Function at 0x14005b7df
Capabilities:
Enumerate processes

Disassembly:
push rax
pushf
mov eax, 0xaee27db3
pushf
not eax
add eax, 0x1c3a835f
xor eax, 0xf947eb3
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x3d7510a9
xor eax, 0x7a5eacd0
rol eax, 0xf7
popf
cmp eax, 3
jne 0x14005b81c
popf
pop rax
jmp 0x14005baf0
cmp eax, 0xd
jne 0x14005b82b
popf
pop rax
jmp 0x14005bf8a
cmp eax, 0xa
jne 0x14005b83a
popf
pop rax
jmp 0x14005be1e
cmp eax, 9
jne 0x14005b849
popf
pop rax
jmp 0x14005bd84
cmp eax, 6
jne 0x14005b858
popf
pop rax
jmp 0x14005bc23
cmp eax, 2
jne 0x14005b867
popf
pop rax
jmp 0x14005ba51
cmp eax, 0xb
jne 0x14005b876
popf
pop rax
jmp 0x14005bebd
cmp eax, 1
jne 0x14005b885
popf
pop rax
jmp 0x14005b9f1
cmp eax, 5
jne 0x14005b894
popf
pop rax
jmp 0x14005bb68
cmp eax, 0xe
jne 0x14005b8a3
popf
pop rax
jmp 0x14005bfcb
cmp eax, 0
jne 0x14005b8b2
popf
pop rax
jmp 0x14005b8ee
cmp eax, 0xc
jne 0x14005b8c1
popf
pop rax
jmp 0x14005bf1b
cmp eax, 4
jne 0x14005b8d0
popf
pop rax
jmp 0x14005bb25
cmp eax, 8
jne 0x14005b8df
popf
pop rax
jmp 0x14005bcf3
cmp eax, 7
jne 0x14005b8ee
popf
pop rax
jmp 0x14005bcbd
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14003d040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x130
mov ecx, 0x6ea2781d
pushf
not ecx
add ecx, 0x15e2757f
xor ecx, 0x36c581b8
rol ecx, 0x47
popf
pushf
not ecx
add ecx, 0x420df02
xor ecx, 0x7285a48d
rol ecx, 0x88
popf
pushf
not ecx
add ecx, 0x7656d237
xor ecx, 0x5dbd80a3
rol ecx, 0xa7
popf
pushf
not ecx
add ecx, 0x1e9193e5
xor ecx, 0x7fc2e31b
rol ecx, 0xbc
popf
xor edx, edx
xor sil, sil
jmp 0x14005b97c
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14005b9be
push rax
pushf
mov eax, 0xcbeb1aec
pushf
not eax
add eax, 0x8cdeb2e
xor eax, 0x7b9586f6
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x651acc0
xor eax, 0x3eda5608
rol eax, 0xc1
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0x94560ff1
pushf
not eax
add eax, 0x3cd4d380
xor eax, 0x621cc0b4
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x305fd741
xor eax, 0x29aa427c
rol eax, 0x2b
popf
jmp 0x14005b80d
xor al, al
jmp 0x14005bfcb
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x14005ba5a
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14005babd
push rax
pushf
mov eax, 0x9f0bd746
pushf
not eax
add eax, 0x5afd348
xor eax, 0x5d0a8263
rol eax, 0x80
popf
pushf
not eax
add eax, 0x27e01525
xor eax, 0x28b208f8
rol eax, 0xde
popf
pushf
not eax
add eax, 0x7e9f5593
xor eax, 0x27c2efb7
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x29547b63
xor eax, 0x364dabb4
rol eax, 0xde
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0xd512e194
pushf
not eax
add eax, 0x363a1d0c
xor eax, 0x574a50fe
rol eax, 2
popf
pushf
not eax
add eax, 0x3d8604b9
xor eax, 0x63d05014
rol eax, 0xb9
popf
jmp 0x14005b80d
nop
push rax
pushf
mov eax, 0x289625ac
pushf
not eax
add eax, 0x747318d5
xor eax, 0x6630269c
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x34a7fb05
xor eax, 0x5ef3cd1c
rol eax, 0xa0
popf
jmp 0x14005b80d
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
push rax
pushf
mov eax, 0x79cfc083
pushf
not eax
add eax, 0x294ecef9
xor eax, 0x7a3a0b8a
rol eax, 0x45
popf
pushf
not eax
add eax, 0x1e8c1c2c
xor eax, 0x61eb5c31
rol eax, 0xc6
popf
jmp 0x14005b80d
inc rax
cmp byte [rcx + rax], sil
jne 0x14005bbca
push rax
pushf
mov eax, 0x5aa68a1d
pushf
not eax
add eax, 0x38b80c91
xor eax, 0x419ed8d6
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x56c947df
xor eax, 0x6e6fd355
rol eax, 4
popf
pushf
not eax
add eax, 0x1fee3a04
xor eax, 0x1dfbdd02
rol eax, 0xfe
popf
pushf
not eax
add eax, 0x57ad1984
xor eax, 0x7273892a
rol eax, 0xf1
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0x578420db
pushf
not eax
add eax, 0x4ae180a5
xor eax, 0xa0d3bd8
rol eax, 0xaf
popf
pushf
not eax
add eax, 0x17b6c259
xor eax, 0x4d9a7583
rol eax, 0x21
popf
pushf
not eax
add eax, 0x503c57fc
xor eax, 0x1cc9fc01
rol eax, 0x20
popf
pushf
not eax
add eax, 0x2c9c8e96
xor eax, 0x43978300
rol eax, 0x47
popf
jmp 0x14005b80d
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14005bc77
push rax
pushf
mov eax, 0x4c1b8cc6
pushf
not eax
add eax, 0x1eb5e65f
xor eax, 0x37b9c36c
rol eax, 0x44
popf
pushf
not eax
add eax, 0x5b70a5de
xor eax, 0x3edd0bb9
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x1924e051
xor eax, 0x595144d2
rol eax, 0xd5
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0x7e10c79
pushf
not eax
add eax, 0x330a7148
xor eax, 0x7383af89
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x13ddc2fb
xor eax, 0x10c135de
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x2011b3e3
xor eax, 0x4f62491d
rol eax, 9
popf
jmp 0x14005b80d
mov rcx, qword [rbx]
push rax
pushf
mov eax, 0x2983a16d
pushf
not eax
add eax, 0x6eb13178
xor eax, 0x53ba664e
rol eax, 0x61
popf
pushf
not eax
add eax, 0x777f09e2
xor eax, 0x4a4f9d59
rol eax, 0x94
popf
jmp 0x14005b80d
cmp r8, rax
jne 0x14005bd3e
push rax
pushf
mov eax, 0xca4067dd
pushf
not eax
add eax, 0x99234ae
xor eax, 0x5693a23b
rol eax, 0x62
popf
pushf
not eax
add eax, 0x484cef0a
xor eax, 0xb4a2726
rol eax, 0x29
popf
pushf
not eax
add eax, 0x377abf40
xor eax, 0x6d51c9eb
rol eax, 0xe5
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0x530e1da8
pushf
not eax
add eax, 0x3d34895d
xor eax, 0x1ba0228f
rol eax, 0xed
popf
pushf
not eax
add eax, 0x13131566
xor eax, 0x64c5cf33
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x2b8d554a
xor eax, 0x253026f1
rol eax, 0xed
popf
jmp 0x14005b80d
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005bdc5
push rax
pushf
mov eax, 0x88f73b96
pushf
not eax
add eax, 0x67aa60bd
xor eax, 0x205e9bc8
rol eax, 0xf
popf
pushf
not eax
add eax, 0x4bc5ca3a
xor eax, 0x6c4e4a63
rol eax, 0x5c
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0xcf34863
pushf
not eax
add eax, 0x7510fff1
xor eax, 0x32afd523
rol eax, 0x84
popf
pushf
not eax
add eax, 0x6e4a180c
xor eax, 0x370f2048
rol eax, 0x77
popf
pushf
not eax
add eax, 0x39cfcec9
xor eax, 0x382da133
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x5601812f
xor eax, 0xcafc6b6
rol eax, 0x46
popf
jmp 0x14005b80d
lea rdx, [rsp + 0x20]
mov rcx, rdi
jmp 0x14005be27
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005be8a
push rax
pushf
mov eax, 0x30edcdca
pushf
not eax
add eax, 0x5cb2e5df
xor eax, 0x3b10701c
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x72e5e312
xor eax, 0x2f7dd400
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x74a816f7
xor eax, 0x27808fde
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x1d487733
xor eax, 0x658c117c
rol eax, 0x6b
popf
jmp 0x14005b80d
push rax
pushf
mov eax, 0x7b7cc1c1
pushf
not eax
add eax, 0x48de8b06
xor eax, 0x36703e95
rol eax, 0x99
popf
pushf
not eax
add eax, 0x1a78815f
xor eax, 0x72825d6f
rol eax, 0x68
popf
jmp 0x14005b80d
jmp 0x14005bf8a
mov sil, 0xa4
pushf
not sil
add sil, 0x24
xor sil, 0x10
rol sil, 0xc1
popf
pushf
not sil
add sil, 0xf
xor sil, 0x70
rol sil, 0xd2
popf
push rax
pushf
mov eax, 0x8ad5d1ed
pushf
not eax
add eax, 0x19af10ad
xor eax, 0x2c6afe66
rol eax, 0x6c
popf
pushf
not eax
add eax, 0x72b5fca9
xor eax, 0x1dc41cb3
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x5f73a0fe
xor eax, 0x200c8b73
rol eax, 0x1e
popf
jmp 0x14005b80d
mov rcx, rdi
jmp 0x14005bf8e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
push rax
pushf
mov eax, 0x5b4a88e2
pushf
not eax
add eax, 0x1f646701
xor eax, 0x321ce3f5
rol eax, 0x28
popf
pushf
not eax
add eax, 0x26cfd50e
xor eax, 0x2f91e917
rol eax, 0x48
popf
jmp 0x14005b80d
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400ff118
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret