Function at 0x140002450
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r12
push r14
push r15
sub rsp, 0x698
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x670], rax
xor r12d, r12d
mov qword [rsp + 0x20], 0x238
mov r15, r8
mov dword [rsp + 0x28], r12d
mov r14, rdx
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x38], r12
mov r8d, 0x20c
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x4c]
mov dword [rsp + 0x48], r12d
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400024ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____CreateToolhelp32Snapshot_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
xor eax, eax
jmp 0x1400026a0
lea rcx, str.___hSnapShot_n
call fcn.140002350
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140002539
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Process32First_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400026a0
mov qword [rsp + 0x6c0], rbx
lea rcx, str.___Process32First_n
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x688], rdi
mov qword [rsp + 0x680], r13
call fcn.140002350
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140002666
lea r13, str.cmd.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, r12d
cmp eax, 0x208
jae 0x1400025d9
test eax, eax
je 0x1400025bf
mov rbx, r12
mov edi, eax
mov esi, eax
movzx ecx, word [rsp + rbx + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [rsp + rbx + 0x260], ax
lea rbx, [rbx + 2]
sub rdi, 1
jne 0x1400025a2
mov eax, esi
add rax, rax
cmp rax, 0x410
jae 0x1400026bf
mov word [rsp + rax + 0x260], r12w
mov rax, r12
lea rdx, [rsp + 0x260]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r13 + rax*2 - 2]
jne 0x140002650
cmp rax, 8
jne 0x1400025f0
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
mov dword [r14], r8d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r15], rax
test rax, rax
jne 0x140002666
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcess_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140002680
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002582
lea rcx, str.___GetProcess_Finish_n
call fcn.140002350
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rdi, qword [rsp + 0x688]
mov rsi, qword [rsp + 0x690]
mov rbx, qword [rsp + 0x6c0]
mov r13, qword [rsp + 0x680]
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140002f50
add rsp, 0x698
pop r15
pop r14
pop r12
pop rbp
ret
call fcn.140003078
int3