Function at 0x14001afe0
Capabilities:
Enumerate processes

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x300
mov qword [rsp + 0x2e8], 0xfffffffffffffffe
mov rax, qword [0x140022260]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov qword [rsp + 0x2b0], 0
lea rcx, [rsp + 0x28]
call fcn.14000d5a0
nop
mov dword [rsp + 0x20], 0xffffffff
mov rcx, qword [rsp + 0x318]
call fcn.14000d770
xor edx, edx
mov ecx, 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x14001b25d
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x2b0]
call sub.KERNEL32.dll_Process32FirstW
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x14001b23e
lea rcx, [rsp + 0x28]
call fcn.14000d770
lea rdx, [rsp + 0x28]
mov ecx, dword [rsp + 0x78]
call fcn.14001adc0
test eax, eax
jbe 0x14001b223
lea rcx, [rsp + 0x28]
call fcn.14000d620
test rax, rax
jbe 0x14001b223
mov dword [rsp + 0x2b8], 0
jmp 0x14001b0de
mov eax, dword [rsp + 0x2b8]
add eax, 1
mov dword [rsp + 0x2b8], eax
mov ebx, dword [rsp + 0x2b8]
lea rcx, [rsp + 0x28]
call fcn.14000d620
cmp rbx, rax
jae 0x14001b223
mov edx, dword [rsp + 0x2b8]
lea rcx, [rsp + 0x28]
call fcn.14000d640
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x310]
call fcn.1400107ec
test eax, eax
jne 0x14001b21e
mov dword [rsp + 0x2c8], 0
movzx eax, byte [rsp + 0x320]
test eax, eax
je 0x14001b143
mov dword [rsp + 0x2c8], 9
mov eax, dword [rsp + 0x2c8]
add eax, 0x104
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.14000fcb0
mov qword [rsp + 0x2d0], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x2c0], rax
mov eax, dword [rsp + 0x2c8]
add eax, 0x104
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x2c0]
call fcn.1400103b0
movzx eax, byte [rsp + 0x320]
test eax, eax
je 0x14001b1ed
mov eax, dword [rsp + 0x2c8]
add eax, 0x104
mov r8d, eax
mov r9d, 0xa
mov rdx, qword [rsp + 0x2c0]
mov ecx, dword [rsp + 0x78]
call fcn.14001099c
lea r8, str._r_n_r_n
mov edx, 0x104
mov rcx, qword [rsp + 0x2c0]
call fcn.1400109c4
lea r8, [rsp + 0x9c]
mov edx, 0x104
mov rcx, qword [rsp + 0x2c0]
call fcn.1400109c4
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x318]
call fcn.14000d690
jmp 0x14001b223
jmp 0x14001b0cd
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x2b0]
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x58], eax
jmp 0x14001b082
mov rcx, qword [rsp + 0x318]
call fcn.14000d620
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x2cc], 0
jmp 0x14001b27b
mov eax, dword [rsp + 0x2cc]
add eax, 1
mov dword [rsp + 0x2cc], eax
mov ebx, dword [rsp + 0x2cc]
lea rcx, [rsp + 0x28]
call fcn.14000d620
cmp rbx, rax
jae 0x14001b2d4
mov edx, dword [rsp + 0x2cc]
lea rcx, [rsp + 0x28]
call fcn.14000d640
mov rax, qword [rax]
mov qword [rsp + 0x2d8], rax
mov rcx, qword [rsp + 0x2d8]
call fcn.1400100e0
mov edx, dword [rsp + 0x2cc]
lea rcx, [rsp + 0x28]
call fcn.14000d640
mov qword [rax], 0
jmp 0x14001b26a
lea rcx, [rsp + 0x28]
call fcn.14000d770
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2e0], eax
lea rcx, [rsp + 0x28]
call fcn.14000d5f0
mov eax, dword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1400100c0
add rsp, 0x300
pop rbx
ret