Function at 0x1400069c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
sub rsp, 0x498
mov rax, qword [0x14004c018]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor edx, edx
mov dword [rsp + 0x260], 0x104
mov r14, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140006a12
lea rcx, str.____Could_not_get_a_snapshot_of_the_systems_processes__CreateToolhelp32Snapshot_
call fcn.140013f14
mov eax, ebp
jmp 0x140006c8c
mov qword [rsp + 0x4b8], rbx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x4c0], rsi
mov rcx, rbp
mov qword [rsp + 0x4c8], rdi
mov qword [rsp + 0x490], r15
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140006a6b
lea rcx, str.____Could_not_retrieve_information_about_the_first_process__Process32First_
call fcn.140013f14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x140006c6c
lea r15, str.HealthService.exe
mov r8d, dword [rsp + 0x28]
test r8d, r8d
je 0x140006c4b
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006c3b
lea r9, [rsp + 0x260]
mov dword [rsp + 0x260], 0x104
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x140006aef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x28]
lea rcx, str.___Couldnt_query_image_information_of_process_with_PID__ld__QueryFullProcessImageName_failed_with_0x_x__n
mov r8d, eax
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006c4b
lea rcx, [rsp + 0x270]
call fcn.14000ba60
test eax, eax
jne 0x140006b3e
xor ebx, ebx
mov rdi, r15
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x270]
call fcn.14000d710
test rax, rax
jne 0x140006b3e
inc ebx
add rdi, 8
cmp ebx, 0x15
jb 0x140006b10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006c4b
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call fcn.14000ef50
mov rbx, rax
test rax, rax
je 0x140006cb0
lea rcx, [rsp + 0x270]
call fcn.14000f390
mov qword [rbx], rax
mov r10, rax
test rax, rax
je 0x140006ca7
mov r11, qword [r14]
test r11, r11
je 0x140006c16
mov r8, qword [r11]
mov rcx, rax
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140006ba4
add rcx, 2
test eax, eax
jne 0x140006b90
test edx, edx
js 0x140006c16
mov r9, qword [r11 + 0x18]
test r9, r9
je 0x140006be4
mov rax, qword [r9]
mov r8, r10
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140006bd4
add rax, 2
test ecx, ecx
jne 0x140006bc0
test edx, edx
jns 0x140006be4
mov r11, r9
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x140006bb1
mov r8, qword [r11 + 0x18]
test r8, r8
je 0x140006c0c
mov rdx, qword [r8]
sub rdx, r10
movzx ecx, word [r10]
movzx eax, word [r10 + rdx]
sub ecx, eax
jne 0x140006c08
add r10, 2
test eax, eax
jne 0x140006bf3
test ecx, ecx
jns 0x140006c1d
mov qword [rbx + 0x18], r8
mov qword [r11 + 0x18], rbx
jmp 0x140006c1d
mov qword [rbx + 0x18], r11
mov qword [r14], rbx
mov r8, qword [rbx]
lea rcx, str.___Found_EDR_binary_in_execution__process_with_PID__i_:___s__n
mov edx, dword [rsp + 0x28]
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006c4b
mov edx, dword [rsp + 0x28]
lea rcx, str.___Couldnt_open_handle_on_process__OpenProcess_with_PROCESS_QUERY_LIMITED_INFORMATION___ld_n
call fcn.140001010
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006a72
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x4b8]
mov r15, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000cb50
add rsp, 0x498
pop r14
pop rbp
ret
lea rcx, str.____Couldnt_alloc_memory_for_binary_path_for_process_with_PID__ld__slistNewEntry__binaryPath__n
jmp 0x140006cb7
lea rcx, str.____Couldnt_alloc_memory_for_binary_path_for_process_with_PID__ld__slistNewEntry__n
mov edx, dword [rsp + 0x28]
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x140006c6c