Function at 0x7ff876eec360
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1bd0]
mov eax, 0x1cd0
call fcn.7ff876f161b0
sub rsp, rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff876eec3a2
xor al, al
mov rdi, qword [rsp + 0x1ce8]
add rsp, 0x1cd0
pop rbp
ret
lea rdx, [rbp + 0x130]
mov qword [rsp + 0x1ce0], rbx
mov rcx, rdi
mov dword [rbp + 0x130], 0x238
call qword [sym.imp.kernel32.dll_Process32FirstW]
test eax, eax
je 0x7ff876eec716
nop dword [rax]
mov eax, dword [0x7ff876f54ca0]
lea rcx, [rbp + 0x386]
movups xmm0, xmmword [0x7ff876f54c90]
mov dword [rbp + 0x380], eax
xor edx, edx
movzx eax, word [0x7ff876f54ca4]
mov r8d, 0x1f2
movaps xmmword [rbp + 0x370], xmm0
mov word [rbp + 0x384], ax
call fcn.7ff876f43bb0
mov eax, dword [0x7ff876f54cb8]
lea rcx, [rbp + 0x58e]
movups xmm0, xmmword [0x7ff876f54ca8]
mov dword [rbp + 0x588], eax
xor edx, edx
movzx eax, word [0x7ff876f54cbc]
mov r8d, 0x1f2
movups xmmword [rbp + 0x578], xmm0
mov word [rbp + 0x58c], ax
call fcn.7ff876f43bb0
mov eax, dword [0x7ff876f54cd0]
lea rcx, [rbp + 0x796]
movups xmm0, xmmword [0x7ff876f54cc0]
mov dword [rbp + 0x790], eax
xor edx, edx
movzx eax, word [0x7ff876f54cd4]
mov r8d, 0x1f2
movaps xmmword [rbp + 0x780], xmm0
mov word [rbp + 0x794], ax
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54cd8]
xor edx, edx
lea rcx, [rbp + 0x9a0]
mov r8d, 0x1f0
movups xmmword [rbp + 0x988], xmm0
movsd xmm0, qword [0x7ff876f54ce8]
movsd qword [rbp + 0x998], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54cf0]
xor edx, edx
lea rcx, [rbp + 0xba0]
mov r8d, 0x1f8
movaps xmmword [rbp + 0xb90], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d00]
mov eax, dword [0x7ff876f54d10]
lea rcx, [rbp + 0xdac]
xor edx, edx
mov dword [rbp + 0xda8], eax
mov r8d, 0x1f4
movups xmmword [rbp + 0xd98], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d18]
movzx eax, word [0x7ff876f54d30]
lea rcx, [rbp + 0xfba]
xor edx, edx
mov word [rbp + 0xfb8], ax
movaps xmmword [rbp + 0xfa0], xmm0
mov r8d, 0x1ee
movsd xmm0, qword [0x7ff876f54d28]
movsd qword [rbp + 0xfb0], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d38]
xor edx, edx
mov r8d, 0x1e8
movups xmm1, xmmword [0x7ff876f54d48]
lea rcx, [rbp + 0x11c8]
movups xmmword [rbp + 0x11a8], xmm0
movups xmmword [rbp + 0x11b8], xmm1
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d58]
xor edx, edx
lea rcx, [rbp + 0x13c8]
mov r8d, 0x1f0
movaps xmmword [rbp + 0x13b0], xmm0
movsd xmm0, qword [0x7ff876f54d68]
movsd qword [rbp + 0x13c0], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d70]
xor edx, edx
movups xmmword [rbp + 0x15b8], xmm0
mov r8d, 0x1f8
lea rcx, [rbp + 0x15c8]
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d80]
mov eax, dword [0x7ff876f54d90]
lea rcx, [rbp + 0x17d4]
xor edx, edx
mov dword [rbp + 0x17d0], eax
mov r8d, 0x1f4
movaps xmmword [rbp + 0x17c0], xmm0
call fcn.7ff876f43bb0
movups xmm0, xmmword [0x7ff876f54d98]
mov eax, dword [0x7ff876f54db8]
xor edx, edx
movups xmm1, xmmword [0x7ff876f54da8]
mov r8d, 0x1e4
mov dword [rbp + 0x19e8], eax
lea rcx, [rbp + 0x19ec]
movups xmmword [rbp + 0x19c8], xmm0
movups xmmword [rbp + 0x19d8], xmm1
call fcn.7ff876f43bb0
xor ebx, ebx
movsxd rax, ebx
lea rdx, [rbp + 0x370]
imul rcx, rax, 0x208
add rdx, rcx
lea rcx, [rbp + 0x15c]
call fcn.7ff876f221e8
test eax, eax
je 0x7ff876eec750
inc ebx
cmp ebx, 0xc
jl 0x7ff876eec636
mov r8d, dword [rbp + 0x138]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x7ff876eec6fe
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.kernel32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x7ff876eec6f5
lea rdx, [0x7ff876f54dc0]
lea rcx, [rsp + 0x20]
call fcn.7ff876f170d4
test rax, rax
jne 0x7ff876eec73a
lea rdx, [0x7ff876f54dd0]
lea rcx, [rsp + 0x20]
call fcn.7ff876f170d4
test rax, rax
jne 0x7ff876eec73a
lea rdx, [0x7ff876f54df0]
lea rcx, [rsp + 0x20]
call fcn.7ff876f170d4
test rax, rax
jne 0x7ff876eec73a
lea rdx, [0x7ff876f54e30]
lea rcx, [rsp + 0x20]
call fcn.7ff876f170d4
test rax, rax
jne 0x7ff876eec73a
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rdx, [rbp + 0x130]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_Process32NextW]
test eax, eax
jne 0x7ff876eec3d0
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x1ce0]
mov rdi, qword [rsp + 0x1ce8]
add rsp, 0x1cd0
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x7ff876eec721
mov rcx, rdi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov al, 1
jmp 0x7ff876eec721