Function at 0x140003840
Capabilities:
Enumerate processes
Patch process command line

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
lea rbp, [rsp - 0x6a0]
sub rsp, 0x7a0
lea r15, [0x1400e9720]
xor edx, edx
mov rcx, r15
mov r8d, 0x80
call fcn.140007ee0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400038ac
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400038bb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x7a0
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x780], r12
xor r12d, r12d
mov qword [rsp + 0x798], rbx
mov qword [rsp + 0x790], rsi
mov qword [rsp + 0x788], rdi
nop
xor edx, edx
lea rcx, [rbp + 0x1b0]
mov r8d, 0x1fe
call fcn.140007ee0
mov rax, r12
nop word [rax + rax]
movzx ecx, word [rbp + rax - 0x64]
mov word [rbp + rax + 0x1b0], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140003900
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_CharLowerW]
mov r8d, 0xb
lea rdx, [rbp + 0x1b0]
lea rcx, str.svchost.exe
call fcn.140008ad8
test eax, eax
jne 0x140003b1b
mov esi, dword [rsp + 0x78]
lea rcx, [0x140019e50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140003970
lea rcx, [0x140019e50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140003b1b
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov rbx, r12
test rax, rax
je 0x1400039d4
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140003b1b
lea rax, [rbp + 0x6c8]
mov dword [rbp + 0x6c8], r12d
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, rbx
call rdi
test eax, eax
jne 0x140003b12
mov rdi, qword [rsp + 0x48]
lea rax, [rbp + 0x6c0]
mov rdx, rdi
mov qword [rbp + 0x6c0], r12
mov r9d, 0x2c8
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x3b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003b12
lea rax, [rbp + 0x6c0]
mov r9d, 8
lea rdx, [rdi + 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x6d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003b12
mov rdx, qword [rbp + 0x6d0]
lea rax, [rbp + 0x6c0]
add rdx, 0x70
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140003b12
movzx ecx, word [rsp + 0x30]
add ecx, 2
call fcn.140008ad0
mov rdi, rax
test rax, rax
je 0x140003b12
movzx r8d, word [rsp + 0x30]
xor edx, edx
add r8d, 2
mov rcx, rax
call fcn.140007ee0
movzx r9d, word [rsp + 0x30]
lea rax, [rbp + 0x6c0]
mov rdx, qword [rsp + 0x38]
mov r8, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140003aca
mov rcx, rdi
call fcn.140008ac8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.secsvcs
mov rcx, rdi
call fcn.140007a28
mov rcx, rdi
mov rbx, rax
call fcn.140008ac8
test rbx, rbx
je 0x140003b1b
cmp dword [0x1400e9720], r12d
mov ecx, r12d
je 0x140003b08
nop
inc ecx
cmp dword [r15 + rcx*4], r12d
jne 0x140003b00
mov eax, dword [rsp + 0x78]
mov dword [r15 + rcx*4], eax
jmp 0x140003b1b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x70]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400038e0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x780]
mov rax, r15
mov rdi, qword [rsp + 0x788]
mov rsi, qword [rsp + 0x790]
mov rbx, qword [rsp + 0x798]
add rsp, 0x7a0
pop r15
pop r14
pop rbp
ret