Function at 0x140064fc0
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d8]
sub rsp, 0x2d8
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov eax, ecx
cmp ecx, 0xffffffff
jne 0x140064ff5
xor al, al
jmp 0x1400656e1
xor r13b, r13b
mov dword [rbp - 0x70], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x230], rax
cmp rax, 0xffffffffffffffff
je 0x1400656dd
xor r15d, r15d
mov r12d, r15d
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1400656d0
lea rax, [fcn.14015a988]
mov qword [rbp + 0x238], rax
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
cmp word [rbp - 0x44], 0
jne 0x140065070
mov r8, r15
jmp 0x14006508b
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140065080
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x40]
call fcn.14000b804
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140063bb0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1400650c7
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000c6f4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
lea r14, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 0x10
cmovae r14, r8
lea rax, [rsp + 0x20]
cmovae rax, r8
mov rcx, qword [rsp + 0x30]
add rax, rcx
lea rsi, [rsp + 0x20]
cmp r9, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r15
test rdi, rdi
je 0x140065149
mov rbx, r15
movsx ecx, byte [rbx + rsi]
call fcn.140155970
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jne 0x140065125
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
lea rbx, [rsp + 0x20]
cmp r9, 0x10
cmovae rbx, r8
add rbx, rcx
lea rdx, [rsp + 0x20]
cmp r9, 0x10
cmovae rdx, r8
add rdx, rcx
lea rcx, [rsp + 0x20]
cmp r9, 0x10
cmovae rcx, r8
lea r8, [rbp + 0x238]
call fcn.140037400
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
mov rdx, rax
sub rdx, rcx
sub rbx, rax
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c94c
mov edx, 0x10c
lea rcx, [rsp + 0x60]
call fcn.1400160a0
mov r14, rax
mov r15, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400651c9
mov r14, qword [rax]
test r15, r15
jne 0x1400651d6
mov rbx, r15
jmp 0x140065260
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x140065259
cmp r15, rdi
ja 0x140065259
sub rdi, r15
inc rdi
lea rsi, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rsi, qword [rsp + 0x20]
nop dword [rax]
test rdi, rdi
je 0x140065259
movsx edx, byte [r14]
mov r8, rdi
mov rcx, rsi
call fcn.14011daf8
mov rbx, rax
test rax, rax
je 0x140065259
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.14011db30
test eax, eax
je 0x14006523d
sub rsi, rbx
dec rsi
add rdi, rsi
lea rsi, [rbx + 1]
jmp 0x140065200
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rax, rcx
sub rbx, rax
xor r15d, r15d
jmp 0x140065265
or rbx, 0xffffffffffffffff
xor r15d, r15d
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x1400652ba
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x1400652b0
test cl, 0x1f
jne 0x140065357
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140065351
sub rcx, rax
cmp rcx, 8
jb 0x14006534b
cmp rcx, 0x27
ja 0x140065345
mov rcx, rax
call fcn.1400eb7f4
mov rcx, qword [rsp + 0x20]
cmp rbx, 0xffffffffffffffff
je 0x1400652ed
mov dword [rbp + 0x228], r15d
lea rdx, [rbp + 0x228]
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rbp + 0x220]
cmp dword [rbp + 0x228], eax
cmove r12d, dword [rbp - 0x68]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x140065328
inc rax
cmp rax, 0x1000
jb 0x140065323
test cl, 0x1f
jne 0x14006536f
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140065369
sub rcx, rax
cmp rcx, 8
jb 0x140065363
cmp rcx, 0x27
ja 0x14006535d
mov rcx, rax
call fcn.1400eb7f4
lea rdx, [rbp - 0x70]
mov rbx, qword [rbp + 0x230]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140065375
jmp 0x140065050
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
test r12d, r12d
je 0x1400656d0
lea rdx, [rbp - 0x70]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1400656d0
lea rax, [fcn.14015a988]
mov qword [rbp + 0x238], rax
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
cmp word [rbp - 0x44], 0
jne 0x1400653c1
mov r8, r15
jmp 0x1400653db
lea rax, [rbp - 0x44]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400653d0
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x40]
call fcn.14000b804
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140063bb0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x140065417
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14000c6f4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], r15
mov word [rsp + 0x40], r15w
lea r14, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 0x10
cmovae r14, r8
lea rax, [rsp + 0x20]
cmovae rax, r8
mov rcx, qword [rsp + 0x30]
add rax, rcx
lea rsi, [rsp + 0x20]
cmp r9, 0x10
cmovae rsi, r8
mov rdi, rax
sub rdi, rsi
cmp rsi, rax
cmova rdi, r15
test rdi, rdi
je 0x140065499
mov rbx, r15
movsx ecx, byte [rbx + rsi]
call fcn.140155970
mov byte [r14 + rbx], al
inc rbx
cmp rbx, rdi
jne 0x140065475
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x20]
lea rbx, [rsp + 0x20]
cmp r9, 0x10
cmovae rbx, r8
add rbx, rcx
lea rdx, [rsp + 0x20]
cmp r9, 0x10
cmovae rdx, r8
add rdx, rcx
lea rcx, [rsp + 0x20]
cmp r9, 0x10
cmovae rcx, r8
lea r8, [rbp + 0x238]
call fcn.140037400
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
mov rdx, rax
sub rdx, rcx
sub rbx, rax
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c94c
mov edx, 0x10a
lea rcx, [rsp + 0x60]
call fcn.1400160a0
mov r14, rax
mov r15, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140065519
mov r14, qword [rax]
test r15, r15
jne 0x140065526
mov rbx, r15
jmp 0x1400655b0
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400655a9
cmp r15, rdi
ja 0x1400655a9
sub rdi, r15
inc rdi
lea rsi, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rsi, qword [rsp + 0x20]
nop dword [rax]
test rdi, rdi
je 0x1400655a9
movsx edx, byte [r14]
mov r8, rdi
mov rcx, rsi
call fcn.14011daf8
mov rbx, rax
test rax, rax
je 0x1400655a9
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.14011db30
test eax, eax
je 0x14006558d
sub rsi, rbx
dec rsi
add rdi, rsi
lea rsi, [rbx + 1]
jmp 0x140065550
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rax, rcx
sub rbx, rax
xor r15d, r15d
jmp 0x1400655b5
or rbx, 0xffffffffffffffff
xor r15d, r15d
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x14006560a
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140065600
test cl, 0x1f
jne 0x1400656b2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400656ac
sub rcx, rax
cmp rcx, 8
jb 0x1400656a6
cmp rcx, 0x27
ja 0x1400656a0
mov rcx, rax
call fcn.1400eb7f4
mov rcx, qword [rsp + 0x20]
cmp rbx, 0xffffffffffffffff
je 0x14006564b
mov dword [rbp + 0x228], r15d
lea rdx, [rbp + 0x228]
mov ecx, dword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov eax, dword [rbp + 0x220]
mov rcx, qword [rsp + 0x20]
cmp dword [rbp + 0x228], eax
jne 0x14006564b
movzx r13d, r13b
cmp dword [rbp - 0x50], r12d
mov eax, 1
cmove r13d, eax
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x140065686
inc rax
cmp rax, 0x1000
jb 0x140065681
test cl, 0x1f
jne 0x1400656ca
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1400656c4
sub rcx, rax
cmp rcx, 8
jb 0x1400656be
cmp rcx, 0x27
ja 0x1400656b8
mov rcx, rax
call fcn.1400eb7f4
lea rdx, [rbp - 0x70]
mov rcx, qword [rbp + 0x230]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1400656d0
jmp 0x1400653a1
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
nop
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
mov rcx, qword [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r13b
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret