Function at 0x140008420
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
mov qword [rsp + 0xa8], rdx
mov rsi, rcx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140008621
mov rdi, rax
mov dword [rsp + 0xc0], 0x238
lea rdx, [rsp + 0xc0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140008743
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x60], rdi
jmp 0x1400084c0
call fcn.1400138c0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, rdi
lea rdx, [rsp + 0xc0]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140008811
mov rcx, rsi
lea rdx, [rsp + 0xec]
call fcn.140013170
mov rax, qword [rsp + 0xa8]
mov r13, qword [rax]
mov rcx, qword [rax + 8]
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xb8], rcx
cmp r13, rcx
je 0x1400085d0
mov rax, qword [rsp + 0x28]
mov rcx, rax
cmp qword [rsp + 0x68], 0x10
jb 0x14000850c
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
lea rdx, [rcx + rax]
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rax
jmp 0x140008556
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
cmp rsi, qword [rsp + 0xb0]
jne 0x14000872e
add r13, 0x20
cmp r13, qword [rsp + 0xb8]
je 0x1400085d0
cmp qword [r13 + 0x18], 0x10
mov r15, r13
jb 0x140008564
mov r15, qword [r13]
mov rdi, qword [r13 + 0x10]
cmp rax, rdi
jl 0x140008548
mov rsi, rcx
test rdi, rdi
je 0x14000853a
mov rbx, rax
mov rsi, rcx
xor r14d, r14d
nop
movzx ebp, byte [r15 + r14]
movzx ecx, byte [rsi + r14]
call fcn.140023594
mov r12d, eax
mov ecx, ebp
call fcn.140023594
cmp r12d, eax
jne 0x1400085b0
inc r14
cmp rdi, r14
jne 0x140008580
jmp 0x140008530
inc rsi
lea rax, [rbx - 1]
cmp rbx, rdi
mov rbx, rax
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
jg 0x14000857b
jmp 0x140008548
mov r8, qword [rsp + 0x68]
cmp r8, 0x10
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
jb 0x140008495
mov rcx, qword [rsi]
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140008490
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140008847
add r8, 0x28
mov rdx, r8
mov rcx, rax
jmp 0x140008490
movabs rax, 0x64ad60031a2b166c
mov qword [rsp + 0x30], rax
movabs rax, 0x66e15c49b9bc6237
mov qword [rsp + 0x38], rax
movabs rax, 0xe01c532e571b92de
mov qword [rsp + 0x40], rax
movabs rax, 0x2297d878add95d2d
mov qword [rsp + 0x48], rax
movabs rax, 0x7757c264fca711eb
mov qword [rsp + 0x50], rax
movabs rax, 0x3f924b8903379448
mov qword [rsp + 0x58], rax
movabs rcx, 0x44f0126c68595337
mov qword [rsp + 0xc0], rcx
movabs rcx, 0x9b5393dd8d91074
mov qword [rsp + 0xc8], rcx
movabs rcx, 0xd22f23423273feb1
mov qword [rsp + 0xd0], rcx
movabs rcx, 0x56f8b00bddb8337e
mov qword [rsp + 0xd8], rcx
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rax
lea rax, [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [0x140051b70]
lea rdx, [rsp + 0x30]
call fcn.140001820
mov rcx, rax
mov dl, 0xa
call fcn.140001550
jmp 0x14000881a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x28]
jmp 0x140008830
movabs rax, 0x64ad60031a2b166c
mov qword [rsp + 0x80], rax
movabs rax, 0x3ac64a58bbb66224
mov qword [rsp + 0x88], rax
movabs rax, 0xb40f5731401ab883
mov qword [rsp + 0x90], rax
movabs rax, 0x56f89e6fb8d45a1f
mov qword [rsp + 0x98], rax
movabs rax, 0x44f0126c68595337
mov qword [rsp + 0x30], rax
movabs rax, 0x9b5393dd8d91074
mov qword [rsp + 0x38], rax
movabs rax, 0xd22f23423273feb1
mov qword [rsp + 0x40], rax
movabs rax, 0x56f8b00bddb8337e
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x90]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [0x140051b70]
lea rdx, [rsp + 0x80]
call fcn.140001820
mov rcx, rax
mov dl, 0xa
call fcn.140001550
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140020300
int3