Function at 0x140003660
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140103040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r13, rdx
xor r12d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
je 0x1400038e9
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400038e0
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r13 + r8*2], 0
jne 0x140003700
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1400236c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003740
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.1400236c0
mov r10, qword [rsp + 0x30]
mov r9, qword [rsp + 0x50]
cmp r10, r9
je 0x140003774
xor bl, bl
mov r9, qword [rsp + 0x38]
jmp 0x14000381a
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
seta dl
cmova rcx, qword [rsp + 0x40]
lea r8, [rcx + r9*2]
lea r14, [rsp + 0x40]
test dl, dl
cmovne r14, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, qword [rsp + 0x38]
cmp r9, 7
seta dl
cmova rcx, qword [rsp + 0x20]
lea r15, [rcx + r10*2]
lea rbx, [rsp + 0x20]
test dl, dl
cmovne rbx, qword [rsp + 0x20]
sub r8, r14
mov rax, r15
sub rax, rbx
xor r8, rax
test r8, 0xfffffffffffffffe
je 0x1400037da
xor bl, bl
jmp 0x14000381a
cmp rbx, r15
je 0x140003813
sub r14, rbx
movzx esi, word [r14 + rbx]
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
movzx edi, ax
movzx ecx, si
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp di, ax
jne 0x1400038c1
add rbx, 2
cmp rbx, r15
jne 0x1400037e2
mov r9, qword [rsp + 0x38]
mov bl, 1
mov rdi, qword [rsp + 0x60]
cmp r9, 7
jbe 0x140003853
lea rdx, [r9*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000384e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038cd
call fcn.14008b044
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
mov r8, qword [rsp + 0x58]
cmp r8, 7
jbe 0x1400038a5
lea rdx, [r8*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d4
call fcn.14008b044
test bl, bl
jne 0x1400038db
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400036e0
jmp 0x1400038e0
xor bl, bl
mov r9, qword [rsp + 0x38]
jmp 0x140003815
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r12d, dword [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r12d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14008acd0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret