Function at 0x14000e550
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x770
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140022040]
xor rax, rsp
mov qword [rbp + 0x720], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e7a4
movabs rdx, 0x35fe0982163248fe
movabs rax, 0xd9526af5b884375
mov qword [rbp], rax
movabs rcx, 0xd9526af5bca431d
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp], rdx
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0x2a8], rax
movabs rax, 0xdfa26dd5bb84358
xorps xmm0, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x358c09c11612488c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x617dab51d8a9c8aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x3beb1730b614a846
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xf0294c20f6b22133
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xc4e8beb66693fc81
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xca75b4e9e6df705d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xdb6b85d0f11ffb84
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs rax, 0x6114ab25d8c8c8cf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rax, 0x3bbb1710b673a828
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0xf04c4c43f6dd2141
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
movabs rax, 0xc4bbbe9666e0fcf2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movabs rax, 0xca06b499e6be7033
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0xdb6b85a4f170fbec
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x2c0]
mov qword [rbp + 0x2f8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqu ymm0, ymmword [rbp + 0x40]
vmovdqa ymmword [rbp + 0x20], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x2e0]
vmovdqa ymmword [rbp + 0x40], ymm1
mov r9d, 0x10
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000e845
lea rdx, [rbp + 0x60]
mov dword [rbp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000e83c
lea r8, [rbp + 0x8c]
mov edx, 0x104
lea rcx, [rbp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x104
lea rcx, [rbp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
mov r8, rdi
lea rcx, [rbp + 0x300]
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, 0x104
lea rcx, [rbp + 0x300]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x510]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rcx, rbx
test rax, rax
jne 0x14000e86b
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000e7c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x720]
xor rcx, rsp
call fcn.140019e40
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x68]
jmp 0x14000e847