Function at 0x140009b30
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x140036138]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140009bb5
mov rsi, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140009bd9
lea rbx, [rsp + 0x54]
lea r14, [rsp + 0x28]
nop dword [rax]
mov rcx, rdi
mov rdx, rbx
call fcn.140012740
test eax, eax
je 0x140009be3
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140009b90
mov edi, 0x490
jmp 0x140009be5
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000ac40
nop
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140009be5
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000ac40
mov eax, edi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
invalid
stc
wait
stosb byte [rdi], al
int1
stc
stc
invalid
test r12, r13
cmovnp edi, dword [rdi]
invalid
mov r9, qword [rbx]
adc qword [r14 + r8], rdx
out dx, al
lodsb al, byte [rsi]
out 0xf8, al
stc
pop qword [rbx - 0x6060e5a]
lea rbx, [rbx - 0x6060e5a]
cmpsb byte [rsi], byte [rdi]
int1
stc
stc
cmpsb byte [rsi], byte [rdi]
int1
stc
stc
mov rdx, qword [rbx]
xchg edx, eax
sahf
invalid
invalid
invalid
pop qword [rbx - 0x6060e66]
wait
invalid
fisttp qword [rbx - 0x71]
in al, dx
invalid
sbb esi, dword [rax - 0x64]
invalid
fist dword [rax]
adc al, 6
out dx, al
out 0xf8, al
stc
pop qword [rbx - 0x6060e6a]
lea rbx, [rbx - 0x6060e6a]
mov rdx, qword [rbx]
jge 0x1400669b3
invalid
invalid
mov dh, cl
stc
stc
invalid
lea edx, [rdi + rcx*2]
test esp, ebp
add cl, byte [rbx + 0x3f]
invalid
or ebp, dword [rdi + 0x10]
adc al, 6
out dx, al
fcompp
clc
stc
pop qword [rbx - 0x6060e7a]
add dword [rsi + 0x4af9f9f1], 0xffffff8d
wait
xchg cl, dh
stc
stc
add dword [rsi + 0x4af9f9f1], 0xffffff8d
wait
xchg cl, dh
stc
stc
mov rdx, qword [rbx]
invalid
pushfq
invalid
invalid
test esp, ebp
cmovnp esp, dword [rbp - 0x23]
invalid
call 0x14b91b8e5
call 0x12e0c7eef
invalid
stc
lea rbx, [rbx - 0x6060e8a]
rol rsi, 0
invalid
int1
cld
pop r14
invalid
push 0xfffffffffffffff1
stc
stc
wait
push 0xfffffffffffffff1
stc
stc
invalid
in al, 0x4f
test esp, ebp
add eax, 0x4bdd654b
invalid
invalid
pop qword [rbx - 0x6060e4a]
lea rbx, [rbx - 0x6060e4a]
mov rdx, qword [rbx]
jbe 0x140066af2
invalid
invalid
invalid
clc
stc
pop qword [rbx - 0x6060e56]
wait
stosb byte [rdi], al
int1
stc
stc
invalid
sahf
invalid
invalid
outsd dx, dword [rsi]
mov r9, qword [rbx]
call qword [rdx]
adc al, 6
out dx, al
sbb eax, 0x8f4ef9f8
and dword [rsi + 0x4af9f9f1], 0xffffff8d
wait
cmpsb byte [rsi], byte [rdi]
int1
stc
stc
mov rdx, qword [rbx]
ja 0x140066b6e
invalid
add rax, 0x6060b12
invalid
invalid
invalid
fisttp qword gs:[rax - 0x75]
xchg edx, eax
and eax, esi
mov r9, qword [rbx]
invalid
pop qword [rbx - 0x6060e76]
wait
mov dh, cl
stc
stc
invalid
mov rdx, qword [rbx]
jl case.0x140009bd2.36
invalid
rol rsi, 0
invalid
mov ecx, dword [rbx]
or dl, byte [rdx]
adc al, 6
out dx, al
mov ch, 0xdb
clc
stc
pop qword [rbx - 0x6060e7a]
lea rbx, [rbx - 0x6060e7a]
mov rdx, qword [rbx]
mov edx, dword [rbx]
mov edx, dword [rbx]
or ebx, dword [rsi - 0x72b4f9e9]
adc al, 0x4b
invalid
test r14, r13
add cl, byte [rdx - 0x71]
fmul qword [rdi - 0x75]
or esi, ebp
loope 0x140066cb2
stc
pop qword [rbx - 0x6060e86]
stc
stc
wait
jp 0x140066cb7
stc
stc
invalid
adc ecx, eax
xchg ecx, eax
invalid
lea ecx, [rdx]
or eax, dword [rsi]
invalid
mov rdx, qword [rbx]
mov eax, 0x4b061792
add eax, 0xd88f4a1c
test rax, r13
cmovle ecx, dword [rbx + 0x1415730b]
invalid
stc
pop qword [rbx - 0x6060e6a]
lea rbx, [rbx - 0x6060e6a]
int1
stc
stc
int1
stc
stc
mov rdx, qword [rbx]
sahf
invalid
lea rdx, [r10 + r9*2]
mov ecx, dword [rbx]
sahf
invalid
invalid
mov r9, qword [r9]
out dx, al
test eax, 0x8ff9f8e0
or dword [rdx + 0x4af9f9f1], 0x65
wait
mov dh, cl
stc
stc
invalid
xchg ecx, eax
invalid
test esp, ebp
or ecx, dword [rbx + 0x65]
fisttp qword [rbx + 0x3f]
fmul qword [rcx]
or edx, 6
invalid
invalid
invalid
mov r9, qword [r9]
pop rsp
out dx, al
or dword [rsi + rbp*8 + 0x46], ebx
loopne 0x140066dba
loopne 0x140066dba
stc
pop qword [rbx - 0x6060e86]
stc
stc
wait
jp 0x140066dbf
stc
stc
invalid