Function at 0x1400212d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140063030]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r12d, r8d
mov r15, rdx
xor ebx, ebx
mov edi, ebx
mov dword [rsp + 0x20], ebx
mov dword [rbp + 0x10], 0x238
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140021974
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14002196b
nop dword [rax + rax]
mov qword [rbp - 0x18], rbx
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
lea rax, [rbp + 0x3c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140021370
lea rdx, [rbp + 0x3c]
lea rcx, [rbp - 0x18]
call fcn.14001a720
nop
mov edx, 5
lea rcx, [rbp - 0x58]
call fcn.1400140c0
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
add r8, rdx
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x78]
call fcn.1400146e0
or edi, 0x10
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140021402
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400213fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219aa
call fcn.14002453c
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
or edi, 1
mov dword [rsp + 0x20], edi
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
lea r9, [rbp - 0x18]
mov rsi, qword [rbp - 0x18]
mov r14, qword [rbp]
cmp r14, 8
cmovae r9, rsi
mov rbx, qword [rbp - 8]
cmp rbx, qword [rbp - 0x68]
jne 0x140021483
mov r8, rbx
test rbx, rbx
je 0x140021767
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140021483
sub r9, rax
cmp cx, dx
ja 0x140021483
cmp r8, 1
je 0x140021767
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140021463
xor al, al
test al, al
jne 0x14002177c
mov edx, 6
lea rcx, [rbp - 0x38]
call fcn.1400140c0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
add r8, rdx
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x68]
call fcn.1400146e0
or edi, 0x20
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140021507
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219b0
call fcn.14002453c
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
or edi, 2
mov dword [rsp + 0x20], edi
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
lea r9, [rbp - 0x18]
cmp r14, 8
cmovae r9, rsi
cmp rbx, qword [rsp + 0x78]
jne 0x140021583
mov r8, rbx
test rbx, rbx
je 0x14002176e
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140021583
sub r9, rax
cmp cx, dx
ja 0x140021583
cmp r8, 1
je 0x14002176e
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140021563
xor al, al
test al, al
jne 0x14002177c
mov edx, 7
lea rcx, [rbp - 0x58]
call fcn.1400140c0
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
add r8, rdx
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x48]
call fcn.1400146e0
or edi, 0x40
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140021607
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219b6
call fcn.14002453c
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
or edi, 4
mov dword [rsp + 0x20], edi
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
lea r9, [rbp - 0x18]
cmp r14, 8
cmovae r9, rsi
cmp rbx, qword [rsp + 0x58]
jne 0x140021684
mov r8, rbx
test rbx, rbx
je 0x140021775
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140021684
sub r9, rax
cmp cx, dx
ja 0x140021684
cmp r8, 1
je 0x140021775
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140021664
xor al, al
test al, al
jne 0x14002177c
mov edx, 8
lea rcx, [rbp - 0x38]
call fcn.1400140c0
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
mov r8, qword [rbp - 0x28]
add r8, rdx
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x28]
call fcn.1400146e0
bts edi, 7
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140021709
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021704
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219bc
call fcn.14002453c
or edi, 8
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rax, qword [rsp + 0x28]
lea r8, [rbp - 0x18]
cmp r14, 8
cmovae r8, rsi
cmp rbx, qword [rsp + 0x38]
jne 0x140021763
test rbx, rbx
je 0x14002177c
movzx ecx, word [r8]
movzx edx, word [rax]
cmp cx, dx
jb 0x140021763
sub r8, rax
cmp cx, dx
ja 0x140021763
cmp rbx, 1
je 0x14002177c
dec rbx
add rax, 2
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140021747
xor bl, bl
jmp 0x14002177e
mov al, 1
jmp 0x140021485
mov al, 1
jmp 0x140021585
mov al, 1
jmp 0x140021686
mov bl, 1
test dil, 8
je 0x1400217e0
and edi, 0xfffffff7
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400217c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400217c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219c2
call fcn.14002453c
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], ax
jmp 0x1400217e2
xor eax, eax
test dil, 4
je 0x140021842
and edi, 0xfffffffb
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14002182f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021828
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219c8
call fcn.14002453c
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], ax
test dil, 2
je 0x1400218a0
and edi, 0xfffffffd
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14002188e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219ce
call fcn.14002453c
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
test dil, 1
je 0x1400218e9
and edi, 0xfffffffe
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400218e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400218e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219d4
call fcn.14002453c
test bl, bl
jne 0x14002191b
test r12d, r12d
je 0x1400218f8
cmp dword [rbp + 0x30], r12d
jne 0x14002191b
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x14002190e
mov eax, dword [rbp + 0x18]
mov dword [rdx], eax
add qword [r15 + 8], 4
jmp 0x14002191b
lea r8, [rbp + 0x18]
mov rcx, r15
call fcn.140021fa0
nop
cmp r14, 8
jb 0x140021952
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
mov rax, rsi
jb 0x14002194a
mov rsi, qword [rsi - 8]
sub rax, rsi
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400219a4
mov rcx, rsi
call fcn.14002453c
lea rdx, [rbp + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14002196b
xor ebx, ebx
jmp 0x140021350
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400244f0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002ae98
nop
call fcn.14002ae98
nop
call fcn.14002ae98
nop
call fcn.14002ae98
nop
call fcn.14002ae98
int3
call fcn.14002ae98
nop
call fcn.14002ae98
nop
call fcn.14002ae98
nop
call fcn.14002ae98
int3