Function at 0x140036bf0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2bc0]
mov eax, 0x2cc0
call fcn.140134690
sub rsp, rax
mov r13, r8
mov rbx, rdx
mov r12, rcx
mov dword [r9], 0
mov dword [rsp + 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140036f75
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140036f6c
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140036f6c
nop
mov rdi, qword [rbx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140036f4e
nop
lea rdx, [rbx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140036c9e
mov rdx, qword [rdx]
lea rcx, [rbp - 0x64]
call fcn.1401776c4
test eax, eax
je 0x140036cb8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140036c90
jmp 0x140036f4e
mov r8d, dword [rsp + 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140036f4e
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x20]
lea r8, [rbp + 0x3c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
je 0x140036f45
lea r9, [rsp + 0x24]
mov r8d, 0x2000
lea rdx, [rbp + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x140036f45
xor r14b, r14b
xor edi, edi
mov esi, dword [rsp + 0x24]
shr rsi, 3
test rsi, rsi
je 0x140036e40
nop word [rax + rax]
mov r9d, 0x104
lea r8, [rbp + 0x1b0]
mov rdx, qword [rbp + rdi*8 + 0xbc0]
mov rcx, r15
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x140036e0b
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
call fcn.14000bfcc
test rax, rax
je 0x140036fa3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140007020
test al, al
jne 0x140036dd1
test rbx, rbx
jne 0x140036daf
xor eax, eax
jmp 0x140036dc0
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140036db6
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140008250
nop
mov rdx, qword [r12]
test rdx, rdx
je 0x140036f98
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.1401776c4
test eax, eax
je 0x140036e18
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036e0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
inc rdi
cmp rdi, rsi
jge 0x140036e40
jmp 0x140036d40
mov rax, qword [rbp + 0x2c18]
inc dword [rax]
mov r14b, 1
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036e40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r14b, r14b
jne 0x140036f40
mov rbx, qword [r13]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov rcx, rbx
mov edx, dword [rsp + 0x78]
cmp byte [rax + 0x19], r14b
jne 0x140036e99
nop dword [rax + rax]
mov qword [rsp + 0x38], rax
cmp dword [rax + 0x20], edx
jae 0x140036e85
mov dword [rsp + 0x40], r14d
mov rax, qword [rax + 0x10]
jmp 0x140036e93
mov dword [rsp + 0x40], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r14b
je 0x140036e70
cmp byte [rcx + 0x19], r14b
jne 0x140036ea4
cmp edx, dword [rcx + 0x20]
jae 0x140036f17
movabs rax, 0x38e38e38e38e38e
cmp qword [r13 + 8], rax
je 0x140036f92
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov ecx, 0x48
call fcn.140133e2c
nop
mov ecx, dword [rsp + 0x78]
mov dword [rax + 0x20], ecx
mov qword [rax + 0x28], r14
mov qword [rax + 0x38], r14
mov qword [rax + 0x40], 7
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov word [rax + 0x18], 0
mov qword [rsp + 0x58], r14
movups xmm0, xmmword [rsp + 0x38]
movaps xmmword [rsp + 0x60], xmm0
mov r8, rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.14003a360
mov rcx, rax
lea rax, [rbp + 0x3c0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140036f25
add rcx, 0x28
lea rdx, [rbp + 0x3c0]
call fcn.14003a5e0
mov rsi, qword [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140036f6c
mov rbx, qword [rbp + 0x2c08]
jmp 0x140036c80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x2d00]
add rsp, 0x2cc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002c130
nop
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80004005
call fcn.14000c3ac
int3