Function at 0x7ff7a6156460
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x7ff7a673fab8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
xor r12d, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x7ff7a6156755
mov dword [rsp + 0x70], 0x238
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff7a6161080
nop
lea rdi, [rsp + 0x28]
mov r8, qword [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdi, r8
lea rcx, [rsp + 0x28]
cmovae rcx, r8
mov rax, qword [rsp + 0x38]
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x28]
cmovae rbx, r8
cmp rbx, rsi
je 0x7ff7a6156526
sub rdi, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
call qword [sym.imp.ucrtbase.dll_towlower]
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x7ff7a6156510
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x7ff7a61566ff
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.7ff7a6160f40
nop
lea rdi, [rsp + 0x48]
mov r14, qword [rsp + 0x60]
cmp r14, 8
setae al
mov r11, qword [rsp + 0x48]
cmovae rdi, r11
lea rcx, [rsp + 0x48]
test al, al
mov rax, qword [rsp + 0x58]
je 0x7ff7a615657c
mov rbx, r11
lea rsi, [r11 + rax*2]
jmp 0x7ff7a6156585
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x48]
cmp rbx, rsi
je 0x7ff7a61565b5
sub rdi, rbx
nop dword [rax]
movzx ecx, word [rbx]
call qword [sym.imp.ucrtbase.dll_towlower]
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x7ff7a6156590
mov r14, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rbx, qword [rsp + 0x28]
lea rsi, [rsp + 0x48]
cmp r14, 8
setae r13b
cmovae rsi, r11
mov rdi, qword [rsp + 0x38]
cmp rdi, rax
ja 0x7ff7a6156668
sub rax, rdi
test rdi, rdi
je 0x7ff7a61566c3
inc rax
lea r15, [rsi + rax*2]
mov rax, rsi
movzx r10d, word [rbx]
nop
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov rdx, r12
je 0x7ff7a615662a
cmp word [rax], r10w
je 0x7ff7a6156627
cmp rcx, 1
je 0x7ff7a615662a
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x7ff7a6156614
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x7ff7a6156663
mov r8, rdi
mov rdx, rbx
test rdi, rdi
je 0x7ff7a6156657
mov r9, rax
sub r9, rbx
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x7ff7a61566b5
add rdx, 2
sub r8, 1
jne 0x7ff7a6156643
sub rax, rsi
sar rax, 1
cmp rax, 0xffffffffffffffff
jne 0x7ff7a61566be
mov r15, qword [rsp + 0x20]
test r13b, r13b
je 0x7ff7a61566a2
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x7ff7a615669a
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7a6156749
mov rcx, r11
call fcn.7ff7a6330db8
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.kernel32.dll_Process32NextW]
jmp 0x7ff7a6156534
add rax, 2
jmp 0x7ff7a6156600
mov r15, qword [rsp + 0x20]
mov r12d, dword [rsp + 0x78]
cmp r14, 8
jb 0x7ff7a61566ff
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x7ff7a61566f7
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff7a6156749
mov rcx, r11
call fcn.7ff7a6330db8
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x7ff7a6156755
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7a6156750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7a6156750
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.7ff7a6330db8
mov eax, r12d
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.7ff7a6330880
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret