Function at 0x140009b00
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x140033138]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140009b85
mov rsi, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140009ba9
lea rbx, [rsp + 0x54]
lea r14, [rsp + 0x28]
nop dword [rax]
mov rcx, rdi
mov rdx, rbx
call fcn.1400125e4
test eax, eax
je 0x140009bb3
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140009b60
mov edi, 0x490
jmp 0x140009bb5
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000acd0
nop
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x140009bb5
xor edi, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000acd0
mov eax, edi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
retf
xchg ebp, eax
push rsp
int3
xor ecx, edx
xchg ebp, eax
push rax
add edx, dword [rax + 0xf31d654]
xor byte [rdi], ah
push rax
pop rsp
push rbp
xchg ebp, eax
mov edx, 0x262e5544
push rbp
pushfq
push rbp
pushfq
push rax
add dl, byte [rdx + rdi*4 - 0x33ab6afe]
jne 0x140061a85
enter 0xffffffffffff94d9, 0x52
retf
xor ebx, ebp
xchg esp, eax
loopne 0x140061a5b
lodsb al, byte [rsi]
invalid
invalid
xchg ecx, eax
push rsp
invalid
xchg ecx, eax
push rax
pop rsp
pop rcx
xchg ebp, eax
push rdx
pop rcx
xchg ebp, eax
push rsp
int3
enter 0xffffffffffff94d9, 0x52
retf
push rsp
invalid
fstpnce st(1), st(0)
fst dword [rax + rdx*2 + 0x315a9009]
rcl byte [rbp + 0x54900350]
invalid
xor byte [rdi], ah
push rax
pop rsp
movsd dword [rdi], dword [rsi]
xchg ebp, eax
mov edx, 0x262ea544
pushfq
pushfq
pushfq
push rax
add dl, byte [rax - 0x276bdcb0]
cmp edx, dword [rax - 0x6b2fcca6]
mov edx, 0x3e09402
invalid
lodsb al, byte [rsi]
invalid
add ebp, dword [rsp + rdx*8 - 0x6bddaf70]
fdivr dword [rdx]
xchg ebp, eax
push rax
invalid
invalid
test eax, 0x9126262e
invalid
push rsp
int3
nop
push rax
sbb dword [rbp + 0x54900350], edx
invalid
invalid
xchg esp, eax
push rdx
ret 0x5095
xchg ecx, eax
push rax
pop rsp
imul ebp, dword [rsi], 0x52952626
imul r13d, dword [rsi], 0x54952626
int3
fst dword [rdx + rdx*2 + 0x95094cb]
nop
pop rdx
xor ebx, ebx
xchg ebp, eax
push rax
add edx, dword [rax + 0x5231d654]
xor dword [rdi], esp
push rax
pop rsp
jne 0x140061baa
xchg ebp, eax
xchg ebp, eax
mov edx, 0x262e7544
pushfq
push rax
add dl, byte [rbp + 0x41ddcc54]
enter 0xffffffffffff94d9, 0x52
push rdx
push rdx
retf
fst dword [rsi + 0x28d34d54]
fstpnce st(1), st(0)
xchg esp, eax
mov edx, 0x3e09402
lodsb al, byte [rsi]
mov al, 0x91
push rsp
invalid
xor dword [rsi + 7], ebx
invalid
xchg ebp, eax
push rsp
int3
jle 0x140061c1b
enter 0xffffffffffff97d9, 0xffffffffffffffda
int 0xd4
fstpnce st(1), st(0)
fstpnce st(1), st(0)
xchg esp, eax
push rax
or dword [rax - 0x6a21cea6], edx
push rax
add edx, dword [rax - 0x2bce29ac]
invalid
xor dword [rdi], esp
push rax
pop rsp
xchg ebp, eax
mov edx, 0x262e4544
pushfq
push rax
add dl, byte [rdx + rdi*4 + 0x4d549702]
invalid
xchg edi, eax
push rsp
invalid
invalid
invalid
add dl, byte [rdi + 0x2ffe4d54]
fstpnce st(1), st(0)
xchg esp, eax
loopne 0x140061c1e
invalid
xchg ecx, eax
push rsp
invalid
int 0xcb
fnstenv [rcx]
mov dword [rdi], 0x50912627
pop rsp
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
push rdx
nop
push rax
and dword [rax - 0x6a23cea6], edx
push rax
add ecx, dword [rbx - 0x7c29ab70]
xor dword [rdx + 0x3e], esp
invalid
xchg esp, eax
mov edx, 0x191e9102
lodsd eax, dword [rsi]
invalid
xchg ebp, eax
xchg ebp, eax
push rax
add edx, dword [rax - 0x6ece29ac]
invalid
movsd dword [rdi], dword [rsi]
pushfq
push rax
add dl, byte [rdx + rdi*4 - 0x33ab6afe]
int3
invalid
int3
fst dword [rdi - 0x262b2aae]
fstpnce st(1), st(0)
fst dword [rsi + 0x36d34d54]
fstpnce st(1), st(0)
xchg esp, eax
loopne 0x140061cfc
lodsd eax, dword [rsi]
ret 0x5495
push rdx
ret 0x5495
enter 0xffffffffffff94d9, 0xffffffffffffffda
ret
push rax
pop rsp
xchg ebp, eax
push rdx
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
push rsp
int3
int 0xd4
fstpnce st(1), st(0)
fstpnce st(1), st(0)
xchg esp, eax
push rax
or dword [rax - 0x6a36cea6], edx
push rax
add edx, dword [rax + 0x7631d654]
nop
push rsp
invalid
xor dword [rsi + 0x3f], esi
nop
push rsp
invalid
push rbp
pushfq
push rax
add dl, byte [rbp + 0x4eb1cc54]
enter 0xffffffffffff94d9, 0x52
retf
fstpnce st(1), st(0)
fst dword [rax - 0x6b2bcca6]
mov edx, 0x3e09402
invalid
add eax, 0x50912627
pop rsp
pop rcx
xchg ebp, eax
push rdx
pop rcx
xchg ecx, eax
invalid
fstpnce st(1), st(0)
xchg ecx, eax
nop
and al, 0x90
push rax
sbb dword [rbp - 0x6f74fcb0], edx
nop
nop
push rsp
invalid
xchg ebp, eax
mov edx, 0x262ea544
pushfq
push rax
add dl, byte [rcx + 0x2621191e]
fcompp
xchg ecx, eax
nop
and al, 0x94
mov edx, 0x1e09502
add dword [rbp + 0x3f5095de], ebp
xchg ecx, eax
pop rdx
add dword [rbp + 0x3f5095de], ebp
xchg ecx, eax
pop rdx
invalid
xchg ecx, eax
push rax
pop rsp
test eax, 0x9526262e
push rdx
test eax, 0x9026262e
push rax
and dword [rax - 0x6a23cea6], edx
push rax
add ecx, dword [rbx - 0x7c29ab70]
mov edx, dword [rax + 0x3183d654]
cmp al, 0x27
mov edx, dword [rax + 0x3183d654]
cmp al, 0x27
push rax
pop rsp
mov ch, 0x2e
xchg ebp, eax
mov edx, 0x262eb544
pushfq
push rax
add dl, byte [rdx + rdi*4 + 0x191e9102]
fstpnce st(1), st(0)
xchg ebp, eax
push rsp
int3
and edx, dword [rax - 0x2952e520]
xchg ecx, eax
invalid