Function at 0x1400014a0
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6c8
mov rdi, qword [0x14000a930]
mov rax, qword [rdi]
mov qword [rsp + 0x6b8], rax
xor eax, eax
mov rbx, rcx
movsxd r14, edx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14000164c
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rdx, rax
mov qword [rsp + 0x28], rax
call sub.KERNEL32.dll_Process32FirstW
mov r8, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x34], eax
test eax, eax
je 0x1400015dd
mov r8, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r15, [rsp + 0x4b0]
mov dword [rsp + 0x34], 0
lea rsi, [rsp + 0x280]
mov rdi, qword [sym.imp.msvcrt.dll__wcsnicmp]
lea r12, [r15 + r14*2]
mov qword [rsp + 0x38], r8
jmp 0x140001563
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400015d8
mov ebp, dword [rsp + 0x48]
test ebp, ebp
je 0x140001550
mov edx, ebp
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140001550
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x280], 0x438
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1400015c6
nop word [rax + rax]
mov r8, r14
mov rdx, r15
mov rcx, rbx
call rdi
test eax, eax
jne 0x1400015b7
cmp word [r12], 0x5c
je 0x140001618
mov rdx, rsi
mov rcx, r13
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1400015a0
mov rax, qword [rsp + 0x38]
mov rcx, r13
call rax
jmp 0x140001550
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call r8
mov rdi, qword [0x14000a930]
mov rax, qword [rsp + 0x6b8]
sub rax, qword [rdi]
jne 0x140001656
mov eax, dword [rsp + 0x34]
add rsp, 0x6c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add dword [rsp + 0x34], 1
mov ecx, 2
call qword [fcn.140007990]
mov r9, r15
mov r8d, ebp
lea rdx, str.Pid__ld_uses__S_n
mov rcx, rax
call fcn.140001450
mov rax, qword [rsp + 0x38]
mov rcx, r13
call rax
jmp 0x140001550
mov dword [rsp + 0x34], 0xffffffff
jmp 0x1400015e5
call fcn.1400028d0
nop
nop dword [rax]
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rsi, qword [0x14000a930]
mov rax, qword [rsi]
mov qword [rsp + 0x68], rax
xor eax, eax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [rsp + 0x2c], 3
mov rbx, rax
je 0x1400016e8
mov rdi, qword [rbx]
mov ecx, 2
call qword [fcn.140007990]
lea rdx, str.Usage:__S__command____arguments_...__nCommands:_n_tblocking_pids__top_level_directory__n_trecycle__path__n
mov r8, rdi
mov rcx, rax
mov edi, 1
call fcn.140001450
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x68]
sub rax, qword [rsi]
jne 0x140001814
mov eax, edi
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [rax + 8]
lea rcx, str.blocking_pids
call sub.msvcrt.dll_wcscmp
mov edx, eax
test eax, eax
jne 0x140001768
mov r10, qword [rbx + 0x10]
movzx ecx, word [r10]
test cx, cx
je 0x14000174d
mov r8d, 2
jmp 0x14000171e
mov r8, rax
mov edx, r9d
cmp cx, 0x2f
jne 0x14000172f
mov ecx, 0x5c
mov word [r10 + r8 - 2], cx
lea rax, [r8 + 2]
lea r9d, [rdx + 1]
movzx ecx, word [r10 + rax - 2]
test cx, cx
jne 0x140001718
cmp word [r10 + r8 - 2], 0x5c
cmovne edx, r9d
mov rcx, r10
xor edi, edi
call fcn.1400014a0
test eax, eax
setne dil
jmp 0x1400016be
cmp dword [rsp + 0x2c], 3
jne 0x140001699
mov rdx, qword [rbx + 8]
lea rcx, str.recycle
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140001699
mov r12, qword [rbx + 0x10]
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea edi, [rax + 2]
movsxd rdi, edi
add rdi, rdi
mov rcx, rdi
call sub.msvcrt.dll_malloc
mov rbp, rax
test rax, rax
je 0x140001819
lea r8, [rdi - 4]
mov rdx, r12
mov rcx, rax
call sub.msvcrt.dll_memcpy
pxor xmm0, xmm0
mov eax, 0x654
mov dword [rbp + rdi - 4], 0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], 3
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rbp
mov edi, eax
call sub.msvcrt.dll_free
jmp 0x1400016be
call fcn.1400028d0
or edi, 0xffffffff
jmp 0x1400016be