Function at 0x140067f60
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.OLEAUT32.dll_VarUI8FromDec
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
xor edi, edi
mov r13d, edi
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call fcn.14011d670
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140068224
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rsp + 0x7c], 0
jne 0x140067ffb
mov r8, rdi
jmp 0x14006800e
lea rax, [rsp + 0x7c]
mov r8, rcx
inc r8
cmp word [rax + r8*2], 0
jne 0x140068003
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.14000b804
nop
lea rbx, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 8
cmovae rbx, r9
lea rax, [rsp + 0x20]
cmovae rax, r9
mov r11, qword [rsp + 0x30]
lea rax, [rax + r11*2]
lea r14, [rsp + 0x20]
cmovae r14, r9
mov r15, rax
sub r15, r14
inc r15
shr r15, 1
cmp r14, rax
mov r8d, 0
cmova r15, r8
test r15, r15
je 0x14006809c
sub r14, rbx
movzx ecx, word [r14 + rbx]
call fcn.140155970
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r15
jne 0x140068071
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, qword [rsi + 0x18]
cmp rcx, 8
jb 0x1400680ab
mov rbx, qword [rsi]
jmp 0x1400680ae
mov rbx, rsi
cmp rcx, 8
jb 0x1400680b9
mov rdx, qword [rsi]
jmp 0x1400680bc
mov rdx, rsi
mov rax, qword [rsi + 0x10]
lea rax, [rdx + rax*2]
cmp rcx, 8
jb 0x1400680cf
mov r15, qword [rsi]
jmp 0x1400680d2
mov r15, rsi
mov rdi, r8
mov r14, rax
sub r14, r15
inc r14
shr r14, 1
cmp r15, rax
cmova r14, r8
test r14, r14
je 0x140068118
sub r15, rbx
movzx ecx, word [r15 + rbx]
call fcn.140155970
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x1400680f0
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
cmp qword [rsi + 0x18], 8
jb 0x140068124
mov rdx, qword [rsi]
jmp 0x140068127
mov rdx, rsi
lea rcx, [rsp + 0x20]
cmp r10, 8
cmovae rcx, r9
mov rbx, qword [rsi + 0x10]
mov r8, rbx
cmp r11, rbx
cmovb r8, r11
test r8, r8
jmp 0x140068175
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14006815d
add rcx, 2
add rdx, 2
sub r8, 1
jmp 0x140068175
mov r8d, 1
cmp word [rcx], ax
mov rax, 0xffffffffffffffff
cmovb r8d, eax
xor edi, edi
jmp 0x14006817c
jne 0x140068147
xor edi, edi
mov r8d, edi
test r8d, r8d
jne 0x140068188
cmp r11, rbx
jb 0x140068188
jbe 0x1400681e8
cmp r10, 8
jb 0x1400681d6
lea rax, [r10 + 1]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14006821e
add rax, rax
cmp rax, 0x1000
jb 0x1400681ce
test byte [rsp + 0x20], 0x1f
jne 0x140068218
mov rax, qword [r9 - 8]
cmp rax, r9
jae 0x140068212
sub r9, rax
cmp r9, 8
jb 0x14006820c
cmp r9, 0x27
ja 0x140068206
mov r9, rax
mov rcx, r9
call fcn.1400eb7f4
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
jmp 0x140067fcf
mov r13d, dword [rsp + 0x58]
cmp r10, 8
jb 0x140068224
lea r8, [r10 + 1]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.14000c6f4
jmp 0x140068224
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
call fcn.140128ff4
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsi + 0x18]
cmp r8, 8
jb 0x140068246
inc r8
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.14000c6f4
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
cmp qword [rsi + 0x18], 8
jb 0x14006825c
mov rsi, qword [rsi]
mov word [rsi], di
mov eax, r13d
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret