Function at 0x14000de90
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rsi, rcx
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14000df1e
mov rdi, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000df42
lea rbx, [rsp + 0x54]
lea r14, [rsp + 0x28]
nop dword [rax]
mov rcx, rsi
mov rdx, rbx
call fcn.1400156b8
test eax, eax
je 0x14000df55
mov rcx, rdi
mov rdx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000def0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x490
jmp 0x14000df60
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400192f0
nop
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000df60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400192f0
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
mov si, 0xc163
add eax, 0x834ad133
stc
retf 0xff3b
cmp ebp, dword [rsi]
loopne 0x140067e2b
jle 0x140067e45
std
stc
ficomp word [rdx + 0x2931a642]
invalid
sub eax, dword [rax - 0x1b]
lodsd eax, dword [rsi]
invalid
sub dword [rdx - 0x1a], edx
rol dword [rsi - 0x6b], 1
push rdx
out 0xd1, al
xchg ebp, eax
fidiv dword [rbx]
clts
invalid
adc eax, 0xe9537320
sbb esp, 7
vaddsubps ymm6, ymm5, ymmword [rbx - 0x58bb370c]
hlt
enter 0xffffffffffffa744, 0x2d
invalid
push qword [rsi + 0x1e]
push rsi
xlatb
fld qword [rbx]
cmp eax, 0x325b8153
hlt
hlt
adc byte [rcx], ch
movabs byte [0xdb46dbe577654624], al
pop rdx
ficomp dword [rbx + rbx*4 + 0x2a]
ja 0x140067e93
or dl, cl
xlatb
popfq
mov byte [0x104f06828], dl
dec ch
xchg dl, bh
cli
mov dh, ch
sub eax, 0x377ad1b4
sub eax, 0x377ad1b4
mov edi, 0x8bfcf429
fucomi st(3)
jmp 0x140067e9f
invalid
cdq
lodsb al, byte [rsi]
mov dl, 0x80
add eax, 0x9bd4488b
pop qword [rdi + 0x5a]
add al, 7
sub al, byte [rdi]
mov ecx, ebp
ffreep st(2)
cmp ebx, edi
int 0x6a
call 0x14883619d
fnclex
jl case.0x14000df3b.12
invalid
fnclex
jl case.0x14000df3b.12
jns 0x140067eaa
mov dh, 0xc2
mov ah, 0x64
mov esi, 0xfe120d21
invalid
adc bh, dh
invalid
or eax, 0xff2ffe12
mul byte [rdx + 0x1f894e1c]
jo 0x140067f43
insb byte [rdi], dx
insb byte [rdi], dx
cmp dword [rbx], esi
invalid
loopne 0x140067e8f
jno 0x140067e9e
stosd dword [rdi], eax
xchg byte [rbp + 0x4791d0d0], dh
mov cl, 0x29
sbb al, 0x7d
invalid
jg 0x140067f96
fild qword [rbp - 0x1b]
invalid
push rax
imul ah
ret
ret 0xabfd
std
stosd dword [rdi], eax
add al, 0x25
sbb cl, al
invalid
movsd dword [rdi], dword [rsi]
or byte [r13 + 0x7a], cl
insd dword [rdi], dx
mov byte [rdi], cl
in eax, dx
movabs byte [0x490c96d7f7db7de6], al
or al, 0x49
or al, 0x49
mov ecx, 0xe0540c8f
out 0x19, al
invalid
mov bh, 0x1e
add al, 0xf9
scasb al, byte [rdi]
mov ecx, 0xfa3ff72a
sar ebp, cl
out 0xef, eax
invalid
outsd dx, dword [rsi]
mov dh, al
invalid
invalid
jg 0x140067f99
jp 0x140067f86
imul esp, ebp, 0xfbe9c380
in eax, dx
cmp spl, byte [rax - 0x77c7308b]
mov byte [rdi - 0x2d05e768], bh
mov byte [rdi - 0x2d05e768], bh
je case.0x14000df3b.26
pop rdi
sbb eax, 0x63cc5026
jmp 0x140068024
in al, 0x61
in al, 0x61
invalid
xor ah, byte [rdx - 0x21]
invalid
insb byte [rdi], dx
pop rsp
leave
loopne 0x140068019
or dword [r8], r8d
and ebp, eax
add byte [rbp + rsi - 0x4b5e2aba], ch
invalid
adc ecx, dword [rcx + 0x2e]
invalid
int1
xor esi, edi
pop rdi
pop rcx
pop rax
invalid
invalid
retf 0x57ba
insd dword [rdi], dx
fst dword [rbx + rax*2 - 0x4c082445]
invalid
fcomi st(7)
invalid
loop 0x140068003
sub al, 0x17
jge 0x140067fc3
adc al, 0xd2
and al, 0xec
invalid
cdq
jge 0x140068002
sub al, 0x2e
invalid
sbb byte [rax + 0x75], 0x1e
and bh, byte [rcx + 0x7a]
stc
fchs
sahf
out dx, eax
sbb dword [rsp + rbp*2], esi
fstp qword [rsi - 0x35]
invalid
pop rax
mov dword [rax - 0x640741a3], ebp
leave
imul edi, dword [rbp - 0x19], 0x74
sbb dword [rdi], 0xffffff8a
mov edx, 0xdc2492ea
call 0x157025c68
jo 0x1400680bf
xchg ecx, eax
enter 0x48e5, 0xffffffffffffffe9
jmp 0x1b0ae3042
invalid
jo 0x1400680ba
stc
add ebx, dword [rax]
ror dword [esi + 0x7b], 0xdb
call 0x160028012
ret 0x3d23
invalid
invalid
and edi, dword [0x1945b7d08]
xor dword [rsi], ebp
scasb al, byte [rdi]
lodsd eax, dword [rsi]
mov ecx, 0xbed41a4f
invalid
invalid
mov esp, 0xb36a52a1
movabs eax, dword [0xae89bd73ecb36a52]
jb 0x1400680ec
invalid
mov edx, 0x506db837
xor byte [rsi], al
hlt
popfq
jae 0x1400680fb
pop rcx
invalid
jmp 0x196856bf7
je 0x1400680fc
jl 0x1400680d8
xor al, 0x91
sub dword [rdx - 0x3b], ebx
invalid
or cl, byte [rsp + rsi*8]
fstp st(7)
mov esi, 0xb06677d9
sbb eax, 0xf32b9a56
invalid
movabs dword [0xb22d46324b0ae55f], eax
insb byte [rdi], dx
call 0x1b6770282
invalid
xchg edx, eax
add r8, rdx
xor eax, 0xc5f4b74
fnsave dword [rbx + 0xcd45e19]
sbb dword [rsi - 0x2c], ebx
or al, 0xc8
insd dword [rdi], dx
rcl dword [rdx], cl
ret 0x7435
sbb dword [rsi - 0x2c], ebx
or al, 0xc8
insd dword [rdi], dx
rcl dword [rdx], cl
invalid
call rsp
push rdi
invalid
sti
mov bh, 0x3c
mov ebx, 0xf0391235
invalid
int3
add eax, 0x72da0806
mov esp, 0xe004489c
jb 0x14006817a
pushfq
add al, 0xe0
loop 0x140068179
push 0xffffffffffffffd4
insw word [rdi], dx
je 0x140068226
lea edi, [rdi + 0x73b6147]
adc byte [rcx + 0xc], ch
adc ah, byte [rbx - 0x719f1442]
nop
jo 0x1400681b8
jno 0x140068208
jge 0x14006822b
xchg esp, eax
sbb al, 0x46
insd dword [rdi], dx
invalid
or al, 0xb0
push rsi
invalid
xchg edi, eax
sbb al, 0x9e
invalid
int 0x2a
stosd dword [rdi], eax
jae 0x140068285
xor bh, byte [0x10401abd1]
cmp dh, bh
div dword [rsi - 0x519954aa]
div dword [rsi - 0x519954aa]
movabs dword [0x3a15466c82a83b51], eax
and eax, 0x76e09d43
loopne 0x14006829e
invalid
rcr dword [rax], cl
push rcx
fnstcw word [r13 + 0x760b5716]
sbb byte [rcx + 0x4f], dl
fnstcw word [rbp + 0x760b5716]
sti
hlt
mov byte [rax], 0x5d
and ch, ah
fdiv qword [rdi]
pop rdx
cmp byte [rsi - 0xd], dl
invalid
mov word [rdi], ss
in eax, dx
fdivr dword [rcx + rdx*8]
adc eax, 0x6e623dc
in al, 0x53
fisttp dword [rdi - 0x53d0ecb]
cmp al, 0xa3
invalid
invalid
mov dh, 0xfe
mov eax, 0x39984bd7
scasb al, byte [rdi]
stosb byte [rdi], al
invalid