0x2f]
cmp rdi, rcx
ja 0x140050610
lea rcx, [rsp + 0x20]
cmp rax, rcx
jb 0x140050610
movups xmmword [rdi], xmm0
jmp 0x140050613
movups xmmword [rdi], xmm0
lea rcx, [0x14006f400]
call fcn.1400684c0
nop
cmp byte [rdi + 0x10], 0
je 0x140050669
xor byte [rdi], 0xcd
xor byte [rdi + 1], 0x59
xor byte [rdi + 2], 0x43
xor byte [rdi + 3], 0x8f
xor byte [rdi + 4], 0x61
xor byte [rdi + 5], 0x79
xor byte [rdi + 6], 9
xor byte [rdi + 7], 0x81
xor byte [rdi + 8], 0xcd
xor byte [rdi + 9], 0x59
xor byte [rdi + 0xa], 0x43
xor byte [rdi + 0xb], 0x8f
xor byte [rdi + 0xc], 0x61
xor byte [rdi + 0xd], 0x79
xor byte [rdi + 0xe], 9
xor byte [rdi + 0xf], 0x81
mov byte [rdi + 0x10], 0
mov ecx, 0x968
mov eax, dword [rcx + rbx]
mov edx, 0x970
test al, 1
jne 0x1400506a9
or eax, 1
mov dword [rcx + rbx], eax
add rbx, rdx
mov word [rbx + 9], 0x159
mov dword [rbx], 0xe336368e
mov dword [rbx + 4], 0xee675905
mov byte [rbx + 8], 0xb9
lea rcx, [0x14006f430]
call fcn.1400684c0
nop
jmp 0x1400506ac
add rbx, rdx
cmp byte [rbx + 0xa], 0
je 0x1400506dd
xor byte [rbx], 0xcd
xor byte [rbx + 1], 0x59
xor byte [rbx + 2], 0x43
xor byte [rbx + 3], 0x8f
xor byte [rbx + 4], 0x61
xor byte [rbx + 5], 0x79
xor byte [rbx + 6], 9
xor byte [rbx + 7], 0x81
xor byte [rbx + 8], 0xcd
xor byte [rbx + 9], 0x59
mov byte [rbx + 0xa], 0
mov rdx, rdi
mov rcx, rbx
call fcn.140063900
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov eax, 0x97c
mov ecx, dword [rax + rdx]
mov ebx, 0x980
add rbx, rdx
test cl, 1
jne 0x14005073b
or ecx, 1
mov dword [rax + rdx], ecx
mov word [rbx + 9], 0x135
mov dword [rbx], 0x2b0d671e
mov dword [rbx + 4], 0x521952fb
mov byte [rbx + 8], 0x51
lea rcx, [0x14006f3e0]
call fcn.1400684c0
nop
cmp byte [rbx + 0xa], 0
je 0x14005076c
xor byte [rbx], 0x5b
xor byte [rbx + 1], 0x35
xor byte [rbx + 2], 0x5f
xor byte [rbx + 3], 0x11
xor byte [rbx + 4], 0xdb
xor byte [rbx + 5], 0x77
xor byte [rbx + 6], 0x75
xor byte [rbx + 7], 0x3b
xor byte [rbx + 8], 0x5b
xor byte [rbx + 9], 0x35
mov byte [rbx + 0xa], 0
mov edx, edi
mov rcx, rbx
call fcn.14000c330
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140068380
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret