Function at 0x1400037c0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov rbx, qword [rcx + 8]
mov rsi, qword [rcx]
lea rdi, [rsi + rbx]
lea rax, [rsp + 0x40]
lea r13, [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x80], rbx
cmp rbx, 7
ja 0x140003840
mov r8, rbx
mov rdx, r13
cmp rsi, rdi
je 0x140003b64
xor eax, eax
nop word [rax + rax]
movsx cx, byte [rsi + rax]
mov word [rdx + rax*2], cx
add rax, 1
cmp rbx, rax
jne 0x140003820
jmp 0x1400039b1
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.140111bc0
mov r8, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rdx, rax
mov qword [rsp + 0x50], r8
cmp rsi, rdi
je 0x1400039b1
lea rax, [rax + rbx*2]
lea rcx, [rbx - 1]
cmp rsi, rax
jae 0x140003883
cmp rdx, rdi
jb 0x140003818
cmp rcx, 0xe
jbe 0x140003b6c
mov r9, rbx
mov rcx, rbx
pxor xmm3, xmm3
xor eax, eax
shr r9, 4
and rcx, 0xfffffffffffffff0
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqa xmm1, xmm3
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
punpcklbw xmm2, xmm1
punpckhbw xmm0, xmm1
movups xmmword [rdx + rax*2], xmm2
movups xmmword [rdx + rax*2 + 0x10], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x1400038a8
mov rax, r9
lea r9, [rsi + rcx]
shl rax, 5
add rax, rdx
cmp rbx, rcx
je 0x1400039b1
sub rbx, rcx
lea r10, [rbx - 1]
cmp r10, 6
jbe 0x140003937
movq xmm0, qword [rsi + rcx]
pxor xmm1, xmm1
lea r10, [rdx + rcx*2]
mov rcx, rbx
and rcx, 0xfffffffffffffff8
pcmpgtb xmm1, xmm0
movdqa xmm2, xmm0
lea rax, [rax + rcx*2]
add r9, rcx
and ebx, 7
punpcklbw xmm0, xmm1
punpcklbw xmm2, xmm1
pshufd xmm0, xmm0, 0x4e
movq qword [r10], xmm2
movq qword [r10 + 8], xmm0
je 0x1400039b1
movsx cx, byte [r9]
mov word [rax], cx
lea rcx, [r9 + 1]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 1]
mov word [rax + 2], cx
lea rcx, [r9 + 2]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 2]
mov word [rax + 4], cx
lea rcx, [r9 + 3]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 3]
mov word [rax + 6], cx
lea rcx, [r9 + 4]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 4]
mov word [rax + 8], cx
lea rcx, [r9 + 5]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 5]
mov word [rax + 0xa], cx
lea rcx, [r9 + 6]
cmp rdi, rcx
je 0x1400039b1
movsx cx, byte [r9 + 6]
mov word [rax + 0xc], cx
xor eax, eax
mov qword [rsp + 0x48], r8
mov ecx, 2
mov word [rdx + r8*2], ax
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003b60
lea r12, [rsp + 0x80]
mov rcx, rax
mov dword [rsp + 0x80], 0x130
mov rdx, r12
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140003b58
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x70]
lea rsi, [rsp + 0xac]
jmp 0x140003a47
cmp rcx, rbp
je 0x140003a34
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov rdx, r12
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140003b58
mov dword [rsp + 0x28], 0
mov r8, rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
call rdi
movsxd rdx, eax
xor r8d, r8d
mov rcx, r15
mov qword [rsp + 0x60], rbp
mov r14, rdx
call fcn.14010c920
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x28], r14d
mov r8, rsi
xor edx, edx
mov r9d, 0xffffffff
xor ecx, ecx
mov qword [rsp + 0x20], rax
call rdi
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
cmp rdx, qword [rsp + 0x68]
jne 0x140003a20
mov r8, qword [rsp + 0x40]
test rdx, rdx
je 0x140003b00
cmp r8, rcx
je 0x140003b00
test r8, r8
setne r9b
test rcx, rcx
setne al
cmp r9b, al
jne 0x140003a20
xor eax, eax
nop word [rax + rax]
movzx r11d, word [rcx + rax*2]
cmp word [r8 + rax*2], r11w
jne 0x140003a20
add rax, 1
cmp rdx, rax
jne 0x140003ae0
nop dword [rax]
mov rcx, rbx
call fcn.140002970
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x140003b21
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov ebx, 1
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x140003b3f
mov rax, qword [rsp + 0x50]
lea rdx, [rax + rax + 2]
call fcn.1401260d0
mov eax, ebx
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.140002970
xor ebx, ebx
jmp 0x140003b26
xor r8d, r8d
jmp 0x1400039b1
mov rax, rdx
mov r9, rsi
xor ecx, ecx
jmp 0x1400038f7