Function at 0x140067c50
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x2e0], rbx
xor r13b, r13b
mov dword [rsp + 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140067f2d
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140067f24
mov edx, 0xa8
lea rcx, [rsp + 0x20]
call fcn.140016310
nop
cmp qword [rax + 0x18], 8
jb 0x140067cce
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x1d8]
call fcn.140006214
nop
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x140067cfb
inc r8
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.14000c6f4
mov qword [rsp + 0x38], 7
xor esi, esi
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
or r15, 0xffffffffffffffff
lea r14d, [rsi + 1]
call fcn.14000b6b4
test rax, rax
je 0x140067f19
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x1d0], rbx
lea rcx, [rsp + 0x7c]
lea rax, [rsp + 0x7c]
test rax, 0xffffffffffff0000
jne 0x140067d7f
movzx edi, cx
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140067e7c
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140008224
mov rbx, qword [rbp + 0x1d0]
jmp 0x140067e7c
lea rax, [rsp + 0x7c]
mov rdi, r15
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140067d90
test edi, edi
jne 0x140067df9
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140067e7c
cmp dword [rdx + 0x10], 0
jge 0x140067dca
cmp dword [rbx - 0xc], 0
jl 0x140067ecb
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x140067e7c
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140067de0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x1d0], rbx
jmp 0x140067e7c
mov r14d, dword [rbx - 0x10]
lea rsi, [rsp + 0x7c]
sub rsi, rbx
sar rsi, 1
test edi, edi
js 0x140067f0e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140067e36
mov edx, edi
lea rcx, [rbp + 0x1d0]
call fcn.140007cb8
mov rbx, qword [rbp + 0x1d0]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
cmp rsi, r14
ja 0x140067e50
lea r8, [rbx + rsi*2]
mov r9d, edi
call fcn.1400084a0
jmp 0x140067e63
movsxd r9, edi
add r9, r9
add rdx, rdx
lea r8, [rsp + 0x7c]
call fcn.1400683a0
cmp edi, dword [rbx - 0xc]
jg 0x140067f03
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
lea r14d, [rsi + 1]
mov rdx, qword [rbp + 0x1d8]
test rdx, rdx
je 0x140067ef8
mov rcx, rbx
call fcn.140159ed0
movzx r13d, r13b
test eax, eax
cmove r13d, r14d
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140067eb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140067ed6
jmp 0x140067d18
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov rdx, qword [rbp + 0x1d8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140067f24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140067f24
mov ecx, 0x80004005
call fcn.14000b9ec
nop
mov ecx, 0x80070057
call fcn.14000b9ec
int3
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov ecx, 0x80004005
call fcn.14000b9ec
nop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret