Function at 0x140010600
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x1400c9040]
xor rax, rsp
mov qword [rbp + 0x490], rax
movzx ebx, dl
mov r14, rcx
mov dword [rbp + 0x1f0], 0xc740c765
mov dword [rbp + 0x1f4], 0x6959753d
mov dword [rbp + 0x1f8], 0x1ec4ff7
mov dword [rbp + 0x1fc], 0x9d5b989a
mov dword [rbp + 0x200], 0xc82912aa
mov dword [rbp + 0x204], 0xb2f5783c
mov dword [rbp + 0x208], 0x46510fc4
mov dword [rbp + 0x20c], 0x373af679
mov dword [rbp + 0x210], 0xb5700d6d
mov dword [rbp + 0x214], 0xb6a63b2b
mov dword [rbp + 0x218], 0x28232dd2
mov dword [rbp + 0x21c], 0x427e0819
mov dword [rbp + 0x220], 0x252160ef
mov dword [rbp + 0x224], 0x3ccfef4f
mov dword [rbp + 0x228], 0xf4c33e17
mov dword [rbp + 0x22c], 0x4a028a35
mov dword [rbp + 0x250], 0x22143ed2
mov dword [rbp + 0x254], 0xb57f6e94
mov dword [rbp + 0x258], 0xeef075fa
mov dword [rbp + 0x25c], 0xe8db03aa
mov dword [rbp + 0x260], 0x7921e123
mov dword [rbp + 0x264], 0x3235e365
mov dword [rbp + 0x268], 0x7160aa72
mov dword [rbp + 0x26c], 0x149e04fd
mov dword [rbp + 0x230], 0x21d9511d
mov dword [rbp + 0x234], 0xe1cbdaa9
mov dword [rbp + 0x238], 0xa011cfa5
mov dword [rbp + 0x23c], 0x52cd1457
mov dword [rbp + 0x240], 0x4d60ca61
mov dword [rbp + 0x244], 0x1788dbd8
mov dword [rbp + 0x248], 0xa61ae472
mov dword [rbp + 0x24c], 0x70ec34ef
mov dword [rbp + 0x270], 0xaa3a6c73
mov dword [rbp + 0x274], 0x49cae029
mov dword [rbp + 0x278], 0xcbed3e6c
mov dword [rbp + 0x27c], 0x804e292d
lea rcx, [rsp + 0x58]
call fcn.14003c2a0
nop
movabs r12, 0x1000000000000000
movabs r13, 0x4000000000000000
xor r15d, r15d
test bl, bl
je 0x1400108e9
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400123b0
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003cc80
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x14001086c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010867
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e5e
call fcn.14004dce0
movdqa xmm0, xmmword [0x1400b4010]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400108d4
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400108c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e64
call fcn.14004dce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x1400108e9
call fcn.14002d160
mov rax, qword [r14]
or qword [rax], r12
mov rax, qword [r14]
or qword [rax], r13
lea rax, [rbp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400123b0
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003cc80
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140010985
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010980
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e6a
call fcn.14004dce0
movdqa xmm0, xmmword [0x1400b4010]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400109ed
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400109da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e70
call fcn.14004dce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140010ad3
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x280]
call fcn.140078480
lea rcx, [rbp + 0x280]
call fcn.14003ad80
mov esi, r15d
nop dword [rax + rax]
mov rbx, r15
mov qword [rbp - 0x50], 0x238
mov dword [rbp - 0x48], r15d
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r15
mov dword [rbp - 0x28], r15d
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x24]
call fcn.140078480
xor eax, eax
mov dword [rbp + 0x1e4], eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140010aae
nop dword [rax]
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x24]
call fcn.140061368
lea rcx, [rbx + 1]
test eax, eax
cmovne rcx, rbx
mov rbx, rcx
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140010a80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp rbx, 1
jbe 0x140010ad3
mov ecx, Ordinal_101
call qword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0x50
jb 0x140010a20
lea rax, [rbp + 0x230]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400123b0
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003cc80
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140010b6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e76
call fcn.14004dce0
movdqa xmm0, xmmword [0x1400b4010]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140010bd7
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e7c
call fcn.14004dce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140010be7
mov rax, qword [r14]
or qword [rax], r12
mov rax, qword [r14]
or qword [rax], r13
lea rax, [rbp + 0x250]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400123b0
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003cc80
nop
movzx ebx, byte [rax]
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140010c83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010c7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e82
call fcn.14004dce0
movdqa xmm0, xmmword [0x1400b4010]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140010ceb
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010cd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e88
call fcn.14004dce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
test bl, bl
je 0x140010cf6
mov byte [0x1400d3f00], 1
lea rax, [rbp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400123b0
nop
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14003cc80
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140010d83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e8e
call fcn.14004dce0
movdqa xmm0, xmmword [0x1400b4010]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140010deb
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010dd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e58
call fcn.14004dce0
mov qword [rsp + 0x40], r15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x70]
mov r8, qword [r8 + 8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
call fcn.14003d340
mov edx, 0x50
mov rcx, qword [rsp + 0x70]
call fcn.14004dce0
nop
lea rcx, [rsp + 0x58]
call fcn.140038db0
nop
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.14004dcc0
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
nop
call fcn.1400599e0
int3