Function at 0x140011b18
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14001dab0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x878
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x21e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x898]
mov qword [rbp + 0x808], 0xfffffffffffffffe
mov rax, qword [0x140045018]
xor rax, rbp
mov qword [rbp + 0x830], rax
lea rcx, [0x14004d098]
call fcn.140011244
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400119c9
xor edx, edx
mov ecx, 2
call fcn.1400118a7
mov qword [rbp + 0x528], rax
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 8]
call fcn.1400110cd
nop
lea rcx, [rbp + 8]
call fcn.140011221
test rax, rax
jne 0x14001db7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011627
mov dword [rbp + 0x544], 2
lea rcx, [rbp + 8]
call fcn.1400117da
nop
mov rcx, qword [rbp + 0x860]
call fcn.140011af5
mov eax, dword [rbp + 0x544]
jmp 0x14001de37
mov dword [rbp + 0x30], 0x238
lea rcx, [rbp + 8]
call fcn.140011221
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.14001178f
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x14001dbdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140011627
mov dword [rbp + 0x564], 2
lea rcx, [rbp + 8]
call fcn.1400117da
nop
mov rcx, qword [rbp + 0x860]
call fcn.140011af5
mov eax, dword [rbp + 0x564]
jmp 0x14001de37
lea rax, [rbp + 0x588]
mov qword [rbp + 0x5b8], rax
lea rax, [rbp + 0x5d8]
mov qword [rbp + 0x608], rax
lea rax, [rbp + 0x628]
mov qword [rbp + 0x658], rax
mov rdx, qword [rbp + 0x5b8]
mov rcx, qword [rbp + 0x860]
call fcn.140011ae6
mov qword [rbp + 0x818], rax
mov rdx, qword [rbp + 0x608]
mov rcx, qword [rbp + 0x860]
call fcn.1400113ed
mov qword [rbp + 0x820], rax
mov rdx, qword [rbp + 0x658]
mov rcx, qword [rbp + 0x860]
call fcn.140011ae6
mov qword [rbp + 0x828], rax
mov rax, qword [sym.imp.ucrtbased.dll_towlower]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x818]
mov r8, qword [rbp + 0x820]
mov rdx, qword [rbp + 0x828]
lea rcx, [rbp + 0x678]
call fcn.1400110d2
lea rcx, [rbp + 0x678]
call fcn.1400119ab
lea rdx, [rbp + 0x5c]
lea rcx, [rbp + 0x2a8]
call fcn.1400111ae
nop
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6d8], rax
lea rax, [rbp + 0x6f8]
mov qword [rbp + 0x728], rax
lea rax, [rbp + 0x748]
mov qword [rbp + 0x778], rax
mov rdx, qword [rbp + 0x6d8]
lea rcx, [rbp + 0x2a8]
call fcn.140011ae6
mov qword [rbp + 0x818], rax
mov rdx, qword [rbp + 0x728]
lea rcx, [rbp + 0x2a8]
call fcn.1400113ed
mov qword [rbp + 0x820], rax
mov rdx, qword [rbp + 0x778]
lea rcx, [rbp + 0x2a8]
call fcn.140011ae6
mov qword [rbp + 0x828], rax
mov rax, qword [sym.imp.ucrtbased.dll_towlower]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x818]
mov r8, qword [rbp + 0x820]
mov rdx, qword [rbp + 0x828]
lea rcx, [rbp + 0x798]
call fcn.1400110d2
lea rcx, [rbp + 0x798]
call fcn.1400119ab
mov rdx, qword [rbp + 0x860]
lea rcx, [rbp + 0x2a8]
call fcn.1400113bb
movzx eax, al
test eax, eax
je 0x14001dde8
lea rdx, str.___Found_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011b59
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.140011b59
lea rdx, str._with_PID
mov rcx, rax
call fcn.140011186
mov edx, dword [rbp + 0x38]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x14001197e]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x7c4], eax
lea rcx, [rbp + 0x2a8]
call fcn.140011af5
nop
lea rcx, [rbp + 8]
call fcn.1400117da
nop
mov rcx, qword [rbp + 0x860]
call fcn.140011af5
mov eax, dword [rbp + 0x7c4]
jmp 0x14001de37
lea rcx, [rbp + 0x2a8]
call fcn.140011af5
lea rcx, [rbp + 8]
call fcn.140011221
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.1400112a3
test eax, eax
jne 0x14001dc8e
mov dword [rbp + 0x7e4], 2
lea rcx, [rbp + 8]
call fcn.1400117da
nop
mov rcx, qword [rbp + 0x860]
call fcn.140011af5
mov eax, dword [rbp + 0x7e4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140039940]
call fcn.140011c85
mov rax, rdi
mov rcx, qword [rbp + 0x830]
xor rcx, rbp
call fcn.14001134d
lea rsp, [rbp + 0x848]
pop rdi
pop rbp
ret