Function at 0x1400767c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x1400b1008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov r12d, r13d
mov qword [rsp + 0x38], r13
lea ecx, [r13 + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400768e4
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov dword [rsp + 0x40], 0x20
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable2]
cmp eax, 0x7a
jne 0x140076890
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x20], r13
mov ebx, dword [rsp + 0x40]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400768e4
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, 1
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable2]
test eax, eax
jne 0x1400768e4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r12, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x1400768e4
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140076920
nop
test r14, r14
je 0x1400768f8
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x20], r13
test r12, r12
je 0x14007690b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], r13
mov eax, 1
jmp 0x140076ae8
mov edx, 0x104
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov rbx, rax
cmp r15d, dword [rsp + 0x58]
je 0x140076a0e
mov edx, 0x104
lea rcx, [0x1400f24c8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
cmp rax, rbx
jne 0x14007696e
mov r8, rbx
lea rdx, [0x1400f2458]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
je 0x1400769a2
mov edx, 0x104
lea rcx, str.esrv_svc.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
cmp rax, rbx
jne 0x140076a0e
mov r8, rbx
lea rdx, [0x1400f3fb8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140076a0e
mov edx, 0x104
lea rcx, [0x1400f3b08]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov edi, r13d
cmp rbx, rax
sete dil
mov edx, dword [rsi]
shl rdx, 5
add rdx, 0x20
mov rcx, qword [rsi + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x140076a0e
mov qword [rsi + 8], rax
mov ecx, dword [rsi]
shl rcx, 5
xorps xmm0, xmm0
movups xmmword [rcx + rax], xmm0
movups xmmword [rcx + rax + 0x10], xmm0
mov edx, dword [rsi]
shl rdx, 5
mov rcx, qword [rsi + 8]
mov eax, dword [rsp + 0x58]
mov dword [rdx + rcx + 4], eax
mov ecx, dword [rsi]
shl rcx, 5
mov rax, qword [rsi + 8]
mov dword [rcx + rax], edi
inc dword [rsi]
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140076920
mov r15d, r13d
mov dword [rsp + 0x30], r13d
nop dword [rax]
cmp r15d, dword [rsi]
jae 0x140076abe
mov edi, r13d
mov dword [rsp + 0x2c], r13d
cmp edi, dword [r14]
jae 0x140076ab1
mov ebx, r15d
shl rbx, 5
mov rdx, qword [rsi + 8]
mov eax, edi
imul rcx, rax, 0x1c
mov eax, dword [rcx + r14 + 0x18]
cmp dword [rdx + rbx + 4], eax
jne 0x140076aa9
mov eax, dword [rcx + r14 + 4]
mov dword [rdx + rbx + 0xc], eax
mov eax, dword [rcx + r14 + 4]
cmp eax, 2
je 0x140076a88
cmp eax, 5
je 0x140076a88
mov rax, qword [rsi + 8]
mov dword [rbx + rax + 8], 0xffff
jmp 0x140076aa9
mov eax, dword [rcx + r14 + 0xc]
mov dword [rsp + 0x28], eax
movzx ecx, ax
mov dword [rsp + 0x28], ecx
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
mov rax, qword [rsi + 8]
mov dword [rbx + rax + 8], ecx
inc edi
mov dword [rsp + 0x2c], edi
jmp 0x140076a41
inc r15d
mov dword [rsp + 0x30], r15d
jmp 0x140076a30
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsp + 0x20], r13
test r12, r12
je 0x140076adf
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], r13
xor eax, eax
jmp 0x140076ae8
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001ea0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret