Function at 0x1400056e0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r12d, r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x20], 1
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400059d8
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400059ce
movabs r13, 0x7fffffffffffffff
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400057b0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x50]
call fcn.140001910
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
lea rsi, [rdx + rax*2]
lea rdi, [rsp + 0x50]
cmova rdi, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
cmp rdi, rsi
jne 0x140005814
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
jmp 0x14000590d
sub rsi, rdi
sar rsi, 1
mov ebx, 0xf
mov qword [rsp + 0x48], rbx
cmp rsi, r13
ja 0x140005a1f
cmp rsi, rbx
jbe 0x1400058cd
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x140005855
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140005890
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14000587a
mov rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x1400058d2
cmp rcx, 0x1000
jb 0x1400058bc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005a19
mov rcx, rax
call fcn.140006c70
mov rcx, rax
test rax, rax
je 0x140005a0b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x1400058d2
call fcn.140006c70
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
jmp 0x1400058d2
mov rax, qword [rsp + 0x30]
lea r8, [rsp + 0x30]
cmp rbx, 0xf
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x140005903
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdi, [rdi + 2]
sub rdx, 1
jne 0x1400058f0
mov qword [rsp + 0x40], rsi
mov byte [r8 + rsi], 0
mov rax, qword [r14 + 8]
cmp rax, qword [r14 + 0x10]
je 0x14000592b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1400012c0
add qword [r14 + 8], 0x20
jmp 0x14000593c
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r14
call fcn.140006950
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000597a
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005974
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a0b
call fcn.140006cac
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400059b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005a12
call fcn.140006cac
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005790
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, r14
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140006c50
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001120
int3
call fcn.1400011c0
int3