Function at 0x1400015c0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14002d080]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400025c0
nop
lea r14, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r14, r8
lea rcx, [rsp + 0x50]
cmovae rcx, r8
mov rax, qword [rsp + 0x60]
add rax, rcx
lea rsi, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
xor r13d, r13d
cmp rsi, rax
cmova rdi, r13
test rdi, rdi
je 0x140001677
mov ebx, r13d
movsx ecx, byte [rbx + rsi]
call fcn.140007358
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140001662
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14000171e
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400016cc
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a8a
call fcn.140003094
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140001a36
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001a31
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a7e
jmp 0x140001a2e
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400019a6
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, 0xffffffff
lea r8, [rbp - 0x44]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
mov ecx, eax
call fcn.14000338c
mov rdi, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rbp - 0x44]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x1400017b0
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140002690
mov rcx, rdi
call fcn.140003094
lea r14, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x78]
cmp r8, 0x10
cmovae r14, rcx
lea rax, [rsp + 0x70]
cmovae rax, rcx
mov r9, qword [rbp - 0x80]
add rax, r9
lea rsi, [rsp + 0x70]
cmp r8, 0x10
cmovae rsi, rcx
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r13
test rdi, rdi
je 0x140001839
mov rbx, r13
movsx ecx, byte [rbx + rsi]
call fcn.140007358
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140001817
mov r8, qword [rbp - 0x78]
mov r9, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmp r8, 0x10
cmovae rdx, rcx
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
cmp r8, r9
jne 0x14000186a
call fcn.140004f20
test eax, eax
je 0x1400018bc
lea rdx, [rbp - 0x70]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov ebx, eax
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400018b5
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001aa2
call fcn.140003094
test ebx, ebx
jmp 0x140001734
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x68]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140001904
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a90
call fcn.140003094
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140001952
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000194d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a96
call fcn.140003094
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14000199f
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14000199a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a9c
mov rcx, r8
call fcn.140003094
mov eax, ebx
jmp 0x140001a38
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1400019ed
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a78
call fcn.140003094
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140001a36
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140001a31
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a84
mov rcx, r8
call fcn.140003094
xor eax, eax
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140003070
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009768
nop
call fcn.140009768
int3
call fcn.140009768
nop
call fcn.140009768
nop
call fcn.140009768
nop
call fcn.140009768
nop
call fcn.140009768
nop
call fcn.140009768
int3