Function at 0x1400555cc
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4e0
mov rax, qword [0x140168900]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor esi, esi
mov qword [rsp + 0x50], rsi
test rcx, rcx
jne 0x140055619
mov eax, 0x80070057
jmp 0x140055b55
mov r8, rcx
lea rdx, str._lsCopyAcceleratorDllInjection.log
lea rcx, [rsp + 0x50]
call fcn.1400f23a4
mov r15d, eax
test eax, eax
jns 0x14005567d
lea r12, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x140055666
test byte [rcx + 0x1c], 1
je 0x140055666
mov edx, 0xd7
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140055675
call fcn.140030c60
mov eax, r15d
jmp 0x140055b55
mov r8d, 0x12
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.1400520b4
nop
cmp qword [rbp + 0x18], rsi
je 0x140055b25
mov byte [rbp - 0x80], sil
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
lea rdx, str.Dump_started
lea rcx, [rbp - 0x70]
call fcn.140050e4c
xor ecx, ecx
call fcn.14000ea14
mov qword [rsp + 0x68], rax
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x300]
call fcn.140032ec0
lea rcx, [rsp + 0x68]
call fcn.14000e9cc
mov r9, rax
lea r8, str._A__c
mov edx, 0x64
lea rcx, [rbp + 0x300]
call fcn.140011934
test rax, rax
je 0x140055724
lea rdx, [rbp + 0x300]
lea rcx, [rbp - 0x70]
call fcn.140050e4c
mov rcx, rax
lea rdx, str.__local_
call fcn.140050e4c
lea rdx, str._nList_of_processes_that_have_copy_accelerator_dtour_dll_injected_in:_n
lea rcx, [rbp - 0x70]
call fcn.140050b58
mov rcx, rax
call fcn.140051bc4
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x1400557fa
call fcn.1400f259c
mov r15d, eax
test eax, eax
jns 0x1400557fa
lea r12, [0x140162280]
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x14005579b
test byte [rcx + 0x1c], 1
je 0x14005579b
mov edx, 0xd8
mov r9d, eax
lea r8, [0x140123930]
mov rcx, qword [rcx + 0x10]
call fcn.140044450
nop
cmp qword [rbp + 0x18], rsi
je 0x1400557cb
lea rcx, [rbp - 0x68]
call fcn.14005e090
test rax, rax
jne 0x1400557cb
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a1b8
nop
lea rcx, [rbp + 0x38]
call fcn.140052a44
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x38]
call fcn.140052b8c
nop
test rbx, rbx
je 0x140055675
mov rcx, rbx
jmp 0x140055670
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r13, rsi
mov qword [rsp + 0x48], rsi
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0xa4]
call fcn.140032ec0
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140055a93
lea r12, [0x140162280]
mov r14, qword [rsp + 0x40]
cmp dword [rbp + 0xa8], esi
je 0x140055a7b
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
mov qword [rbp + 0x2f8], rsi
lea rax, [rbp + 0xcc]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14005587c
lea rdx, [rbp + 0xcc]
lea rcx, [rbp + 0x2e0]
call fcn.140044a80
nop
mov rcx, qword [rsp + 0x38]
jmp 0x1400558f4
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rcx + 0x10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400558c9
mov r9, qword [rcx]
cmp r8, qword [rbp + 0x2f0]
jne 0x1400558f0
test r8, r8
je 0x1400558f9
sub r9, rdx
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x1400558f0
add rdx, 2
sub r8, 1
je 0x1400558f9
jmp 0x1400558da
add rcx, 0x20
cmp rcx, r14
jne 0x1400558a1
cmp r14, rcx
jne 0x140055a6f
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x58], esi
xor eax, eax
mov qword [rsp + 0x5c], rax
mov eax, dword [rbp + 0xa8]
mov dword [rsp + 0x60], eax
mov rcx, qword [0x140162280]
cmp rcx, r12
je 0x140055943
test byte [rcx + 0x1c], 4
je 0x140055943
mov edx, 0x22
lea r8, [0x14013b288]
mov rcx, qword [rcx + 0x10]
call fcn.140044430
lea rax, str.MpDetoursCopyAccelerator.dll
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400c9b2c
mov r15d, eax
test eax, eax
jns 0x140055a19
lea rdx, str.Failed_to_get_list_of_modules_for:
lea rcx, [rbp - 0x70]
call fcn.140050e4c
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
mov rcx, rax
call fcn.1400513b8
lea rdx, [0x14012a41c]
mov rcx, rax
call fcn.140050b58
mov edx, dword [rbp + 0xa8]
mov rcx, rax
call fcn.140052e94
mov rcx, rax
lea rdx, str.___hr0x
call fcn.140050b58
mov rsi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.14005f524
mov edx, r15d
mov rcx, rsi
call fcn.140052d30
mov rcx, rax
call fcn.140051bc4
xor esi, esi
mov r15d, esi
cmp r14, r13
je 0x140055a51
lea rdx, [rbp + 0x2e0]
mov rcx, r14
call fcn.1400523d4
add r14, 0x20
mov qword [rsp + 0x40], r14
jmp 0x140055a6f
cmp byte [rsp + 0x30], sil
je 0x140055a6f
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
lea rcx, [rbp - 0x70]
call fcn.1400513b8
mov rcx, rax
call fcn.140051bc4
jmp 0x1400559fa
lea r8, [rbp + 0x2e0]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140051184
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
lea rcx, [rbp + 0x2e0]
call fcn.140045650
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14005584d
lea rdx, str._nDone.
lea rcx, [rbp - 0x70]
call fcn.140050e4c
mov rcx, rax
call fcn.140051bc4
lea rcx, [rbp - 0x68]
call fcn.14005e090
test rax, rax
jne 0x140055ad5
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a1b8
nop
lea rcx, [rsp + 0x38]
call fcn.14005dfcc
nop
cmp rdi, 0xffffffffffffffff
je 0x140055af0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x18], rsi
je 0x140055b20
lea rcx, [rbp - 0x68]
call fcn.14005e090
test rax, rax
jne 0x140055b20
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a1b8
nop
jmp 0x1400557cb
lea rcx, [rbp + 0x38]
call fcn.140052a44
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x38]
call fcn.140052b8c
nop
test rbx, rbx
je 0x140055b50
mov rcx, rbx
call fcn.140030c60
mov eax, 0x80070005
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140030c40
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret