Function at 0x14008ca90
Capabilities:
Enumerate processes

Disassembly:
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
jmp 0x14008cac7
xor edx, edx
mov dword [rsp - 0x18], 0x1a2c6e80
xchg rdi, r13
mov qword [rsp + 0x170], r13
xchg rdi, r13
jmp 0x14008cc89
sub rsp, 0x5a6be917
add rsp, 0x5a6be7b7
mov rax, qword [0x1402567f0]
xor rax, rsp
jmp 0x14008cc4e
xor r8d, 0x3e21d9ce
xor r8d, 0x67aeb5a6
add r8d, 0x396cba2c
sub r8d, 0x66e248ef
jmp 0x14008cb99
xchg rcx, r13
cmp r8, rax
mov dword [rsp - 0x3c], 0x3128fa53
jne 0x14008ccf0
jmp 0x14008cca9
add dword [rsp + 0x20], 0x7144044
sub dword [rsp + 0x20], 0x2e99426f
xor dword [rsp + 0x20], 0x3ba7bf60
jmp 0x14008cb85
xor edx, edx
lea ecx, [rdx + 2]
mov rsp, rsp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
jmp 0x14008cb6e
nop dword [rax]
xchg rcx, rcx
inc rax
cmp byte [rcx + rax], 0
jne 0x14008cb54
xchg r8, r8
cmp qword [rbx + 0x18], 0x10
jmp 0x14008cc6b
xchg rsi, r13
mov r13, rax
xchg rsi, r13
test rax, rax
je 0x14008cd18
jmp 0x14008caaa
mov rcx, rsi
mov r15, r15
xor edi, edi
call sub.KERNEL32.dll_Process32First
test eax, eax
jmp 0x14008ccbb
lea rcx, [rsp + 0x24]
call fcn.1400ec5d0
mov r11, r11
lea rdx, [rsp + 0x20]
jmp 0x14008cbb0
mov dword [rsp + 0x20], 0x7e1cf357
xor dword [rsp + 0x20], 0x29859206
sub dword [rsp + 0x20], 0x54d3b6e2
add dword [rsp + 0x20], 0x207c6396
xor dword [rsp + 0x20], 0x2f9272b5
add dword [rsp + 0x20], 0x565c43cb
jmp 0x14008cb1e
movabs rax, 0xffffffff2a06ab6e
xor rax, 0x72b71377
xor rax, 0x275a500b
sub rax, 0x27397151
sub rax, 0xf82950e
xor rax, 0x7d6bc6e7
add rax, 0x2ed5a9d1
jmp 0x14008cc37
xor cl, 0x33
add cl, 0x40
xor cl, 0x22
xor cl, 0x56
jmp 0x14008ccf5
xchg rsi, rsi
xchg rcx, r13
mov r13, qword [rbx]
jmp 0x14008cb05
add rax, 0x1801966a
add rax, 0x7fffffff
add rax, 0x4e49871
jmp 0x14008cb4d
mov r8, r8
xchg r10, rax
mov qword [rsp + 0x150], r10
xchg r10, rax
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
jmp 0x14008cb3b
xchg rbx, rsp
mov rcx, rsp
xchg rsp, rbx
xchg r8, r13
mov r13, qword [rbx + 0x10]
xchg r8, r13
jb 0x14008cb08
jmp 0x14008cc29
mov r8d, 0x30653d42
add r8d, 0x2f2fcf93
sub r8d, 0x14fd5dcf
add r8d, 0x2a633481
jmp 0x14008cae4
lea rdx, [rsp + 0x4c]
call fcn.1400ecb20
mov rdx, rdx
jmp 0x14008ccd5
mov rcx, rcx
je 0x14008cd9d
nop dword [rax]
lea rcx, [rsp + 0x4c]
xchg rbx, rbx
nop
jmp 0x14008cbe5
test eax, eax
jne 0x14008ccf0
mov cl, 0x33
add cl, 0x28
xor cl, 0x4e
sub cl, 1
xor cl, 0x12
jmp 0x14008cc18
xor cl, cl
mov rbp, rbp
test cl, cl
lea eax, [rdi + 1]
lea rdx, [rsp + 0x20]
xchg r13, rcx
mov r13, rsi
jmp 0x14008cd5e
xchg rdx, rdi
mov rdx, qword [rsp + 0x170]
xchg rdi, rdx
xchg rbx, rcx
mov rbx, qword [rsp + 0x150]
jmp 0x14008cd4e
mov dword [rsp - 0x24], 0x6ba0eb32
xchg rbx, r12
mov r12, qword [rsp + 0x178]
xchg rbx, r12
sub rsp, 0xfffffffffffffea0
xchg r12, r12
nop
jmp 0x14008cd71
xchg rbx, rcx
xor rcx, rsp
call fcn.1400e9e80
jmp 0x14008cd28
xchg rcx, r13
cmove eax, edi
mov dword [rsp - 0x28], 0x556caa53
jmp 0x14008cd8b
add rsp, 8
mov rsi, qword [rsp - 8]
ret
xchg r8, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x14008cd0a
mov edi, eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14008ccc7
xchg rsp, rsp
xchg r8, rcx
mov r8, rsi
jmp 0x14008cd7b