Function at 0x140027b00
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.OLEAUT32.dll_VarUI8FromDec
sub rsp, 0x290
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
xor edi, edi
mov r13d, edi
xor edx, edx
lea ecx, [rdi + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x50]
call fcn.1400ad030
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140027dc4
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rdi
mov word [rsp + 0x20], di
cmp word [rsp + 0x7c], 0
jne 0x140027b9b
mov r8, rdi
jmp 0x140027bae
lea rax, [rsp + 0x7c]
mov r8, rcx
inc r8
cmp word [rax + r8*2], 0
jne 0x140027ba3
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x20]
call fcn.1400237c0
nop
lea rbx, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 8
cmovae rbx, r9
lea rax, [rsp + 0x20]
cmovae rax, r9
mov r11, qword [rsp + 0x30]
lea rax, [rax + r11*2]
lea r14, [rsp + 0x20]
cmovae r14, r9
mov r15, rax
sub r15, r14
inc r15
shr r15, 1
cmp r14, rax
mov r8d, 0
cmova r15, r8
test r15, r15
je 0x140027c3c
sub r14, rbx
movzx ecx, word [r14 + rbx]
call fcn.1400e42a0
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r15
jne 0x140027c11
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
xor r8d, r8d
mov rcx, qword [rsi + 0x18]
cmp rcx, 8
jb 0x140027c4b
mov rbx, qword [rsi]
jmp 0x140027c4e
mov rbx, rsi
cmp rcx, 8
jb 0x140027c59
mov rdx, qword [rsi]
jmp 0x140027c5c
mov rdx, rsi
mov rax, qword [rsi + 0x10]
lea rax, [rdx + rax*2]
cmp rcx, 8
jb 0x140027c6f
mov r15, qword [rsi]
jmp 0x140027c72
mov r15, rsi
mov rdi, r8
mov r14, rax
sub r14, r15
inc r14
shr r14, 1
cmp r15, rax
cmova r14, r8
test r14, r14
je 0x140027cb8
sub r15, rbx
movzx ecx, word [r15 + rbx]
call fcn.1400e42a0
mov word [rbx], ax
lea rbx, [rbx + 2]
inc rdi
cmp rdi, r14
jne 0x140027c90
mov r10, qword [rsp + 0x38]
mov r11, qword [rsp + 0x30]
mov r9, qword [rsp + 0x20]
cmp qword [rsi + 0x18], 8
jb 0x140027cc4
mov rdx, qword [rsi]
jmp 0x140027cc7
mov rdx, rsi
lea rcx, [rsp + 0x20]
cmp r10, 8
cmovae rcx, r9
mov rbx, qword [rsi + 0x10]
mov r8, rbx
cmp r11, rbx
cmovb r8, r11
test r8, r8
jmp 0x140027d15
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140027cfd
add rcx, 2
add rdx, 2
sub r8, 1
jmp 0x140027d15
mov r8d, 1
cmp word [rcx], ax
mov rax, 0xffffffffffffffff
cmovb r8d, eax
xor edi, edi
jmp 0x140027d1c
jne 0x140027ce7
xor edi, edi
mov r8d, edi
test r8d, r8d
jne 0x140027d28
cmp r11, rbx
jb 0x140027d28
jbe 0x140027d88
cmp r10, 8
jb 0x140027d76
lea rax, [r10 + 1]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140027dbe
add rax, rax
cmp rax, 0x1000
jb 0x140027d6e
test byte [rsp + 0x20], 0x1f
jne 0x140027db8
mov rax, qword [r9 - 8]
cmp rax, r9
jae 0x140027db2
sub r9, rax
cmp r9, 8
jb 0x140027dac
cmp r9, 0x27
ja 0x140027da6
mov r9, rax
mov rcx, r9
call fcn.14007b810
lea rdx, [rsp + 0x50]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
jmp 0x140027b6f
mov r13d, dword [rsp + 0x58]
cmp r10, 8
jb 0x140027dc4
lea r8, [r10 + 1]
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.1400146a0
jmp 0x140027dc4
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
call fcn.1400e463c
int3
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsi + 0x18]
cmp r8, 8
jb 0x140027de6
inc r8
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.1400146a0
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
cmp qword [rsi + 0x18], 8
jb 0x140027dfc
mov rsi, qword [rsi]
mov word [rsi], di
mov eax, r13d
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret