Function at 0x14007a3a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14015e098]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
mov dword [rbp - 0x70], 0x238
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14007a6a7
lea rdx, [rbp - 0x70]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14007a6a7
xor r13d, r13d
movabs r14, 0x6500780065002e
mov rbx, qword [0x1408500b0]
mov r15, qword [0x1408500b8]
cmp rbx, r15
je 0x14007a693
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
mov rsi, qword [rbx + 0x10]
cmp rcx, 0x10
jb 0x14007a453
add rsi, qword [rbx]
jmp 0x14007a45f
add rsi, rbx
mov rdi, rbx
cmp rcx, 0x10
jb 0x14007a462
mov rdi, qword [rbx]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov rdx, rsi
sub rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14006fa30
xor r9d, r9d
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400725b0
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x14007a4d6
lea rcx, [rdx + 4]
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x30]
cmp r8, 8
cmovae rax, qword [rsp + 0x30]
mov qword [rax + rdx*2], r14
mov word [rax + rcx*2], r13w
lea rax, [rsp + 0x30]
jmp 0x14007a4f7
mov qword [rsp + 0x20], 4
lea r9, str..exe
xor r8d, r8d
lea edx, [r8 + 4]
lea rcx, [rsp + 0x30]
call fcn.140073cd0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
lea rax, [rbp - 0x44]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x14007a535
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x50]
call fcn.14006ff70
lea rax, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rbp - 0x78]
cmp r14, 8
cmovae rax, rsi
lea r9, [rsp + 0x50]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
cmp r11, 8
cmovae r9, r10
mov r8, qword [rsp + 0x60]
cmp r8, qword [rbp - 0x80]
jne 0x14007a5c0
test r8, r8
je 0x14007a6e2
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x14007a5c0
sub r9, rax
cmp cx, dx
ja 0x14007a5c0
cmp r8, 1
je 0x14007a6e2
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x14007a5a0
xor dil, dil
cmp r11, 8
jb 0x14007a5fe
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14007a5f6
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a6ea
mov rcx, r10
call fcn.1400d6d80
cmp r14, 8
jb 0x14007a639
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14007a631
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a6ea
mov rcx, rsi
call fcn.1400d6d80
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14007a677
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007a672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007a6ea
call fcn.1400d6d80
test dil, dil
jne 0x14007a6f1
add rbx, 0x20
cmp rbx, r15
movabs r14, 0x6500780065002e
jne 0x14007a440
lea rdx, [rbp - 0x70]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14007a421
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400d64d0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dil, 1
jmp 0x14007a5c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3