Function at 0x140023d70
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x14006c030]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r12d, r8d
mov r15, rdx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x10], 0x238
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140024414
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002440b
nop dword [rax + rax]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
lea rax, [rbp + 0x3c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140023e10
lea rdx, [rbp + 0x3c]
lea rcx, [rbp - 0x18]
call fcn.14001a8c0
nop
mov edx, 5
lea rcx, [rbp - 0x58]
call fcn.1400140d0
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
add r8, rdx
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x78]
call fcn.1400146d0
or edi, 0x10
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140023ea2
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023e9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002444a
call fcn.1400285fc
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
or edi, 1
mov dword [rsp + 0x20], edi
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
lea r9, [rbp - 0x18]
mov rsi, qword [rbp - 0x18]
mov r14, qword [rbp]
cmp r14, 8
cmovae r9, rsi
mov rbx, qword [rbp - 8]
cmp rbx, qword [rbp - 0x68]
jne 0x140023f23
mov r8, rbx
test rbx, rbx
je 0x140024207
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140023f23
sub r9, rax
cmp cx, dx
ja 0x140023f23
cmp r8, 1
je 0x140024207
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140023f03
xor al, al
test al, al
jne 0x14002421c
mov edx, 6
lea rcx, [rbp - 0x38]
call fcn.1400140d0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
add r8, rdx
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.1400146d0
or edi, 0x20
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140023fa7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023fa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024450
call fcn.1400285fc
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
or edi, 2
mov dword [rsp + 0x20], edi
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
lea r9, [rbp - 0x18]
cmp r14, 8
cmovae r9, rsi
cmp rbx, qword [rsp + 0x78]
jne 0x140024023
mov r8, rbx
test rbx, rbx
je 0x14002420e
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140024023
sub r9, rax
cmp cx, dx
ja 0x140024023
cmp r8, 1
je 0x14002420e
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140024003
xor al, al
test al, al
jne 0x14002421c
mov edx, 7
lea rcx, [rbp - 0x58]
call fcn.1400140d0
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
add r8, rdx
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x48]
call fcn.1400146d0
or edi, 0x40
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400240a7
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400240a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024456
call fcn.1400285fc
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
or edi, 4
mov dword [rsp + 0x20], edi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
lea r9, [rbp - 0x18]
cmp r14, 8
cmovae r9, rsi
cmp rbx, qword [rsp + 0x58]
jne 0x140024124
mov r8, rbx
test rbx, rbx
je 0x140024215
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140024124
sub r9, rax
cmp cx, dx
ja 0x140024124
cmp r8, 1
je 0x140024215
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140024104
xor al, al
test al, al
jne 0x14002421c
mov edx, 8
lea rcx, [rbp - 0x38]
call fcn.1400140d0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
add r8, rdx
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x28]
call fcn.1400146d0
bts edi, 7
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400241a9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400241a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002445c
call fcn.1400285fc
or edi, 8
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
lea r8, [rbp - 0x18]
cmp r14, 8
cmovae r8, rsi
cmp rbx, qword [rsp + 0x38]
jne 0x140024203
test rbx, rbx
je 0x14002421c
movzx ecx, word [r8]
movzx edx, word [rax]
cmp cx, dx
jb 0x140024203
sub r8, rax
cmp cx, dx
ja 0x140024203
cmp rbx, 1
je 0x14002421c
dec rbx
add rax, 2
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400241e7
xor bl, bl
jmp 0x14002421e
mov al, 1
jmp 0x140023f25
mov al, 1
jmp 0x140024025
mov al, 1
jmp 0x140024126
mov bl, 1
test dil, 8
je 0x140024280
and edi, 0xfffffff7
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140024269
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024264
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024462
call fcn.1400285fc
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], ax
jmp 0x140024282
xor eax, eax
test dil, 4
je 0x1400242e2
and edi, 0xfffffffb
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400242cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400242c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024468
call fcn.1400285fc
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], ax
test dil, 2
je 0x140024340
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14002432e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002446e
call fcn.1400285fc
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
test dil, 1
je 0x140024389
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140024389
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024474
call fcn.1400285fc
test bl, bl
jne 0x1400243bb
test r12d, r12d
je 0x140024398
cmp dword [rbp + 0x30], r12d
jne 0x1400243bb
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1400243ae
mov eax, dword [rbp + 0x18]
mov dword [rdx], eax
add qword [r15 + 8], 4
jmp 0x1400243bb
lea r8, [rbp + 0x18]
mov rcx, r15
call fcn.1400215b0
nop
cmp r14, 8
jb 0x1400243f2
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
mov rax, rsi
jb 0x1400243ea
mov rsi, qword [rsi - 8]
sub rax, rsi
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140024444
mov rcx, rsi
call fcn.1400285fc
lea rdx, [rbp + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14002440b
xor ebx, ebx
jmp 0x140023df0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400285b0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
int3
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
nop
call fcn.14002ef48
int3