Function at 0x14006caa0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1401c5538]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x14006cb15
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14006cb47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1401453a0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], r12b
jne 0x14006cb70
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140003c30
nop
lea rdi, [rbp + 0x80]
mov rdx, qword [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, rdx
lea rsi, [rbp + 0x80]
cmovae rsi, rdx
mov r15, qword [rbp + 0x90]
add rsi, r15
lea rbx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rbx, rdx
cmp rbx, rsi
je 0x14006cbed
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.1401523c0
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x14006cbd3
mov r15, qword [rbp + 0x90]
mov edx, socket
movabs rcx, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rsp + 0x5c]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rax + rdi], 0
jne 0x14006cc17
cmp rdi, rcx
ja 0x14006ce99
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
cmp rdi, 0x10
jae 0x14006cc53
mov qword [rbp + 0x70], rdi
mov r8, rdi
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x60]
call fcn.140147160
mov byte [rbp + rdi + 0x60], 0
jmp 0x14006cca3
mov rsi, rdi
or rsi, 0xf
cmp rsi, rcx
jbe 0x14006cc64
mov rsi, rcx
jmp 0x14006cc6c
cmp rsi, 0x16
cmovb rsi, rdx
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x60]
call fcn.140004ad0
mov rbx, rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rsi
mov r8, rdi
lea rdx, [rsp + 0x5c]
mov rcx, rax
call fcn.140147160
mov byte [rbx + rdi], 0
mov r15, qword [rbp + 0x90]
lea rdi, [rbp + 0x60]
mov r13, qword [rbp + 0x78]
cmp r13, 0x10
setae al
mov rsi, qword [rbp + 0x60]
cmovae rdi, rsi
lea rcx, [rbp + 0x60]
test al, al
mov rax, qword [rbp + 0x70]
je 0x14006cccf
mov rbx, rsi
lea r14, [rax + rsi]
jmp 0x14006ccd7
lea r14, [rcx + rax]
lea rbx, [rbp + 0x60]
cmp rbx, r14
je 0x14006cd06
sub rdi, rbx
nop
movsx ecx, byte [rbx]
call fcn.1401523c0
mov byte [rdi + rbx], al
inc rbx
cmp rbx, r14
jne 0x14006cce0
mov r15, qword [rbp + 0x90]
mov r13, qword [rbp + 0x78]
mov rax, qword [rbp + 0x70]
mov rsi, qword [rbp + 0x60]
lea rdi, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rdi, qword [rbp + 0x80]
lea r14, [rbp + 0x60]
cmp r13, 0x10
setae byte [rsp + 0x20]
cmovae r14, rsi
cmp r15, rax
ja 0x14006cda2
sub rax, r15
test r15, r15
je 0x14006ce42
lea r12, [rax + r14]
movsx edx, byte [rdi]
lea r8, [r12 + 1]
sub r8, r14
mov rcx, r14
call fcn.140148020
mov rbx, rax
test rax, rax
je 0x14006cd9f
nop
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140147d20
test eax, eax
je 0x14006cd92
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
movsx edx, byte [rdi]
mov rcx, rbx
call fcn.140148020
mov rbx, rax
test rax, rax
jne 0x14006cd60
jmp 0x14006cd9f
sub rbx, r14
cmp rbx, 0xffffffffffffffff
jne 0x14006ce42
xor r12d, r12d
cmp byte [rsp + 0x20], 0
je 0x14006cdda
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14006cdd2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ce93
mov rcx, rsi
call fcn.1401452fc
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14006cbe6
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14006ce3a
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ce35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ce9f
call fcn.1401452fc
mov rax, r12
jmp 0x14006cb17
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14006cdf1
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ce89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006ce93
call fcn.1401452fc
jmp 0x14006cdf1
call fcn.14014bf64
int3
call fcn.140002ae0
nop
call fcn.14014bf64
int3