Function at 0x1400011c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor esi, esi
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140001ed0
nop
lea rcx, [rsp + 0x48]
mov r14, qword [rsp + 0x60]
cmp r14, 8
setae dl
mov rbx, qword [rsp + 0x48]
cmovae rcx, rbx
mov rax, qword [rsp + 0x58]
lea r12, [rcx + rax*2]
lea rdi, [rsp + 0x48]
test dl, dl
cmovne rdi, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
cmp rdi, r12
jne 0x14000128c
mov r8d, esi
mov esi, 0xf
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x28], r8b
jmp 0x14000139b
mov rax, r12
sub rax, rdi
sar rax, 1
mov ebx, 0xf
mov qword [rsp + 0x40], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400015ee
cmp rax, 0x10
jb 0x140001340
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400012cd
mov rbx, rcx
jmp 0x1400012da
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140001324
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400015e8
mov rcx, rax
call fcn.140002330
mov rcx, rax
test rax, rax
je 0x1400015d3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001332
test rcx, rcx
je 0x140001330
call fcn.140002330
jmp 0x140001332
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
nop dword [rax]
lea rcx, [rsp + 0x28]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x28]
movzx eax, byte [rdi]
mov byte [rsi + rcx], al
mov rsi, qword [rsp + 0x38]
inc rsi
mov qword [rsp + 0x38], rsi
add rdi, 2
cmp rdi, r12
je 0x140001372
mov rbx, qword [rsp + 0x40]
jmp 0x140001340
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rax, qword [rsp + 0x28]
mov byte [rsi + rax], 0
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400013a8
mov rdx, qword [r15]
lea rcx, [rsp + 0x28]
cmp rsi, 0x10
setae r12b
mov rdi, qword [rsp + 0x28]
cmovae rcx, rdi
cmp r8, qword [r15 + 0x10]
jne 0x1400013d1
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400014e7
test r12b, r12b
je 0x140001411
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400013ff
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015d3
mov rcx, rdi
call fcn.14000236c
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
cmp r14, 8
jb 0x14000144c
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001444
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015da
mov rcx, rbx
call fcn.14000236c
lea rdx, [rsp + 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001224
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1400014a6
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1400014a1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400015e1
mov rcx, r8
call fcn.14000236c
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], al
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140002310
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x78]
cmp rsi, 0x10
jb 0x14000152c
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001523
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015d3
mov rcx, rdi
call fcn.14000236c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000156a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001565
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015da
call fcn.14000236c
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1400015b5
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1400015b0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400015cc
mov rcx, r8
call fcn.14000236c
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov eax, ebx
jmp 0x1400014b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001100
int3
call fcn.1400011a0
int3