Function at 0x140009ef0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
sub rsp, 0x250
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14004b080]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor edx, edx
mov rbx, rcx
xor r14d, r14d
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a06c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [rsi + 6]
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0x855dcb031d769571
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x140], rax
movabs rcx, 0x13386d726183c25b
movabs rax, 0x51110552724b3b43
mov qword [rbp + 0x1c0], rcx
mov qword [rbp + 0x148], rax
lea rcx, [0x14004c800]
movabs rax, 0x385fb02c6d1071e1
movabs rdi, 0xf17daf66711ff417
mov qword [rbp + 0x150], rax
movabs r14, 0x3465643700281b2c
movabs rax, 0xfb89de5199cbf12
mov qword [rbp + 0x1a0], rdi
mov qword [rbp + 0x158], rax
movabs r15, 0x5737c35c0c7e02c1
movabs rax, 0x13161e1712f0a738
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x160], rax
movabs rbx, 0x60caedc57ff39f66
movabs rax, 0xcbeb7b3ebee2fb0
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x168], rax
movdqa xmm2, xmmword [rbp + 0x160]
mov qword [rbp + 0x1b8], rbx
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
mov qword [rbp + 0x1c8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x160], xmm2
vmovdqa ymmword [rbp + 0x140], ymm1
vzeroupper
call fcn.1400069c0
mov rcx, rax
call fcn.14000db00
xor eax, eax
jmp 0x14000a1c1
xor edx, edx
lea rcx, [rbp + 4]
mov r8d, 0x12c
mov edi, r14d
call fcn.140016f00
lea rdx, [rbp]
mov dword [rbp], 0x130
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14000a171
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0x855dcb031d769571
lea rdx, [rbp + 0x140]
mov qword [rbp + 0x140], rax
lea rcx, [0x14004c800]
movabs rax, 0x46154443654f3b43
movabs rbx, 0x60caedc57ff39f66
mov qword [rbp + 0x148], rax
movabs rdi, 0xf17daf66711ff417
mov qword [rbp + 0x158], rbx
movabs r14, 0x3465643700281b2c
movabs r15, 0x5737c35c0c7e02c1
mov qword [rbp + 0x1a0], rdi
movabs rax, 0x5737ed2f7f1b61ae
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], rbx
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x140], ymm1
vzeroupper
call fcn.1400069c0
mov rcx, rax
call fcn.14000db00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000a1c1
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x14000a17e
mov rdx, qword [rbx]
lea rcx, [rbp + 0x2c]
call fcn.14001e848
mov ecx, eax
test eax, eax
jne 0x14000a191
mov r14d, dword [rbp + 8]
test ecx, ecx
lea eax, [rdi + 1]
lea rdx, [rbp]
mov rcx, rsi
cmovne eax, edi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000a171
test edi, edi
je 0x14000a164
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 1
jne 0x14000a1ed
mov rax, r14
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140014990
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0x9f18dd0317799d73
movabs rdx, 0x9cc2ac0d2832556e
mov qword [rbp + 0x1a0], rax
movabs rcx, 0x13386d726183c25b
movabs rax, 0x4c0a08556f5a3b58
mov qword [rbp + 0x1f8], rdx
mov qword [rbp + 0x1a8], rax
movabs rdi, 0xf17daf66711ff417
movabs rax, 0x2444a63f630c72e1
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x1b0], rax
lea rcx, [0x14004c3f0]
movabs rax, 0x12ea88b71ed3ec03
mov qword [rbp + 0x198], rdx
mov qword [rbp + 0x1b8], rax
lea rdx, [rbp + 0x1a0]
movabs rax, 0x33140a1c08edac2e
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x1c0], rax
movabs r14, 0x3465643700281b2c
movabs rax, 0x60dd97d6889c40d6
mov qword [rbp + 0x148], r14
mov qword [rbp + 0x1c8], rax
movabs r15, 0x5737c35c0c7e02c1
movabs rax, 0x63b4c541cceb700a
mov qword [rbp + 0x150], r15
mov qword [rbp + 0x1d0], rax
movabs rbx, 0x60caedc57ff39f66
movabs rax, 0xd0933b748eb63eb4
mov qword [rbp + 0x158], rbx
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x73c2bccb6768e1ca
vmovdqu ymm0, ymmword [rbp + 0x1c0]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xc81525eced025726
mov qword [rbp + 0x1e8], rax
movabs rax, 0xe59e21e444a1b37b
mov qword [rbp + 0x1f0], rax
movabs rax, 0xcbeb7b3ebee2fb0
mov qword [rbp + 0x168], rax
movabs rax, 0xa94b128ec8e0365
mov qword [rbp + 0x170], rax
movabs rax, 0xb1ff1b11e6c21eda
mov qword [rbp + 0x178], rax
movabs rax, 0x1ce2ceae0f0b8fbf
mov qword [rbp + 0x180], rax
movabs rax, 0xa9774e9f8c767754
vmovdqa ymmword [rbp + 0x1a0], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqu ymm0, ymmword [rbp + 0x1e0]
mov qword [rbp + 0x188], rax
movabs rax, 0xe59e21e444a19d09
vmovdqa ymmword [rbp + 0x1c0], ymm1
mov qword [rbp + 0x190], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vzeroupper
call fcn.1400069c0
mov rcx, rax
lea rdx, [0x140044950]
call fcn.1400069c0
movabs rax, 0x9f188f15027a8647
mov qword [rbp + 0x1a0], rdi
mov qword [rbp + 0x140], rax
movabs rax, 0x141c015c205a7e58
mov qword [rbp + 0x148], rax
movabs rax, 0x7943aa24695e6db5
mov qword [rbp + 0x150], rax
movabs rax, 0x60caedc57ff3b148
mov qword [rbp + 0x1a8], r14
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], rbx
vmovdqu ymm0, ymmword [rbp + 0x1a0]
mov qword [rbp + 0x158], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x140], ymm1
lea rdx, [rbp + 0x140]
lea rcx, [0x14004c3f0]
vzeroupper
call fcn.1400069c0
mov rcx, rax
lea rdx, [0x140044950]
call fcn.1400069c0
call fcn.14000abc0
xor ecx, ecx
call fcn.14001b574
int3