Function at 0x14001eff0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400bf300]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r13, rcx
xor r12d, r12d
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x74]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14001f321
movabs r15, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001f0a0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140001400
nop
lea rcx, [rsp + 0x48]
mov rbx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x60]
cmp r14, 7
cmova rcx, rbx
mov rax, qword [rsp + 0x58]
lea rsi, [rcx + rax*2]
lea rdi, [rsp + 0x48]
cmova rdi, rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
cmp rdi, rsi
jne 0x14001f10c
mov r8, r12
mov qword [rsp + 0x38], r12
mov edi, 0xf
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x28], r8b
jmp 0x14001f213
sub rsi, rdi
sar rsi, 1
mov ebx, 0xf
mov qword [rsp + 0x40], rbx
cmp rsi, r15
ja 0x14001f365
cmp rsi, rbx
jbe 0x14001f1c5
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x14001f14d
mov rbx, r15
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14001f188
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001f172
mov rax, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
jmp 0x14001f1ca
cmp rcx, 0x1000
jb 0x14001f1b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001f35f
mov rcx, rax
call fcn.14002e6f8
mov rcx, rax
test rax, rax
je 0x14001f2d7
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
jmp 0x14001f1ca
call fcn.14002e6f8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
jmp 0x14001f1ca
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x28]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x14001f1f5
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x14001f1e2
mov qword [rsp + 0x38], rsi
mov byte [r8 + rsi], 0
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rdx, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14001f221
mov rdx, qword [r13]
lea rcx, [rsp + 0x28]
mov rsi, qword [rsp + 0x28]
cmp rdi, 0xf
cmova rcx, rsi
cmp r8, qword [r13 + 0x10]
jne 0x14001f247
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14001f247
mov r15b, 1
jmp 0x14001f24a
xor r15b, r15b
cmp rdi, 0xf
jbe 0x14001f287
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001f275
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f2d7
mov rcx, rsi
call fcn.14002e734
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x48]
test r15b, r15b
jne 0x14001f2de
cmp r14, 7
jbe 0x14001f2c3
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001f2bb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f312
mov rcx, rbx
call fcn.14002e734
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
jmp 0x14001f068
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r12d, dword [rsp + 0x78]
cmp r14, 7
jbe 0x14001f321
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14001f319
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001f319
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14002e734
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14002eaf0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140013ab0
nop
call fcn.140013ca0
int3