Function at 0x140047120
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov rax, qword [0x14016efd0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004718c
xor edx, edx
lea rcx, [rsp + 0x64]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140047193
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400473b4
mov qword [rsp + 0x310], rsi
movabs rsi, 0x662b8f16b7decdf
mov qword [rsp + 0x318], rdi
xor edi, edi
mov qword [rsp + 0x320], r12
movabs r12, 0xc5994935e8dbfd99
mov qword [rsp + 0x2f0], r13
movabs r13, 0x6bacb8210a99ddb4
mov qword [rsp + 0x2e8], r14
movabs r14, 0xd5b80c5195941d09
mov qword [rsp + 0x2e0], r15
movabs r15, 0xe0aa1d6b20eae83
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x68], eax
je 0x14004735d
mov qword [rsp + 0x20], rsi
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
lea rcx, [rbp - 0x74]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0x348bdbf5bf4cd345
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0x605b8906b18ec93
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xd5d70c7195f11d7c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xe6fa19ab22eaee5
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xc5fd495be8befdfe
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x6bd4b8440ab7ddc7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x348bdbf5bf4cd320
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp + 0x1a0]
movdqa xmm1, xmmword [rsp + 0x40]
pxor xmm1, xmmword [rbp + 0x1b0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rbp + 0x1c8], rax
pxor xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm1
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140047375
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400471f7
jmp 0x140047379
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x2e0]
mov eax, edi
mov rdi, qword [rsp + 0x318]
mov r14, qword [rsp + 0x2e8]
mov r13, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x310]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400d0340
add rsp, 0x2f8
pop rbx
pop rbp
ret