Function at 0x14003cf90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x310], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r13, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp - 0x3c]
call fcn.140241ba0
mov dword [rbp - 0x40], 0x238
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r12
mov ebx, 0xf
mov r15d, ebx
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x20], r12b
lea rdx, [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003d30f
lea rdx, [rbp - 0x14]
lea rcx, [rbp - 0x80]
call fcn.14000fd70
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.140011f50
nop
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x40], 0
cmp qword [rax + 0x18], 8
jb 0x14003d05c
mov rax, qword [rax]
lea rdx, [rbp + 0x200]
mov rcx, rax
call fcn.140216fd4
test eax, eax
je 0x14003d3a2
lea rax, [rbp + 0x200]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14003d081
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x40]
call fcn.14001f680
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbx
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14003d0f5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d0f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d38a
call fcn.1400081a0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
mov byte [rsp + 0x40], 0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14003d120
lea rcx, [rsp + 0x20]
call fcn.1400155c0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14003d173
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d16d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d390
call fcn.1400081a0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14003d1b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d1ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d396
call fcn.1400081a0
lea rbx, [rsp + 0x20]
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0x10
cmovae rbx, r14
lea rsi, [rsp + 0x20]
cmovae rsi, r14
mov rdi, qword [rsp + 0x30]
add rsi, rdi
cmp rbx, rsi
je 0x14003d201
movsx ecx, byte [rbx]
call fcn.14024ba34
mov byte [rbx], al
inc rbx
cmp rbx, rsi
jne 0x14003d1e0
mov r15, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
cmp r15, 0x10
cmovae rcx, r14
mov r8, rdi
cmp rdi, 0xf
mov ebx, 0xf
cmova r8, rbx
lea rdx, str.revouninpro.exe
call fcn.140241de0
test eax, eax
jne 0x14003d237
cmp rdi, rbx
je 0x14003d2c0
lea rcx, [rsp + 0x20]
cmp r15, 0x10
cmovae rcx, r14
mov r8, rdi
cmp rdi, 0xc
mov eax, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
cmova r8, rax
lea rdx, str.revounin.exe
call fcn.140241de0
test eax, eax
jne 0x14003d26a
cmp rdi, 0xc
je 0x14003d2c0
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14003d2aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d2a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d39c
call fcn.1400081a0
lea rdx, [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14003d314
jmp 0x14003d022
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12d, dword [rbp - 0x38]
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14003d31e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003d308
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d39c
call fcn.1400081a0
jmp 0x14003d31e
mov r14, qword [rsp + 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp r15, 0x10
jb 0x14003d351
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14003d349
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003d384
mov rcx, r14
call fcn.1400081a0
mov eax, r12d
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.1402155d0
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14024b534
nop
call fcn.14024b534
nop
call fcn.14024b534
nop
call fcn.14024b534
nop
call fcn.14024b534
nop
lea rcx, str.invalid_wchar_t_filename_argument
call fcn.140216924
int3