Function at 0x1400617af
Capabilities:
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0xc50109d4
pushf
not eax
add eax, 0xf34040e1
xor eax, 0xd61262ea
rol eax, 0x46
popf
pushf
not eax
add eax, 0xedc441c4
xor eax, 0xaf6351d7
rol eax, 0x20
popf
pushf
not eax
add eax, 0xe9361321
xor eax, 0x9c28794e
rol eax, 2
popf
cmp eax, 4
jne 0x1400617ff
popf
pop rax
jmp 0x140061a89
cmp eax, 0
jne 0x14006180e
popf
pop rax
jmp 0x140061868
cmp eax, 3
jne 0x14006181d
popf
pop rax
jmp 0x1400619ea
cmp eax, 1
jne 0x14006182c
popf
pop rax
jmp 0x140061911
cmp eax, 5
jne 0x14006183b
popf
pop rax
jmp 0x140061ac6
cmp eax, 7
jne 0x14006184a
popf
pop rax
jmp 0x140061b80
cmp eax, 6
jne 0x140061859
popf
pop rax
jmp 0x140061b0e
cmp eax, 2
jne 0x140061868
popf
pop rax
jmp 0x1400619cb
push rbx
sub rsp, 0x190
mov rax, qword [0x140008230]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor edx, edx
lea ecx, [rdx + 2]
jmp 0x140061889
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400618cb
push rax
pushf
mov eax, 0x5ceb31b8
pushf
not eax
add eax, 0x9f15d3df
xor eax, 0xb25215f5
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xa3e87cfa
xor eax, 0xbbf0409e
rol eax, 0x27
popf
jmp 0x1400617f0
push rax
pushf
mov eax, 0x28f001c8
pushf
not eax
add eax, 0x86dc67e1
xor eax, 0xdeaeb9e5
rol eax, 7
popf
pushf
not eax
add eax, 0xe4720cd5
xor eax, 0x9c2f5f69
rol eax, 3
popf
pushf
not eax
add eax, 0xd66e6b77
xor eax, 0xdc43dfa0
rol eax, 0xea
popf
jmp 0x1400617f0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rax
jmp 0x140061922
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140061985
push rax
pushf
mov eax, 0xa90af6dd
pushf
not eax
add eax, 0xc1717758
xor eax, 0xb4b93bdc
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xdde8aa08
xor eax, 0xc4fb791c
rol eax, 0x64
popf
pushf
not eax
add eax, 0xf6ab2a60
xor eax, 0xc437efe4
rol eax, 0xa9
popf
pushf
not eax
add eax, 0xca59f0c5
xor eax, 0xcb7e11fd
rol eax, 0xd5
popf
jmp 0x1400617f0
push rax
pushf
mov eax, 0x2d5e795a
pushf
not eax
add eax, 0xdb7a85bd
xor eax, 0xecb1c2b3
rol eax, 0x35
popf
pushf
not eax
add eax, 0xcf665521
xor eax, 0xf95ecab6
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xedbbe63a
xor eax, 0x870bc4ad
rol eax, 0x2f
popf
jmp 0x1400617f0
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.140059a56
mov rcx, rax
call fcn.14005a9ee
test al, al
jne 0x140061b80
lea rdx, [rsp + 0x50]
mov rcx, rbx
jmp 0x1400619f3
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140061a56
push rax
pushf
mov eax, 0xbdfa21d2
pushf
not eax
add eax, 0xc7ca7126
xor eax, 0x95017f5a
rol eax, 0x86
popf
pushf
not eax
add eax, 0x82d9d376
xor eax, 0xe7ff214a
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xc9dbca61
xor eax, 0x9a3c2d7b
rol eax, 0x69
popf
pushf
not eax
add eax, 0x891af2a7
xor eax, 0xac6671c0
rol eax, 0xb3
popf
jmp 0x1400617f0
push rax
pushf
mov eax, 0x120d960e
pushf
not eax
add eax, 0xf4cea936
xor eax, 0xdb38439b
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x8fdc20ff
xor eax, 0x814dcccf
rol eax, 0xed
popf
jmp 0x1400617f0
mov rcx, rbx
jmp 0x140061a8d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x8d97e742
pushf
not eax
add eax, 0xdc31930d
xor eax, 0xb6d438c5
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x9bf8967b
xor eax, 0x89e531b7
rol eax, 0xe6
popf
jmp 0x1400617f0
xor al, al
push rax
pushf
mov eax, 0x4819a15d
pushf
not eax
add eax, 0xfd335181
xor eax, 0xd501ff5f
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xce3685cc
xor eax, 0xcc1d841a
rol eax, 0x49
popf
pushf
not eax
add eax, 0x8b1e8f54
xor eax, 0xd422eb45
rol eax, 0x20
popf
jmp 0x1400617f0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005bd41
add rsp, 0x190
pop rbx
ret
lea rcx, [rsp + 0x20]
call fcn.1400624c3
mov rcx, rax
call fcn.140064fce
mov rdx, rax
call fcn.1400639ed
mov al, 0xe3
pushf
not al
add al, 0x68
xor al, 3
rol al, 0x22
popf
pushf
not al
add al, 0xbf
xor al, 0x87
rol al, 0xbb
popf
pushf
not al
add al, 0x34
xor al, 0x94
rol al, 0x6d
popf
pushf
not al
add al, 0x63
xor al, 0x97
rol al, 0x4f
popf
mov byte [0x140008940], 1
jmp 0x140061b0e