Function at 0x14001d4b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400ef100]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor edx, edx
mov r14, rcx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov r15, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001d6f4
xor r12d, r12d
movabs rdx, 0x7fffffffffffffff
movabs r13, 0x7ffffffffffffffe
lea r8d, [r12 + 0xa]
xorps xmm0, xmm0
mov qword [rsp + 0x30], r12
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x6c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x14001d551
add rbx, rbx
lea rax, [rsp + 0x6c]
add rax, rbx
lea rcx, [rsp + 0x6c]
cmp rcx, rax
jne 0x14001d584
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r12w
jmp 0x14001d65f
sar rbx, 1
cmp rbx, r13
ja 0x14001d77d
mov qword [rsp + 0x38], 7
cmp rbx, 7
ja 0x14001d5c4
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x6c]
add rbx, rbx
lea rcx, [rsp + 0x20]
mov r8, rbx
call fcn.1400a2d60
mov word [rsp + rbx + 0x20], r12w
jmp 0x14001d65f
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x14001d5d9
mov rsi, r13
lea rcx, [rdx + rdx]
jmp 0x14001d5fa
cmp rsi, 0xa
cmovb rsi, r8
lea rcx, [rsi + 1]
cmp rcx, rdx
ja 0x14001d777
add rcx, rcx
cmp rcx, 0x1000
jb 0x14001d626
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001d777
mov rcx, rax
call fcn.1400757c0
test rax, rax
je 0x14001d783
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001d638
test rcx, rcx
je 0x14001d635
call fcn.1400757c0
mov rdi, rax
jmp 0x14001d638
mov rdi, r12
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0x6c]
add rbx, rbx
mov qword [rsp + 0x20], rdi
mov r8, rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
call fcn.1400a2d60
mov word [rbx + rdi], r12w
cmp qword [r14 + 0x18], 7
mov rdx, r14
jbe 0x14001d66c
mov rdx, qword [r14]
cmp qword [rsp + 0x38], 7
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.14007cecc
mov rcx, r15
test eax, eax
je 0x14001d72f
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 7
jbe 0x14001d6dc
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d6d7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d783
call fcn.140075b0c
movabs rdx, 0x7fffffffffffffff
mov r8d, 0xa
test ebx, ebx
jne 0x14001d533
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400757a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14001d773
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001d76e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001d783
call fcn.140075b0c
mov al, 1
jmp 0x14001d6ff
call fcn.1400020d0
int3
call fcn.140002170
int3
call fcn.14007c77c
int3