Function at 0x140003810
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
lea rdi, [rsi + rbx]
lea rax, [rsp + 0x40]
lea r13, [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x80], rbx
cmp rbx, 7
ja 0x140003890
mov r8, rbx
mov rdx, r13
cmp rsi, rdi
je 0x140003bb4
xor eax, eax
nop word [rax + rax]
movsx cx, byte [rsi + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbx, rax
jne 0x140003870
jmp 0x140003a01
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.140112f50
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rdx, rax
mov qword [rsp + 0x50], r8
cmp rsi, rdi
je 0x140003a01
lea rax, [rax + rbx*2]
lea rcx, [rbx - 1]
cmp rsi, rax
jae 0x1400038d3
cmp rdx, rdi
jb 0x140003868
cmp rcx, 0xe
jbe 0x140003bbc
mov r9, rbx
mov rcx, rbx
pxor xmm3, xmm3
xor eax, eax
shr r9, 4
and rcx, 0xfffffffffffffff0
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x1400038f8
mov rax, r9
lea r9, [rsi + rcx]
shl rax, 5
add rax, rdx
cmp rbx, rcx
je 0x140003a01
sub rbx, rcx
lea r10, [rbx - 1]
cmp r10, 6
jbe 0x140003987
movq xmm0, qword [rsi + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbx
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r9, rcx
and ebx, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x140003a01
movsx cx, byte [r9]
mov word [rax], cx
lea rcx, [r9 + 1]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 1]
mov word [rax + 2], cx
lea rcx, [r9 + 2]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 2]
mov word [rax + 4], cx
lea rcx, [r9 + 3]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 3]
mov word [rax + 6], cx
lea rcx, [r9 + 4]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 4]
mov word [rax + 8], cx
lea rcx, [r9 + 5]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 5]
mov word [rax + 0xa], cx
lea rcx, [r9 + 6]
cmp rdi, rcx
je 0x140003a01
movsx cx, byte [r9 + 6]
mov word [rax + 0xc], cx
xor eax, eax
mov qword [rsp + 0x48], r8
mov ecx, 2
mov word [rdx + r8*2], ax
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003bb0
lea r12, [rsp + 0x80]
mov rcx, rax
mov dword [rsp + 0x80], 0x130
mov rdx, r12
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140003ba8
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x70]
lea rsi, [rsp + 0xac]
jmp 0x140003a97
cmp rcx, rbp
je 0x140003a84
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov rdx, r12
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140003ba8
mov dword [rsp + 0x28], 0
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
call rdi
movsxd rdx, eax
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x60], rbp
mov r14, rdx
call fcn.14010dcb0
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r14d
mov r8, rsi
xor edx, edx
mov r9d, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rdi
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
cmp rdx, qword [rsp + 0x68]
jne 0x140003a70
mov r8, qword [rsp + 0x40]
test rdx, rdx
je 0x140003b50
cmp r8, rcx
je 0x140003b50
test r8, r8
setne r9b
test rcx, rcx
setne al
cmp r9b, al
jne 0x140003a70
xor eax, eax
nop word [rax + rax]
movzx r11d, word [rcx + rax*2]
cmp word [r8 + rax*2], r11w
jne 0x140003a70
add rax, 1
cmp rdx, rax
jne 0x140003b30
nop dword [rax]
mov rcx, rbx
call fcn.140001e00
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x140003b71
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov ebx, 1
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x140003b8f
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call fcn.140127f50
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.140001e00
xor ebx, ebx
jmp 0x140003b76
xor r8d, r8d
jmp 0x140003a01
mov rax, rdx
mov r9, rsi
xor ecx, ecx
jmp 0x140003947