Function at 0x140006850
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
sub rsp, 0x498
mov rax, qword [0x140051018]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor edx, edx
mov dword [rsp + 0x260], 0x104
mov r14, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400068a2
lea rcx, str.____Could_not_get_a_snapshot_of_the_systems_processes__CreateToolhelp32Snapshot_
call fcn.1400184e0
mov eax, ebp
jmp 0x140006b1c
mov qword [rsp + 0x4b8], rbx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x4c0], rsi
mov rcx, rbp
mov qword [rsp + 0x4c8], rdi
mov qword [rsp + 0x490], r15
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400068fb
lea rcx, str.____Could_not_retrieve_information_about_the_first_process__Process32First_
call fcn.1400184e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x140006afc
lea r15, str.HealthService.exe
mov r8d, dword [rsp + 0x28]
test r8d, r8d
je 0x140006adb
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140006acb
lea r9, [rsp + 0x260]
mov dword [rsp + 0x260], 0x104
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x14000697f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [rsp + 0x28]
lea rcx, str.___Couldnt_query_image_information_of_process_with_PID__ld__QueryFullProcessImageName_failed_with_0x_x__n
mov r8d, eax
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006adb
lea rcx, [rsp + 0x270]
call fcn.14000c490
test eax, eax
jne 0x1400069ce
xor ebx, ebx
mov rdi, r15
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rsp + 0x270]
call fcn.14000e140
test rax, rax
jne 0x1400069ce
inc ebx
add rdi, 8
cmp ebx, 0x15
jb 0x1400069a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006adb
mov edx, 0x20
lea ecx, [rdx - 0x1f]
call fcn.1400119fc
mov rbx, rax
test rax, rax
je 0x140006b40
lea rcx, [rsp + 0x270]
call fcn.140011e48
mov qword [rbx], rax
mov r10, rax
test rax, rax
je 0x140006b37
mov r11, qword [r14]
test r11, r11
je 0x140006aa6
mov r8, qword [r11]
mov rcx, rax
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140006a34
add rcx, 2
test eax, eax
jne 0x140006a20
test edx, edx
js 0x140006aa6
mov r9, qword [r11 + 0x18]
test r9, r9
je 0x140006a74
mov rax, qword [r9]
mov r8, r10
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140006a64
add rax, 2
test ecx, ecx
jne 0x140006a50
test edx, edx
jns 0x140006a74
mov r11, r9
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x140006a41
mov r8, qword [r11 + 0x18]
test r8, r8
je 0x140006a9c
mov rdx, qword [r8]
sub rdx, r10
movzx ecx, word [r10]
movzx eax, word [r10 + rdx]
sub ecx, eax
jne 0x140006a98
add r10, 2
test eax, eax
jne 0x140006a83
test ecx, ecx
jns 0x140006aad
mov qword [rbx + 0x18], r8
mov qword [r11 + 0x18], rbx
jmp 0x140006aad
mov qword [rbx + 0x18], r11
mov qword [r14], rbx
mov r8, qword [rbx]
lea rcx, str.___Found_EDR_binary_in_execution__process_with_PID__i_:___s__n
mov edx, dword [rsp + 0x28]
call fcn.140001010
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006adb
mov edx, dword [rsp + 0x28]
lea rcx, str.___Couldnt_open_handle_on_process__OpenProcess_with_PROCESS_QUERY_LIMITED_INFORMATION___ld_n
call fcn.140001010
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006902
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, qword [rsp + 0x4c8]
mov rsi, qword [rsp + 0x4c0]
mov rbx, qword [rsp + 0x4b8]
mov r15, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000d570
add rsp, 0x498
pop r14
pop rbp
ret
lea rcx, str.____Couldnt_alloc_memory_for_binary_path_for_process_with_PID__ld__slistNewEntry__binaryPath__n
jmp 0x140006b47
lea rcx, str.____Couldnt_alloc_memory_for_binary_path_for_process_with_PID__ld__slistNewEntry__n
mov edx, dword [rsp + 0x28]
call fcn.140001010
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
jmp 0x140006afc