Function at 0x140023da0
Capabilities:
Enumerate processes

Disassembly:
push rsi
push r12
push r13
sub rsp, 0x2b0
mov rax, qword [0x140295040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, rdx
mov dword [rsp + 0x50], 0x238
mov r13, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140023def
xor eax, eax
jmp 0x140024058
mov qword [rsp + 0x2d0], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x2d8], rbp
mov rcx, rax
mov qword [rsp + 0x2e0], rdi
mov qword [rsp + 0x2a8], r14
mov qword [rsp + 0x2a0], r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140024025
nop dword [rax]
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x28]
call fcn.140025a60
cmp qword [r13 + 0x18], 7
mov rbx, r13
mov r11, qword [r13 + 0x10]
jbe 0x140023e51
mov rbx, qword [r13]
mov r15, qword [rsp + 0x40]
lea rdi, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
cmp r15, 7
mov rbp, qword [rsp + 0x38]
cmova rdi, r14
cmp r11, rbp
ja 0x140023fcf
mov rax, rbp
sub rax, r11
test r11, r11
je 0x140023f16
movzx r10d, word [rbx]
inc rax
lea rsi, [rdi + rax*2]
mov rax, rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, rsi
mov edx, 0
sub rcx, rax
sar rcx, 1
je 0x140023ecc
cmp word [rax], r10w
je 0x140023ec9
cmp rcx, 1
je 0x140023ecc
add rax, 2
dec rcx
cmp word [rax], r10w
jne 0x140023eb6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x140023fcf
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x140023f04
mov r9, rax
sub r9, rbx
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140023f4c
add rdx, 2
sub r8, 1
jne 0x140023ef0
sub rax, rdi
cmp rax, 2
jae 0x140023fcf
mov rsi, qword [rsp + 0x20]
cmp qword [r12 + 0x18], 7
mov rbx, r12
mov r10, qword [r12 + 0x10]
jbe 0x140023f2a
mov rbx, qword [r12]
cmp r15, 7
lea r11, [rsp + 0x28]
cmova r11, r14
test r10, r10
jne 0x140023f55
mov r8, 0xffffffffffffffff
cmp rbp, r8
cmovb r8, rbp
jmp 0x140023fc3
add rax, 2
jmp 0x140023ea0
cmp r10, rbp
ja 0x140023fbc
movzx edi, word [rbx]
mov rax, 0xffffffffffffffff
mov rcx, rbp
sub rcx, r10
cmp rcx, rax
cmovb rax, rcx
lea r8, [r11 + rax*2]
mov r9, r8
sub r9, rbx
nop dword [rax + rax]
cmp word [r8], di
jne 0x140023fad
mov rdx, r10
mov rcx, rbx
test r10, r10
je 0x140023fa5
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x140023fad
add rcx, 2
sub rdx, 1
jne 0x140023f91
sub r8, r11
sar r8, 1
jmp 0x140023fc3
cmp r8, r11
je 0x140023fbc
sub r8, 2
sub r9, 2
jmp 0x140023f80
mov r8, 0xffffffffffffffff
sub rbp, r10
cmp r8, rbp
je 0x140024075
cmp r15, 7
jbe 0x14002400a
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140024002
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400240c0
mov rcx, r14
call fcn.140089f14
mov rsi, qword [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140023e30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r14, qword [rsp + 0x2a8]
mov rdi, qword [rsp + 0x2e0]
mov rbp, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2d0]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140089c70
add rsp, 0x2b0
pop r13
pop r12
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x58]
cmp r15, 7
jbe 0x1400240b9
lea rdx, [r15*2 + 2]
mov r8, r14
cmp rdx, 0x1000
jb 0x1400240b1
mov r14, qword [r14 - 8]
add rdx, 0x27
sub r8, r14
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x1400240c0
mov rcx, r14
call fcn.140089f14
mov eax, ebx
jmp 0x140024030
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3