Function at 0x140055cf4
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4e0
mov rax, qword [0x140173950]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor esi, esi
mov qword [rsp + 0x50], rsi
test rcx, rcx
jne 0x140055d41
mov eax, 0x80070057
jmp 0x14005627d
mov r8, rcx
lea rdx, str._lsCopyAcceleratorDllInjection.log
lea rcx, [rsp + 0x50]
call fcn.1400fb304
mov r15d, eax
test eax, eax
jns 0x140055da5
lea r12, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r12
je 0x140055d8e
test byte [rcx + 0x1c], 1
je 0x140055d8e
mov edx, 0xe4
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140055d9d
call fcn.140030ba0
mov eax, r15d
jmp 0x14005627d
mov r8d, 0x12
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140052308
nop
cmp qword [rbp + 0x18], rsi
je 0x14005624d
mov byte [rbp - 0x80], sil
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
lea rdx, str.Dump_started
lea rcx, [rbp - 0x70]
call fcn.1400510a4
xor ecx, ecx
call fcn.14000e944
mov qword [rsp + 0x68], rax
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x300]
call fcn.140032e00
lea rcx, [rsp + 0x68]
call fcn.14000e8fc
mov r9, rax
lea r8, str._A__c
mov edx, 0x64
lea rcx, [rbp + 0x300]
call fcn.140011864
test rax, rax
je 0x140055e4c
lea rdx, [rbp + 0x300]
lea rcx, [rbp - 0x70]
call fcn.1400510a4
mov rcx, rax
lea rdx, str.__local_
call fcn.1400510a4
lea rdx, str._nList_of_processes_that_have_copy_accelerator_dtour_dll_injected_in:_n
lea rcx, [rbp - 0x70]
call fcn.140050db0
mov rcx, rax
call fcn.140051e18
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x140055f22
call fcn.1400fb4fc
mov r15d, eax
test eax, eax
jns 0x140055f22
lea r12, [0x14016d280]
mov rcx, qword [0x14016d280]
cmp rcx, r12
je 0x140055ec3
test byte [rcx + 0x1c], 1
je 0x140055ec3
mov edx, 0xe5
mov r9d, eax
lea r8, [0x14012cc20]
mov rcx, qword [rcx + 0x10]
call fcn.140044380
nop
cmp qword [rbp + 0x18], rsi
je 0x140055ef3
lea rcx, [rbp - 0x68]
call fcn.14005f810
test rax, rax
jne 0x140055ef3
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a328
nop
lea rcx, [rbp + 0x38]
call fcn.140052c98
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x38]
call fcn.140052de0
nop
test rbx, rbx
je 0x140055d9d
mov rcx, rbx
jmp 0x140055d98
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r13, rsi
mov qword [rsp + 0x48], rsi
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0xa4]
call fcn.140032e00
mov dword [rbp + 0xa0], 0x238
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400561bb
lea r12, [0x14016d280]
mov r14, qword [rsp + 0x40]
cmp dword [rbp + 0xa8], esi
je 0x1400561a3
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
mov qword [rbp + 0x2f0], rsi
mov qword [rbp + 0x2f8], rsi
lea rax, [rbp + 0xcc]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x140055fa4
lea rdx, [rbp + 0xcc]
lea rcx, [rbp + 0x2e0]
call fcn.1400449b0
nop
mov rcx, qword [rsp + 0x38]
jmp 0x14005601c
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rcx + 0x10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x140055ff1
mov r9, qword [rcx]
cmp r8, qword [rbp + 0x2f0]
jne 0x140056018
test r8, r8
je 0x140056021
sub r9, rdx
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x140056018
add rdx, 2
sub r8, 1
jne 0x140056002
jmp 0x140056021
add rcx, 0x20
cmp rcx, r14
jne 0x140055fc9
cmp r14, rcx
jne 0x140056197
mov byte [rsp + 0x30], sil
mov dword [rsp + 0x58], esi
xor eax, eax
mov qword [rsp + 0x5c], rax
mov eax, dword [rbp + 0xa8]
mov dword [rsp + 0x60], eax
mov rcx, qword [0x14016d280]
cmp rcx, r12
je 0x14005606b
test byte [rcx + 0x1c], 4
je 0x14005606b
mov edx, 0x22
lea r8, [0x1401464f0]
mov rcx, qword [rcx + 0x10]
call fcn.140044360
lea rax, str.MpDetoursCopyAccelerator.dll
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400cfadc
mov r15d, eax
test eax, eax
jns 0x140056141
lea rdx, str.Failed_to_get_list_of_modules_for:
lea rcx, [rbp - 0x70]
call fcn.1400510a4
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
mov rcx, rax
call fcn.14005160c
lea rdx, [0x140133b8c]
mov rcx, rax
call fcn.140050db0
mov edx, dword [rbp + 0xa8]
mov rcx, rax
call fcn.1400530e8
mov rcx, rax
lea rdx, str.___hr0x
call fcn.140050db0
mov rsi, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140060c74
mov edx, r15d
mov rcx, rsi
call fcn.140052f84
mov rcx, rax
call fcn.140051e18
xor esi, esi
mov r15d, esi
cmp r14, r13
je 0x140056179
lea rdx, [rbp + 0x2e0]
mov rcx, r14
call fcn.140052628
add r14, 0x20
mov qword [rsp + 0x40], r14
jmp 0x140056197
cmp byte [rsp + 0x30], sil
je 0x140056197
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], 8
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
lea rcx, [rbp - 0x70]
call fcn.14005160c
mov rcx, rax
call fcn.140051e18
jmp 0x140056122
lea r8, [rbp + 0x2e0]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400513dc
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
lea rcx, [rbp + 0x2e0]
call fcn.140045590
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140055f75
lea rdx, str._nDone.
lea rcx, [rbp - 0x70]
call fcn.1400510a4
mov rcx, rax
call fcn.140051e18
lea rcx, [rbp - 0x68]
call fcn.14005f810
test rax, rax
jne 0x1400561fd
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a328
nop
lea rcx, [rsp + 0x38]
call fcn.14005f74c
nop
cmp rdi, 0xffffffffffffffff
je 0x140056218
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x18], rsi
je 0x140056248
lea rcx, [rbp - 0x68]
call fcn.14005f810
test rax, rax
jne 0x140056248
mov rax, qword [rbp - 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call fcn.14004a328
nop
jmp 0x140055ef3
lea rcx, [rbp + 0x38]
call fcn.140052c98
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rbp + 0x38], rax
lea rcx, [rbp + 0x38]
call fcn.140052de0
nop
test rbx, rbx
je 0x140056278
mov rcx, rbx
call fcn.140030ba0
mov eax, 0x80070005
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140030b80
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret