Function at 0x180027520
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov qword [rsp + 0x48], rdx
mov rbx, rcx
mov qword [rsp + 0x40], rcx
mov dword [rbp - 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x180027b52
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180027b49
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
lea rax, [rbp - 4]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800275c0
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x70]
call fcn.180006110
nop
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x180027600
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.180006110
nop
lea rbx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
setae byte [rsp + 0x22]
mov r13, qword [rbp - 0x70]
mov qword [rsp + 0x28], r13
cmovae rbx, r13
lea rsi, [rsp + 0x70]
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r12, qword [rbp - 0x78]
cmp r12, 8
cmovae rsi, r15
mov rdi, qword [rbp - 0x60]
mov rax, qword [rbp - 0x80]
cmp rdi, rax
ja 0x180027703
test rdi, rdi
jne 0x18002766c
mov rax, r14
jmp 0x18002770a
sub rax, rdi
inc rax
lea r14, [rsi + rax*2]
mov rax, rsi
movzx r11d, word [rbx]
nop dword [rax]
mov rcx, r14
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x1800276ac
cmp word [rax], r11w
je 0x1800276a9
cmp rcx, 1
je 0x1800276ac
dec rcx
add rax, 2
cmp word [rax], r11w
jne 0x180027696
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x180027700
mov r9, rdi
mov rcx, rbx
movzx edx, word [rdx]
movzx r8d, r11w
cmp dx, r11w
jb 0x1800276ef
mov r10, rax
sub r10, rbx
cmp dx, r11w
ja 0x1800276ef
cmp r9, 1
je 0x1800276f5
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x1800276d1
add rax, 2
jmp 0x180027680
sub rax, rsi
sar rax, 1
xor r14d, r14d
jmp 0x18002770a
xor r14d, r14d
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x180027905
mov ecx, 0x238
call fcn.180029c40
mov rbx, rax
mov rdx, rax
mov ecx, dword [rbp - 0x10]
call fcn.1800273e0
lea rdx, [rbx + 0x2c]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x180027750
lea rcx, [rsp + 0x50]
call fcn.180006110
nop
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, [0x18002e870]
lea rcx, [rbp - 0x50]
call fcn.180006110
lea rbx, [rbp - 0x50]
mov r13, qword [rbp - 0x38]
cmp r13, 8
setae byte [rsp + 0x20]
mov rsi, qword [rbp - 0x50]
cmovae rbx, rsi
lea r12, [rsp + 0x50]
mov r15, qword [rsp + 0x68]
cmp r15, 8
setae byte [rsp + 0x21]
mov rdi, qword [rsp + 0x50]
cmovae r12, rdi
mov r14, qword [rbp - 0x40]
mov rax, qword [rsp + 0x60]
cmp r14, rax
ja 0x1800279aa
test r14, r14
je 0x18002787e
sub rax, r14
inc rax
lea r15, [r12 + rax*2]
mov rax, r12
movzx r11d, word [rbx]
nop dword [rax]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x18002781c
cmp word [rax], r11w
je 0x180027819
cmp rcx, 1
je 0x18002781c
dec rcx
add rax, 2
cmp word [rax], r11w
jne 0x180027806
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x1800279a5
mov r9, r14
mov rcx, rbx
movzx edx, word [rdx]
movzx r8d, r11w
cmp dx, r11w
jb 0x180027863
mov r10, rax
sub r10, rbx
cmp dx, r11w
ja 0x180027863
cmp r9, 1
je 0x180027869
dec r9
add rcx, 2
movzx edx, word [r10 + rcx]
movzx r8d, word [rcx]
cmp dx, r8w
jae 0x180027845
add rax, 2
jmp 0x1800277f0
sub rax, r12
sar rax, 1
mov r15, qword [rsp + 0x68]
cmp rax, 0xffffffffffffffff
je 0x1800279aa
cmp byte [rsp + 0x20], 0
je 0x1800278bb
lea rdx, [r13*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800278b2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027a6d
mov rcx, rsi
call fcn.180029c7c
nop
cmp byte [rsp + 0x21], 0
je 0x1800278f7
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800278ef
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027aac
mov rcx, rdi
call fcn.180029c7c
mov r12, qword [rbp - 0x78]
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
cmp byte [rsp + 0x22], 0
je 0x180027946
mov rdx, qword [rbp - 0x58]
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x18002793d
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027b3b
mov rcx, r13
call fcn.180029c7c
nop
cmp r12, 8
jb 0x180027981
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x180027979
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027b42
mov rcx, r15
call fcn.180029c7c
lea rdx, [rbp - 0x30]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x180027b49
mov rbx, qword [rsp + 0x40]
jmp 0x180027596
mov r15, qword [rsp + 0x68]
lea rax, [rbp - 0x30]
mov ecx, 4
mov rdx, qword [rsp + 0x48]
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rcx, 1
jne 0x1800279c0
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
mov rax, qword [rax + 0x30]
mov qword [rdx + 0x30], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp - 0x28]
cmp r13, 8
jb 0x180027a7d
lea rdx, [r13*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180027a74
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180027a74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.180029c7c
nop
cmp r15, 8
jb 0x180027abc
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180027ab3
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180027ab3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180029c7c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180027afa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027af4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027b3b
call fcn.180029c7c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180027b37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov r8, rcx
cmp rdx, 0x1000
jb 0x180027b32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x180027b42
call fcn.180029c7c
mov eax, ebx
jmp 0x180027b54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.180029c20
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret