Function at 0x140015e85
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 0x4e
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140015e9e
sub rsp, 0x28
call fcn.1400f9dd0
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400f9ea0
add rsp, 0x10
lea rbp, [rsp + 0x30]
mov dword [rbp], 0x238
mov byte [rsp + 0x288], 0
push 0
push 2
pop rcx
pop rdx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x268], rax
cmp qword [rsp + 0x268], 0
je 0x14001614d
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x270]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32FirstW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x270], eax
cmp dword [rsp + 0x270], 0
je 0x140016140
lea rbp, [rsp + 0x30]
movsxd r15, dword [rbp + 0x20]
cmp r15d, dword [rsp + 0x2b0]
jne 0x140016118
lea rbp, [rsp + 0x30]
movsxd rax, dword [rbp + 8]
push rax
pop rax
mov dword [rsp + 0x280], eax
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push 0x104
lea rax, [rbp + 0x2c]
mov rax, rax
push rax
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400f8570
add rsp, 0x28
lea rcx, [rsp + 0x280]
pop rdx
call fcn.1400f9ad0
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.1400f99b0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x2a0]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400de1b0
add rsp, 0x20
push rax
call fcn.1400f9a30
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f6e70
add rsp, 0x28
lea rcx, [rsp + 0x280]
pop rdx
call fcn.1400f9ad0
cmp byte [rsp + 0x2b8], 0
je 0x140016118
push qword [rsp + 0x28]
movabs rcx, 0x14022e1a0
pop rdx
call fcn.1400f9d20
or rax, rax
jne 0x1400160f3
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400f99b0
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x40]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400f6e70
add rsp, 0x28
call fcn.1400f9ca0
mov rcx, qword [rsp + 0x280]
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400f9cd0
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400f9d20
or rax, rax
je 0x1400160f1
movsxd rax, dword [rsp + 0x280]
mov rax, rax
push rax
pop rcx
call fcn.14007e814
mov byte [rsp + 0x288], 1
push 0x1f4
pop rcx
call fcn.1400db4e0
jmp 0x140016118
movsxd rax, dword [rsp + 0x280]
mov rax, rax
push rax
pop rcx
call fcn.14007e814
mov byte [rsp + 0x288], 1
push 0x1f4
pop rcx
call fcn.1400db4e0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push qword [rsp + 0x270]
pop rcx
pop rdx
call sub.KERNEL32.dll_Process32NextW
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x270], eax
jmp 0x140015f31
push qword [rsp + 0x268]
pop rcx
call sub.KERNEL32.dll_CloseHandle
movsx r15, byte [rsp + 0x288]
and r15, r15
jne 0x140015ede
xor rax, rax
jmp 0x140016167
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
mov rcx, qword [rsp + 0x280]
sub rsp, 0x28
call fcn.1400f9e70
add rsp, 0x28
pop rax
add rsp, 0x298
pop r15
pop rbp
ret