Function at 0x140004010
Capabilities:
Enumerate processes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov rcx, qword [0x140149d28]
lea rax, [r11 + 8]
mov dword [rsp + 0x48], 1
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [r11 + 8]
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x220d84
mov qword [rsp + 0x20], rax
mov byte [r11 + 8], 1
call fcn.1400899c0
movabs rax, 0xba41ae241b2f1e20
mov byte [0x140149d24], 0
mov qword [rsp + 0x90], rax
movabs rdi, 0x8eccfd752ec75367
movabs rax, 0x66f37fa772f6d580
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x98], rax
movabs rsi, 0xdf35c74a6f5d7166
movabs rax, 0x2c1882a97b0deeb1
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0xa0], rax
movabs r14, 0x31de0bc9179fb9c3
movabs rax, 0x28f420b42392386d
mov qword [rsp + 0x68], r14
mov qword [rsp + 0xa8], rax
movabs r15, 0x4570d1844f3b80d8
vmovups ymm0, ymmword [rsp + 0x90]
vmovups ymmword [rsp + 0xc0], ymm0
vpxor xmm0, xmm0, xmmword [rsp + 0x60]
vmovdqu xmm1, xmmword [rsp + 0xd0]
vmovdqu xmmword [rsp + 0xc0], xmm0
movabs rax, 0x19dc51366e491a2f
mov qword [rsp + 0x70], r15
movabs r12, 0x50910ed34dfb481d
mov qword [rsp + 0xb0], rax
vmovups xmm3, xmmword [rsp + 0xb0]
movabs r13, 0x19dc51366e491a4a
mov qword [rsp + 0x78], r12
vpxor xmm2, xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0x80], r13
xor edx, edx
mov qword [rsp + 0x88], rdi
mov ecx, 2
vpxor xmm0, xmm3, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0xe0], xmm0
vmovdqu xmmword [rsp + 0xd0], xmm2
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x110]
mov dword [rsp + 0x110], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140004203
nop dword [rax + rax]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x13c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14000441a
lea rdx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400041d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x140149d20]
mov dword [rsp + 0x50], eax
xor ecx, ecx
mov dword [rsp + 0x48], 0x10
lea rax, [rsp + 0x278]
mov qword [rsp + 0x58], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x278], rcx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0xf0]
mov dword [rsp + 0x54], ecx
mov rcx, qword [0x140149d28]
mov dword [rsp + 0x28], 0x2204d4
mov qword [rsp + 0x20], rax
call fcn.1400899c0
cmp byte [0x140149d68], 0
mov r9, qword [rsp + 0x278]
mov qword [0x140149d70], r9
je 0x14000439b
movabs rax, 0xb85aab670e2e1f3d
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x90], rax
lea rdx, str.inits::init_comm
movabs rax, 0x14852bf73abfe4b0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0xc0]
movabs rax, 0x7b5df1d92b1ebaab
mov qword [rsp + 0x70], r15
mov qword [rsp + 0xa0], rax
mov r8d, 0x1c
movabs rax, 0x34f02eb63e9a2a3d
mov qword [rsp + 0x78], r12
mov qword [rsp + 0xa8], rax
movabs rax, 0x29fc6b451d2c682e
vmovups ymm0, ymmword [rsp + 0x90]
vmovups ymmword [rsp + 0xc0], ymm0
vpxor xmm0, xmm0, xmmword [rsp + 0x60]
vmovdqu xmm1, xmmword [rsp + 0xd0]
vpxor xmm2, xmm1, xmmword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
movabs rax, 0x8eccf70d42ab761f
vmovdqu xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xb8], rax
vmovups xmm3, xmmword [rsp + 0xb0]
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], rdi
vpxor xmm0, xmm3, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0xe0], xmm0
vmovdqu xmmword [rsp + 0xd0], xmm2
vzeroupper
call fcn.140001790
mov eax, dword [0x140149d20]
xor r9d, r9d
mov rcx, qword [0x140149d28]
xor r8d, r8d
mov dword [rsp + 0x48], 4
xor edx, edx
mov dword [rsp + 0x270], eax
lea rax, [rsp + 0x270]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x270]
mov dword [rsp + 0x38], 4
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov dword [rsp + 0x28], 0x2204d8
mov qword [rsp + 0x20], rax
call fcn.1400899c0
lea r11, [rsp + 0x240]
mov al, 1
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x118]
mov dword [0x140149d20], eax
jmp 0x140004212