Function at 0x1401b9990
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4f8
mov qword [rsp + 0x458], 0xfffffffffffffffe
mov rax, qword [0x14027f4c8]
xor rax, rsp
mov qword [rsp + 0x4e8], rax
mov dword [rsp + 0x30], 0
lea rdx, [0x140235e1e]
lea rcx, [rsp + 0x3d0]
call fcn.140002d90
nop
lea rax, [fcn.140002650]
mov qword [rsp + 0x20], rax
lea r9, [fcn.140002820]
mov r8d, 7
mov edx, 8
lea rcx, [rsp + 0x3d8]
call fcn.140156328
nop
mov qword [rsp + 0x290], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x2a0], 0x130
mov dword [rsp + 0x50], 0x238
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x290], rax
lea rdx, [rsp + 0x2a0]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_Process32First]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1401b9e7e
cmp dword [rsp + 0x2a8], 4
ja 0x1401b9bef
lea rdx, [rsp + 0x2cc]
lea rcx, [rsp + 0x3d8]
call fcn.140002d60
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x2a8]
lea rcx, [rsp + 0x418]
call fcn.1401beec0
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0x468], rax
lea rax, [rsp + 0x3e0]
mov rdx, qword [rsp + 0x468]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x418]
call fcn.140002650
mov r9b, 1
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x420]
call fcn.1401beec0
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x470]
mov qword [rsp + 0x478], rax
lea rax, [rsp + 0x3e8]
mov rdx, qword [rsp + 0x478]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x420]
call fcn.140002650
mov r9b, 1
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x428]
call fcn.1401beec0
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x488], rax
lea rax, [rsp + 0x3f0]
mov rdx, qword [rsp + 0x488]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x428]
call fcn.140002650
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x430]
call fcn.1401beec0
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x498], rax
lea rax, [rsp + 0x3f8]
mov rdx, qword [rsp + 0x498]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x430]
call fcn.140002650
jmp 0x1401b9da4
mov edx, dword [rsp + 0x2a8]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_Module32First]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x3d8]
call fcn.140002d60
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x2a8]
lea rcx, [rsp + 0x438]
call fcn.1401beec0
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4a8], rax
lea rax, [rsp + 0x3e0]
mov rdx, qword [rsp + 0x4a8]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x438]
call fcn.140002650
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x68]
lea rcx, [rsp + 0x440]
call fcn.1401beec0
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x4b8], rax
lea rax, [rsp + 0x3e8]
mov rdx, qword [rsp + 0x4b8]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x440]
call fcn.140002650
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x70]
lea rcx, [rsp + 0x448]
call fcn.1401beec0
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x4c0]
mov qword [rsp + 0x4c8], rax
lea rax, [rsp + 0x3f0]
mov rdx, qword [rsp + 0x4c8]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x448]
call fcn.140002650
mov r9b, 1
mov r8d, 8
mov edx, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x450]
call fcn.1401beec0
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x4d0]
mov qword [rsp + 0x4d8], rax
lea rax, [rsp + 0x3f8]
mov rdx, qword [rsp + 0x4d8]
mov rcx, rax
call fcn.140002000
nop
lea rcx, [rsp + 0x450]
call fcn.140002650
mov rax, qword [rsp + 0x500]
add rax, 0x1f0
mov rcx, rax
call fcn.140002ee0
mov rcx, qword [rsp + 0x500]
add rcx, 0x1f0
lea r8, [0x140235e1f]
mov edx, eax
call fcn.140002f10
mov dword [rsp + 0x410], 0
jmp 0x1401b9df4
mov eax, dword [rsp + 0x410]
inc eax
mov dword [rsp + 0x410], eax
cmp dword [rsp + 0x410], 5
jge 0x1401b9e5f
movsxd rax, dword [rsp + 0x410]
lea rax, [rsp + rax*8 + 0x3d8]
mov rcx, rax
call fcn.140001dd0
mov qword [rsp + 0x4e0], rax
mov rcx, qword [rsp + 0x500]
add rcx, 0x1f0
call fcn.140002ee0
dec eax
mov rcx, qword [rsp + 0x500]
add rcx, 0x1f0
mov rdx, qword [rsp + 0x4e0]
mov r9, rdx
mov r8d, dword [rsp + 0x410]
mov edx, eax
call fcn.14000612c
jmp 0x1401b9de4
lea rdx, [rsp + 0x2a0]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_Process32Next]
mov dword [rsp + 0x30], eax
jmp 0x1401b9a5a
mov rax, qword [rsp + 0x500]
add rax, 0x1f0
mov rcx, rax
call fcn.140002ee0
mov r8d, eax
lea rdx, [0x140235f1c]
lea rcx, [rsp + 0x3d0]
call fcn.140002540
lea rcx, [rsp + 0x3d0]
call fcn.140001dd0
mov rcx, qword [rsp + 0x500]
add rcx, 0x118
xor r9d, r9d
mov r8d, 2
mov rdx, rax
call fcn.140002590
nop
lea r9, [fcn.140002650]
mov r8d, 7
mov edx, 8
lea rcx, [rsp + 0x3d8]
call fcn.1401563d8
nop
lea rcx, [rsp + 0x3d0]
call fcn.140002650
mov rcx, qword [rsp + 0x4e8]
xor rcx, rsp
call fcn.140154c30
add rsp, 0x4f8
ret