Function at 0x180003908
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x180014008]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov rsi, r8
lea rcx, [rbp + 0xb0]
mov rbx, rdx
mov r8d, 0x800
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, rbx
call fcn.1800033ec
mov edx, 0x8000
mov rcx, rsi
mov r14d, eax
call fcn.180003588
test r14d, r14d
jle 0x180003976
mov edx, r14d
mov rcx, rsi
call fcn.180003620
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.180003c9c
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800039be
lea rax, [0x180010448]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1800036e8
mov eax, 0x1f
jmp 0x180003b86
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x130
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x1800039ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.CreateToolhelp32Snapshot__Process32First
jmp 0x18000399f
mov rcx, qword [0x1817767c0]
mov rax, qword [rcx]
call qword [rax + 0x30]
mov r8d, dword [rsp + 0x58]
cmp al, 6
sbb ecx, ecx
xor edx, edx
and ecx, 0xfffff400
add ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x180003a68
movzx ecx, word [0x1800104a0]
movsd xmm0, qword [str._nd__td__ts_]
mov word [rbp + 0x88], cx
lea rcx, [rbp + 0x80]
movsd qword [rbp + 0x80], xmm0
call sub.msvcrt.dll__strrev
mov ecx, dword [rsp + 0x58]
lea r8, [rsp + 0x7c]
mov r9d, dword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.180003650
jmp 0x180003b53
lea r8, [rsp + 0x48]
mov edx, 8
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180003aa7
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0xb0]
mov r8d, 0x800
call fcn.1800063f0
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180003aae
mov byte [rbp + 0xb0], 0
mov ecx, dword [rsp + 0x58]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [rsp + 0x40]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov dword [rsp + 0x40], ecx
mov rcx, r15
call fcn.180003c9c
movups xmm0, xmmword [str._nd__ts__ts__td__td__ts_]
test eax, eax
lea rcx, [0x180010440]
movzx eax, word [0x1800104b8]
lea rbx, [0x180010444]
mov word [rbp + 0xa0], ax
cmove rbx, rcx
mov al, byte [0x1800104ba]
lea rcx, [rbp + 0x90]
mov byte [rbp + 0xa2], al
movups xmmword [rbp + 0x90], xmm0
call sub.msvcrt.dll__strrev
mov r9d, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov rdx, rax
mov rcx, rsi
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.180003650
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1800039ea
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
neg r14d
sbb eax, eax
and eax, 5
add eax, 0x11
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.18000dd60
mov rbx, qword [rsp + 0x9f0]
add rsp, 0x9c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret