Function at 0x1400038d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rbp, rcx
lea rdx, str.Anti_analysis
lea rcx, [0x140048790]
call fcn.1400015a0
mov rdi, rax
mov rdx, qword [rax]
movsxd r8, dword [rdx + 4]
mov rdx, qword [r8 + rax + 0x40]
mov rbx, qword [rdx + 8]
mov rcx, rbx
mov qword [rsp + 0x28], rbx
mov rdx, qword [rbx]
call qword [rdx + 8]
lea rcx, [rsp + 0x20]
call fcn.1400022b0
mov dl, 0xa
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x60]
movzx esi, ax
test rbx, rbx
je 0x140003958
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
test rax, rax
je 0x140003958
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, si
mov rcx, rdi
call fcn.140006660
mov rcx, rdi
call fcn.1400062b0
lea rcx, str.ntdll.dll
mov qword [rsp + 0x288], 0xfffffffffc6c7900
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtDelayExecution
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400039a5
lea rdx, [rsp + 0x288]
xor ecx, ecx
call rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, 0x3ca
mov rcx, rbp
mov rdi, rax
call fcn.140003540
test eax, eax
je 0x140003b4b
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rbx, rax
lea rdx, str.__i___ApiHammering_Delayed_Execution_For_:
lea rcx, [0x140048660]
sub ebx, edi
call fcn.1400012f0
mov rcx, rax
mov edx, ebx
call fcn.140002eb0
mov rcx, rax
call fcn.140001f10
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.140012a30
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140003a3b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____CreateToolhelp32Snapshot_Failed_With_Error_:__d__n
call fcn.140006830
jmp 0x140003ae8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140003a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____Process32FirstW_Failed_With_Error_:__d__n
call fcn.140006830
jmp 0x140003ae3
xor r10d, r10d
mov r9, rbp
cmp qword [r9 + 0x18], 8
mov r8, r9
jb 0x140003a83
mov r8, qword [r9]
lea rax, [rsp + 0x5c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140003aa4
add rax, 2
test ecx, ecx
jne 0x140003a90
test edx, edx
je 0x140003ab7
inc r10
add r9, 0x20
cmp r10, 0x1b
jl 0x140003a76
jmp 0x140003ad2
mov r8d, dword [rsp + 0x38]
lea rdx, [rsp + 0x5c]
lea rcx, str._t_i__Found___s__Of_Pid_:__d__n
call fcn.1400068f0
mov edi, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140003a70
test rbx, rbx
je 0x140003af1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x140048660]
test edi, edi
jne 0x140003b28
lea rdx, str.No_blacklisted_process_detected.
call fcn.1400012f0
mov rcx, rax
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
jmp fcn.140001f10
lea rdx, str.Blacklisted_process_detected.
call fcn.1400012f0
mov rcx, rax
lea rdx, [fcn.140001f10]
call fcn.1400030c0
xor ecx, ecx
call fcn.1400176b4
int3
xor ecx, ecx
call fcn.1400176b4
int3