Function at 0x7ff741c060d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x7ff741cd7188]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rdi, rdx
mov r13, 0xffffffffffffffff
mov rax, r13
inc rax
cmp byte [rdx + rax], 0
jne 0x7ff741c06115
lea rsi, [rdx + 1]
add rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov ecx, 0xa
movabs r12, 0x7ffffffffffffffe
movabs r8, 0x7fffffffffffffff
xor r14d, r14d
cmp rdx, rsi
jne 0x7ff741c06167
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
jmp 0x7ff741c06268
mov rax, rsi
sub rax, rdx
mov rdx, r14
mov qword [rsp + 0x50], rdx
mov ebx, 7
mov qword [rsp + 0x58], rbx
cmp rax, r12
ja 0x7ff741c06553
cmp rax, 8
jb 0x7ff741c06220
mov rbx, rax
or rbx, 7
cmp rbx, r12
jbe 0x7ff741c061a3
mov rbx, r12
jmp 0x7ff741c061aa
cmp rbx, rcx
cmovb rbx, rcx
mov rcx, rbx
add rcx, 1
cmovb rcx, r13
cmp rcx, r8
ja 0x7ff741c06559
add rcx, rcx
cmp rcx, 0x1000
jb 0x7ff741c061fe
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff741c06559
mov rcx, rax
call fcn.7ff741ca8870
mov rcx, rax
test rax, rax
je 0x7ff741c0650e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x50]
jmp 0x7ff741c06212
test rcx, rcx
je 0x7ff741c0620f
call fcn.7ff741ca8870
mov rdx, qword [rsp + 0x50]
jmp 0x7ff741c06212
mov rax, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], rbx
nop dword [rax]
lea rcx, [rsp + 0x40]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x40]
movsx eax, byte [rdi]
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x50]
inc rdx
mov qword [rsp + 0x50], rdx
inc rdi
cmp rdi, rsi
je 0x7ff741c06252
mov rbx, qword [rsp + 0x58]
jmp 0x7ff741c06220
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
mov word [rax + rdx*2], r14w
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x7ff741c064d3
mov dword [rsp + 0x60], 0x130
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x7ff741c064ca
lea rcx, [rbp - 0x74]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff741c062a5
lea rsi, [rbp - 0x73]
add rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rax, [rbp - 0x74]
cmp rax, rsi
jne 0x7ff741c062e0
mov qword [rsp + 0x30], r14
mov eax, 7
mov qword [rsp + 0x38], rax
mov word [rsp + 0x20], r14w
jmp 0x7ff741c063fd
lea rcx, [rbp - 0x74]
mov rax, rsi
sub rax, rcx
lea rdi, [rbp - 0x74]
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov ebx, 7
mov qword [rsp + 0x38], rbx
cmp rax, r12
ja 0x7ff741c0654d
cmp rax, 8
jb 0x7ff741c063b0
mov rbx, rax
or rbx, 7
cmp rbx, r12
jbe 0x7ff741c06324
mov rbx, r12
jmp 0x7ff741c06331
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, r13
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x7ff741c0655f
add rcx, rcx
cmp rcx, 0x1000
jb 0x7ff741c0638f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x7ff741c0655f
mov rcx, rax
call fcn.7ff741ca8870
mov rcx, rax
test rax, rax
je 0x7ff741c064ba
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x30]
jmp 0x7ff741c063a3
test rcx, rcx
je 0x7ff741c063a0
call fcn.7ff741ca8870
mov rdx, qword [rsp + 0x30]
jmp 0x7ff741c063a3
mov rax, r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
nop dword [rax]
lea rcx, [rsp + 0x20]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x20]
movsx eax, byte [rdi]
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x30]
inc rdx
mov qword [rsp + 0x30], rdx
inc rdi
cmp rdi, rsi
je 0x7ff741c063e2
mov rbx, qword [rsp + 0x38]
jmp 0x7ff741c063b0
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rax, qword [rsp + 0x20]
mov word [rax + rdx*2], r14w
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x20]
cmp rax, 8
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.ucrtbase.dll__wcsicmp]
test eax, eax
je 0x7ff741c06478
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x7ff741c06465
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c06460
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff741c064ba
call fcn.7ff741ca88ac
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.kernel32.dll_Process32Next]
jmp 0x7ff741c06296
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x7ff741c064c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c064c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff741c064c1
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff741ca88ac
mov bl, 1
jmp 0x7ff741c064d5
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x7ff741c0651a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff741c06515
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff741c06515
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff741ca88ac
movzx eax, bl
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.7ff741ca8850
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.7ff741c01790
nop
call fcn.7ff741c01790
int3
call fcn.7ff741c016f0
nop
call fcn.7ff741c016f0
int3