Function at 0x140001600
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4b8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], 0xfffffffffffffffe
mov qword [rbp + 0x418], rcx
mov rcx, rdx
mov rdx, r8
call fcn.1400023a0
mov qword [rbp + 0x428], rax
mov ecx, 2
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
inc rax
cmp rax, 1
ja 0x140001698
call fcn.140002f10
mov rbx, rax
mov edi, edx
lea rcx, [rbp + 0x428]
call fcn.140002300
mov rax, qword [rbp + 0x418]
mov qword [rax + 8], rbx
mov dword [rax + 0x10], edi
mov ecx, 1
mov qword [rax], rcx
add rsp, 0x4b8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rbp + 0x1e0]
call fcn.1400021f0
mov dword [rbp - 0x58], 0x238
mov rax, qword [rbp + 0x1e4]
mov rcx, qword [rbp + 0x1f0]
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x48], rcx
movups xmm0, xmmword [rbp + 0x1f8]
movups xmmword [rbp - 0x40], xmm0
mov eax, dword [rbp + 0x208]
mov dword [rbp - 0x30], eax
lea rdx, [rbp + 0x20c]
lea r14, [rbp - 0x2c]
mov r8d, 0x208
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rbp - 0x58]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x1400017ad
mov ecx, 0x2c
xor eax, eax
lea r15, [rbp + 0x1e0]
lea r12, [rbp + 0x428]
lea r13, [rbp + 0x420]
lea rsi, [rbp - 0x58]
nop word cs:[rax + rax]
cmp word [rbp + rcx - 0x58], 0
je 0x140001750
add rcx, 2
inc rax
mov r8d, 0x104
cmp rcx, 0x234
jne 0x140001730
jmp 0x140001753
mov r8, rax
mov rcx, r15
mov rdx, r14
call fcn.140002210
mov rbx, qword [rbp + 0x1e8]
test byte [rbp + 0x1e0], 1
jne 0x1400017f6
mov qword [rbp + 0x420], rbx
mov rcx, r12
mov rdx, r13
call fcn.1400027b0
test al, al
jne 0x140001801
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
je 0x14000185f
mov rcx, r13
call fcn.140002300
xor eax, eax
mov ecx, 0x2c
jmp 0x140001730
call fcn.140002f10
mov qword [rbp + 0x1e8], rax
mov dword [rbp + 0x1f0], edx
mov qword [rbp + 0x1e0], 1
test rax, rax
je 0x1400017db
lea rcx, [rbp + 0x1e8]
call fcn.140002bf0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x1400018b2
call fcn.140002f10
jmp 0x14000165d
mov edi, dword [rbp + 0x1f0]
jmp 0x140001662
mov esi, dword [rbp - 0x50]
lea rcx, [rbp + 0x420]
call fcn.140002300
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x1400018bc
mov ecx, 0x1fffff
xor edx, edx
mov r8d, esi
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rsi, rax
dec rax
cmp rax, 0xfffffffffffffffe
jae 0x1400018e1
lea rcx, [rbp + 0x428]
call fcn.140002300
mov rax, qword [rbp + 0x418]
mov qword [rax + 8], rsi
xor ecx, ecx
jmp 0x140001681
call fcn.140002f10
mov qword [rbp + 0x1e8], rax
mov dword [rbp + 0x1f0], edx
mov qword [rbp + 0x1e0], 1
test rax, rax
je 0x14000188d
lea rcx, [rbp + 0x1e8]
call fcn.140002bf0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x1400018c6
lea rcx, [rbp + 0x420]
call fcn.140002300
mov edi, 0xffffffff
xor ebx, ebx
jmp 0x140001662
call fcn.140002f10
jmp 0x14000165d
call fcn.140002f10
jmp 0x14000165d
call fcn.140002f10
mov rbx, rax
mov edi, edx
lea rcx, [rbp + 0x420]
call fcn.140002300
jmp 0x140001662
call fcn.140002f10
jmp 0x14000165d